Most co-hosts never choose a tool stack. They inherit one login at a time. The listing sits on the owner's platform account. The smart lock app is registered to the owner's email because that's who was standing there when the installer set it up. The pricing tool renews on a card you've never seen. Each of those arrived as a convenience, and individually none of them looks like a problem. Together they mean you are running your operation on credentials belonging to five different people, none of whom work for you and any of whom can change a password without telling you.

The audit is three columns and takes about ten minutes per property: who pays, who owns the login, who receives the recovery code. Write every tool down — listing account, lock, pricing, PMS, cleaner scheduling, payouts, the Wi-Fi router admin page. Any row where all three columns say "owner" is a tool you operate but do not control. Any row where your access is a shared password rather than a named seat is a row that breaks the first time that password changes or the platform forces a reset. The goal is not to move everything into your name. It is to know in advance which rows can strand you mid-turnover.

Where the platform offers real delegated access, use it instead of the owner's password. Airbnb's co-host feature is the clearest example: the listing owner invites you under your own verified account and picks the permission level — full access, calendar and messaging, or calendar only — and can change or remove it at any time (Airbnb Help Center, "Add co-hosts to your home listing": airbnb.com/help/article/1244). Named access is better for both sides. Two-factor codes come to your phone rather than the owner's. The activity log shows who actually changed the price. And when the relationship ends, revocation is one deliberate click instead of a password change you discover at 11pm on a Saturday.

Draw the line by portability, not by who offers to pay. Tools that follow you from owner to owner — your PMS and unified inbox, cleaner scheduling, your reporting — belong in your account, billed to you, and priced into your fee. Tools bound to one property or one tax ID — the listing account, the payout method, the insurance policy — belong to the owner. The expensive mistake is letting a generous owner put your operating layer inside their account. That is a discount today and a migration later, and you will be doing that migration during an offboarding, which is the worst week of the year to do it.

Export monthly, because access ends the same afternoon the contract does. Reservation history, message threads, payout statements — all of it lives in accounts you may lose on no notice, and all of it is the evidence of what you actually did. Pull a reservation export and a payout statement per property once a month and keep them somewhere you own. Fifteen minutes. It is the difference between opening your next owner pitch with three years of performance data and asking them to take your word for it.