An agency running twenty clients is running several hundred live links. Most keep them in a spreadsheet, a shared password, and the memory of whoever built them. That holds until an account manager resigns, a client asks for eighteen months of campaign history, or a printed leaflet points somewhere nobody can edit.
Four rules fix it: isolate each client, put the links on a domain the client owns, enforce naming with templates rather than discipline, and agree how links transfer before anyone needs to know. None of it is difficult. It is simply easier to skip in month one and expensive to retrofit in year two.
What actually goes wrong
The failures are boringly consistent across agencies.
Links get created under a personal login, because that is the account that was open at the time. The person leaves, and four hundred live redirects leave with them. Or everyone shares one password, so there is no record of who built what and no way to revoke access for a departing contractor without changing the credential for the entire company.
The spreadsheet is worse than it looks. It is accurate for about six weeks. After that it records the links someone remembered to log, which is a different set from the links that exist.
Then there is the domain problem, which is the one that costs real money. A client's campaign runs on a generic shortener domain — an address that belongs to neither of you and carries the reputation of every stranger who has ever used it. It looks cheap in a paid social ad, and it is a liability in SMS, where carriers filter shared shortener domains aggressively.
Finally, campaigns end and links do not. A promotion closes, the landing page is deleted, and the redirect starts returning a 404 to everyone still holding the leaflet. Nobody notices, because nobody owns the link after the campaign closes.
Rule 1: one workspace per client, not one folder
Folders organize. Workspaces isolate. The distinction matters more than it sounds.
With a workspace per client, a junior on the Acme account cannot see the Brightwell links, let alone edit them. Access is granted and revoked per client, so a freelancer brought in for one project gets exactly one client's data. Usage, limits, and reporting are scoped naturally, which means you can answer "what did we do for this client" without filtering anything.
Folders and tags belong inside the workspace. A workable structure is a folder per campaign and tags for the things you will want to slice later: channel, market, quarter. Tags are cheap and worth over-applying. Nobody has ever regretted being able to pull every link tagged paid-social across a year.
Rule 2: the domain should belong to the client
This is the rule agencies resist and later wish they had followed.
A branded short domain — go.acme.com, or a short registered variant — does three things. It looks like the brand rather than like a shortener, which measurably helps click-through in paid social and email. It gives the client a sending reputation of their own, rather than one inherited from strangers. And, critically, it survives you.
Register the domain in the client's registrar account, not yours. Point a CNAME at your link provider and bill the registration as a pass-through. When the relationship ends — and it will — the client keeps every printed QR code, every business card, and every live campaign, and you keep a clean conscience. When the domain sits in the agency's account instead, offboarding has two outcomes, both bad: you serve a former client's traffic indefinitely for free, or their printed material dies the day you turn it off.
Below roughly five clients, plenty of agencies run everything on a single agency-owned domain. That is a reasonable trade, provided you say so out loud in the contract. What is not reasonable is discovering the arrangement during a handover.
Rule 3: naming a stranger can read
Every agency writes a naming convention. Most keep it in a document nobody opens.
The convention itself is straightforward. Slugs should be lowercase, hyphenated, and readable when spoken aloud: acme-spring-radio, not acme_Spring_Radio_v2_FINAL. UTM values are case-sensitive and literal, so Email, email, and e-mail will sit in three separate rows of a client's analytics forever. Pick lowercase, pick hyphens, and never use spaces.
| Instead of | Use | Why |
|---|---|---|
utm_source=Facebook |
utm_source=facebook |
Casing splits one channel into two rows |
utm_medium=facebook |
utm_medium=social |
Medium is a channel type; source is a place |
utm_campaign=spring sale |
utm_campaign=spring-sale |
Spaces become %20 and look broken |
bit.ly/3xK9wQm |
go.acme.com/spring-radio |
Nobody can read, say, or audit the first one |
The enforcement is the part that matters. A convention held in human memory decays the moment a new starter joins. Held in a UTM template, it applies itself. Build the tagging once per client, save it, and let people select rather than type. Our UTM builder is a fine place to draft the scheme before you commit it to a template.
Rule 4: reporting is an export, not a screenshot
Screenshots do not aggregate, do not compare, and cannot be re-run when a client questions a number six months later.
The monthly client report should come out of the tool as a CSV or an API pull, land in whatever you already use for reporting, and be reproducible. If a number is challenged, you re-run the export rather than search Slack for the original image.
Retention is the constraint people miss when choosing a tool. A platform that keeps thirty days of click history cannot produce a year-on-year comparison, and year-on-year is precisely what a client asks for at renewal. Check the retention figure before you check the price. On in.bio it runs from a year on the entry paid tier to ten years above it; see pricing for where the lines fall.
Rule 5: write the offboarding on day one
Client relationships end. The links do not, because they are printed on things.
Settle four questions in the contract, not in the exit conversation.
| Question | Good answer |
|---|---|
| Who owns the short domain? | The client, registered in their account |
| Who owns the link records? | The client, exported on request in a standard CSV |
| What happens to historical click data? | Exported at handover; agree the format up front |
| What happens to live links you cannot recall? | Repointed to an evergreen page, never left to 404 |
That last one deserves a standing habit rather than a clause. When a campaign closes, repoint its links to a sensible permanent page — the product, the category, the homepage. A redirect that lands somewhere useful is a mild disappointment. A 404 on a printed asset is a support ticket and a bad impression, repeated for as long as the leaflet exists.
What to look for in a tool
Strip out the feature lists and four things decide whether a link platform can carry an agency.
Separate workspaces with per-user access, so client data is genuinely isolated rather than merely filtered. Custom domains, since the branded-domain rule is unenforceable without them. Bulk operations and CSV import and export, because migrating a client with two thousand links by hand is not a plan. And an API, once you reach the point of generating links from a campaign brief rather than a form.
Everything else — QR styling, password protection, expiry dates — is useful, but it is not what breaks when you grow.
Where to start
If you are retrofitting this onto an existing book of business, do it in the order the risk sits. Move the highest-value client onto their own workspace and their own domain first. Export everything from the shared account before you touch it. Write the naming convention into templates the same week, because a convention that arrives after the migration will not be applied retroactively. Then work down the client list at whatever pace the account teams tolerate.
The whole exercise takes a few days. Not doing it takes one resignation.
