Keep cloud accounts under buyer ownership
AWS, Azure, Google Cloud, DNS, source control and monitoring should normally remain in buyer-controlled organizations. Give named users and roles to the provider instead of allowing infrastructure to be created inside an agency account that becomes hard to transfer later.
Use infrastructure as code
Terraform, CloudFormation, Bicep or equivalent tooling makes infrastructure reviewable and repeatable. Changes can pass through version control, peer review and deployment pipelines instead of being hidden as manual console clicks.
Separate production privileges
Developers do not all need administrator access. Use least privilege, short-lived credentials and stronger approval for high-risk production actions. Maintain a break-glass process for emergencies.
Centralize secrets
API keys, database passwords and certificates should live in appropriate secret stores rather than chat messages, source repositories or local text files. Rotate sensitive credentials when staff change.
Define observability before incidents
Agree on logs, metrics, alerts, dashboards and who receives them. A vendor cannot meet an uptime expectation if neither side can see the system failing.
Test backups and recovery
A backup policy is not proven until restoration works. Run recovery tests and document the target recovery time and data-loss tolerance for critical systems.
Plan offboarding from day one
Infrastructure code, architecture diagrams, runbooks, certificates, dashboards and provider accounts should be transferred as part of normal delivery. The buyer should be able to operate or reassign the environment without the original vendor.
Separate deployment speed from change control
Automation should make safe changes easier, not make uncontrolled production changes faster. Define which environments deploy automatically, which require review and who may approve emergency changes.
Track cost as an operational signal
Cloud spend can drift through oversized resources, forgotten environments and data-transfer patterns. Ask the provider to expose cost allocation and alert on unusual changes so optimization is part of operations rather than an annual surprise.
Define incident ownership across time zones
If the offshore team is expected to respond to production incidents, document who is on call, which alerts require action, what changes may be made without approval and how the buyer is notified. A 24/7 promise is only meaningful when escalation and authority are concrete.