An agency running infrastructure for several clients has a problem that a product company never faces: every client is a separate legal and financial relationship, yet the same engineers touch all of them. Mixing client workloads in one account is convenient until a client leaves, an invoice needs to be split, or one client’s runaway process affects another. This guide compares the isolation patterns available and explains when each one fits.
Three isolation levels
Cloud providers offer isolation at roughly three levels, and the right one depends on how independent each client relationship is.
| Level | What separates clients | Best for |
|---|---|---|
| Separate account per client | Identity, billing, quotas, everything | Clients who may take ownership later, regulated work |
| Team or project inside one account | Resources and permissions, shared billing owner | Long-term retainers where the agency pays and rebills |
| Tags and naming inside one project | Reporting only | Small internal or short-lived jobs |
The first level is the cleanest. The second is the most common. The third is where most agencies start and where most billing arguments come from.
Account per client: the clean boundary
A dedicated account per client means the client’s resources, quotas and invoices live in a container that can be handed over intact. If the engagement ends, ownership transfers within the provider’s terms and the agency simply removes its own users. Nothing has to be migrated.
The cost is administrative. Each account needs its own root credentials, MFA device, recovery contacts and payment method, and the agency has to track all of them. The guide to managing multiple cloud accounts covers inventory and access review for exactly this situation. On DigitalOcean, the marketplace lists the Digital Ocean 3 Droplet Account and Digital Ocean 10 Droplet Account, which are sized for the kind of small per-client footprint an agency typically runs. Kamatera’s listing, the Kamatera 5 Limit with $100 Credit Account, fits the same pattern with a small server cap per client.
Teams and projects: one owner, many boundaries
When the agency pays the provider and rebills clients, a single account with internal boundaries is often enough. DigitalOcean organizes billing and resources around Teams, so a client can be a Team with its own members and permissions while the agency remains the billing owner. Providers with a project concept, including Google Cloud and Hetzner, offer a similar split.
The trade-off is that quotas and reputation are shared. A limit reached by one client’s project constrains all of them, and a billing hold on the account pauses everyone. Agencies that choose this model should keep the account’s resource limits well above combined demand and set per-project budget alerts.
Naming that survives staff turnover
Whatever the level, adopt a naming scheme that encodes client, environment and purpose, for example acme-prod-web-01. Six months later, a new engineer should be able to read the resource list and know which client to bill.
Billing separation without spreadsheets
Rebilling only works if the provider’s invoice can be split. Separate accounts give one invoice per client automatically. Teams and projects usually give per-project cost views. Tags are the fallback, and they only help if every resource is tagged at creation. The article on tagging and cost allocation walks through a scheme that holds up on an invoice.
- Decide who pays the provider: the agency or the client.
- Match the isolation level to that decision.
- Export cost data monthly and archive it per client.
- Never let a client’s promotional credit subsidize another client’s usage.
Access handover and exit
Every client relationship ends eventually. Plan the exit at the start: document who owns the account, which credentials the client already holds, and what the agency will rotate on departure. The cloud account handover checklist lists the steps for a transfer that stays within the provider’s terms, including updating contacts, rotating keys and reviewing billing.
For agencies on DigitalOcean, the relevant listings are on the Buy Digital Ocean Account page; for Kamatera, on Buy Kamatera Account. Whichever provider you use, the pattern is the same: choose the isolation level that matches the money flow, name everything consistently, and write the exit plan before the first deployment.
