Notes
What to ask an IT provider before you sign anything
I spent fourteen years hiring and firing them. The questions that actually matter are not the ones on the sales call.
For fourteen years I was the person on the other side of this conversation. My last proper job was running infrastructure for a freight company in Laverton, and part of it was hiring — and more often firing — the outside providers who looked after the bits we didn’t do ourselves. I have sat through the meeting where a man in a good shirt walks you up his managed-services tiers. I have also spent a fortnight of my life prising a domain name out of a provider who had quietly registered it in his own name in 2011, with his personal Gmail as the contact. So when a café owner two doors down asks me how to pick an IT person, I don’t give a gentle answer.
The questions people ask on a sales call are about certifications, years in business, whether he’ll come out on a Saturday. Fair enough, but none of it tells you what happens on the worst day, which is the day the relationship ends. These are the ones that sort the good providers from the ones who will hold you to ransom, roughly in the order I’d ask them.
The domain name is where people get stuck
Your domain name — the yourbusiness.com.au that your email and your website hang off — is a licence held by a registrant. The registrant is the legal holder. The company you pay to look after it is the registrar, or more often a reseller sitting on top of a registrar. Those are two different things, and a distressing number of small businesses have their provider sitting in the registrant field instead of themselves. When that happens you don’t own your own name. You are renting it from the person you are trying to leave.
Untangling that at the freight company took a fortnight and a fairly pointed letter, and we were an outfit with a legal team on the floor above. A café would simply have been stuck.
The check takes two minutes and anyone can run it. Go to the auDA WHOIS lookup at whois.auda.org.au, type in your .com.au or .au domain, and read the registrant details. If it is your business name and your ABN, good. If it is your provider’s company, or a person’s name you only half recognise, that is a problem you fix before you sign anything else. Ask any prospective provider, in writing: will my business be the registrant of my domain, and will I have the login to the registrar account? “Don’t worry, we manage all that for you” is not a yes.
Where the credentials live
The second question is about keys. Every part of your setup sits behind a login, and someone holds the master version of each one. If that someone is only ever your provider, you have handed a stranger the ability to lock you out of your own business. I am not being dramatic. I know a builder who lost his Microsoft 365 email because the global admin account belonged to his IT company, and the IT company went under. Seven years of invoices, quotes and correspondence, sitting behind a login nobody left standing could reset.
So ask where the credentials are stored, and whether you can get them if the provider vanishes tomorrow. There is a short list of accounts you should personally hold the top-level login to, or at the very least be a co-administrator on:
- The domain registrar account.
- DNS — the settings that point your domain at your website and your email. Often the same account, sometimes not.
- Your Microsoft 365 or Google Workspace tenant, as a global or super admin, not an ordinary user.
- Your website hosting, and the content management login if you have one.
- The password manager itself, if they have set one up on your behalf.
A decent provider has no trouble with you owning all of these while they do the day-to-day work. The ones who go twitchy when you ask to be global admin of your own Microsoft tenant are telling you something. “We’ll just use our account” means their account, their control, your dependence.
Response times and what a retainer actually buys
On the sales call everyone is very responsive. Get it in the agreement instead: how quickly they acknowledge a request, and how that changes when your email is down as opposed to when a printer is sulking. A provider who will put “we respond to urgent issues within two business hours” on paper is worth more than one who says it warmly and commits to nothing.
Their work is covered by the Australian Consumer Law whether they mention it or not. Services have to be supplied with due care and skill and be fit for any purpose you made known, and those guarantees reach business purchases costing under $100,000 including GST. That is a floor rather than a substitute for a written scope, but it does mean “we did our best” is not the standard the law holds them to.
As for money, a monthly retainer tends to buy a defined number of support hours, patching and monitoring of your machines, management of your email and backups, and a person who knows your setup so you are not explaining it from scratch every time. What it usually does not buy is project work. Moving to new email, standing up a new site, rebuilding after a break-in: those get quoted separately. Ask what sits inside the monthly figure, and get the outside-it hourly rate before you need it rather than after.
Hardware, margins and the question they hate
Ask them plainly whether they resell hardware and software at a margin, and whether that shapes what they recommend. There is nothing wrong with a fair markup on a laptop or a firewall. There is a great deal wrong with steering a café onto a $4,000 server it does not need because the margin is fat, when a $15-a-month cloud service would have done the job.
Payments are where this bites hardest right now. If your IT person also sells you your card terminal, know the going rate before they quote. A Zeller terminal is $99 at the moment, discounted off a $199 list price, and takes 1.4 per cent on an in-person tap, GST included. A Square Reader is $65 and 1.6 per cent. Those are the numbers to hold a bundled “point-of-sale solution” against.
From 1 October 2026 the ground shifts underneath all of it. Following the Reserve Bank’s review of merchant card payment costs, surcharging is being removed on eftpos, Mastercard and Visa, so you can no longer pass that percentage to the customer at the counter. It comes out of your margin instead. That turns the rate your provider signs you up to into a real recurring cost rather than a number you forget about, which is exactly the sort of thing a provider earning a trailing commission would rather you did not dwell on.
The exit conversation, on day one
Have the breakup conversation on the first day, while everyone is still friendly. If we part ways, what do I get back, in what format, and how long does it take? A good answer is specific: you keep your domain and every admin login because they were always yours, we export your data in a standard format, we give thirty days of handover to your next provider. A bad answer is a long pause.
Put whatever they say into the agreement. Ask, too, for read access to your own documentation — the written record of how your systems are put together — because when a provider disappears, that map tends to go with them. Keep your own copies of anything that matters regardless. The ATO expects you to hold business records for five years, counted from the later of getting the record or completing the transaction it relates to, and you cannot do that if your invoices live somewhere only your ex-provider can reach.
The one to walk away from is the one who makes you feel difficult for asking. I have been difficult for asking, professionally, for most of my working life. It has saved the people I work with a fair amount of money and at least one very bad fortnight.