Who holds the passwords? Why every sailing club needs an access register
When a volunteer stands down, the club's logins often go with them. How to get back in, and why a simple access register stops it happening again.
Every account your sailing club relies on should be registered to the club rather than to an individual, should have at least two people who can get into it, and should be written down in one place. That place is an access register, and it's one of the simplest and most valuable things a club can keep. Clubs that have one can usually get through an AGM handover in an evening, while clubs that don't often only discover what they've lost when the domain name expires and the website and email stop working.
What accounts does a sailing club actually have?
Usually more than the committee realises. A typical club will have most of these:
- the domain name, and the company it's registered with
- the website, or the website builder it runs on
- the club email addresses
- the membership system
- the service that takes card or Direct Debit payments online
- online banking
- the Facebook page, Instagram and any other social media accounts
- the WhatsApp groups and their admins
- results or scoring software, and any licences that go with it
- the Google or Microsoft account that holds the club's shared documents
- the mailing tool used for the newsletter
- the clubhouse Wi-Fi and the router's admin login
Why does it go wrong?
Most club accounts were set up by whoever needed them at the time, using their own email address and sometimes their own bank card. That can work perfectly well for years, until the person stands down, moves away or falls out with the committee, and the account is still in their name.
When that happens, the renewal reminders go to an inbox nobody at the club reads and the card on file eventually expires, so the first anyone knows about the problem is usually when something stops working.
The person with the passwords has left. How do you get back in?
The obvious first step is simply to ask. Most people who stand down are glad to hand things over, and it's far quicker than any recovery process. It's worth doing by email so there's a record, and listing exactly what you need so nothing is missed.
If that doesn't work, it's a case of taking each account in turn:
- The domain name. This matters most, because the website and email both depend on it. Whoever is named as the registrant is the legal owner, so if that's an individual rather than the club, you'll need them to transfer it. If they won't or can't, contact the registrar, explain the position and ask what evidence they need that the club is the rightful owner. It's much easier to sort out before the renewal date than after it.
- Payment services and online banking. Contact the provider with the committee minute that gives the new officers their authority. They'll have a process for changing who controls the account.
- Social media. The platforms do have recovery processes, but they can be slow, which is why it pays to make sure every page has more than one admin in the first place.
- Everything else. For some tools it's genuinely quicker to set up a new account in the club's name, move across what matters, and let members know about the change.
What goes in an access register?
A single table, kept somewhere the committee can see it, with one row for each account:
| Column | What to record |
|---|---|
| Account | The name of the tool or service |
| What it's for | A one-line description |
| Registered to | A club email address, never a personal one |
| Admins | At least two named people |
| Recovery | The email address and phone number used to recover the account |
| Renews | The renewal date and cost |
| Last checked | When someone last confirmed the details are right |
The register records who has access and where the password is kept, but it should never contain the passwords themselves.
Where should the passwords live?
The safest place is a password manager that lets you share a vault between named people, so that each officer has their own login and their access can be removed when they leave. Several of the well-known password managers offer discounts for charities and not-for-profit groups, so it's worth checking what your club qualifies for.
Two other habits make a real difference. The first is to register accounts with role-based email addresses such as secretary@ or treasurer@ rather than personal ones, so the address passes to the next person in the role along with everything registered to it. The second is to turn on two-step verification and make sure the codes go to more than one person, rather than to a single volunteer's phone.
What should happen at the AGM handover?
A short routine, repeated every year, keeps the register honest:
- Incoming officers are given their own logins to the tools they need.
- Outgoing officers' access is removed, politely and promptly.
- Recovery email addresses and phone numbers are updated.
- The register is updated and dated.
- Anything due to renew in the next three months is checked.
It's rarely more than an evening's work, and it's the difference between a handover and a hunt.
Keeping the register current is a natural part of the digital officer's role, and a good reason for the club to have one.
Keeping it up to date
The Club CTO toolkit includes an access register template, and keeping it current is exactly the kind of thing the monthly clinic with your digital officer is there for.