SiteGround auto-renewal safeguards

• DNS lives at SiteGround. psychedelicsinrecovery.org’s nameservers are ns1.siteground.net and ns2.siteground.net, so the records for every subdomain (the main site, the service site, the newer ones) and the mail records sit on the SiteGround account. If that account lapsed, the websites and PIR’s email could stop resolving together, even though the sites themselves are hosted elsewhere.
• The registrar is DreamHost LLC, most likely through WPX’s reseller arrangement. The domain is registered until March 21, 2027.
• SiteGround has been billed once a year to a personal card, not to an account PIR controls.
• Who holds the SiteGround login is unresolved. That’s the real risk: a renewal notice can go to an inbox nobody reads, and a card can expire without anyone knowing it was the one paying.

1. An org-owned billing card or account. SiteGround (and the registrar) bill a card or account that belongs to PIR, managed by the Treasurer, not a member’s personal card.
2. Two account holders. At least two trusted servants (for example the Treasurer and a TechCom member) can sign in to SiteGround and to the registrar, each with their own two-factor sign-in.
3. Calendar reminders 60, 30 and 7 days out before each renewal (SiteGround’s yearly bill, and the domain’s March 21 date), on a shared calendar both holders see.
4. Auto-renew on, with a confirmed backup payment method, checked once a year when the reminder fires.
5. Registrar lock (transfer lock) on psychedelicsinrecovery.org, so the domain can’t be moved away by mistake or by someone who shouldn’t.
6. The logins documented in PIR’s private CONTACTS (who holds each account and where its recovery codes are kept, never the passwords themselves), the same place the other role mailboxes and services are recorded.
7. Optional: consolidate DNS at the registrar or at WPX, so one fewer account has to stay alive. That’s a bigger change (every record copied over, then the nameservers switched) and can wait until the first six are done.

The SiteGround renewal has already snuck up on PIR once. A lapse wouldn’t just take a website offline: because SiteGround answers for PIR’s DNS, the subdomains and email would go dark with it. Each step above costs little or nothing, and together they mean no single card, inbox or person can be the reason PIR disappears from the internet. It’s the same idea as the stewardship plan for PIR’s GitHub pages: keys held by the organization, by more than one person, written down.

This is a proposal for the Board of Directors and TechCom. Nothing here has been decided or changed. The Board decides on the billing card and the account holders; TechCom can do the technical steps (reminders, auto-renew check, registrar lock, the CONTACTS entry) once the Board says yes. Questions or changes: bring them to the BoardDesk or the TechCom Desk, or type /techcom in PIR’s Discord.