You, personally or your business entity, in a registrar account you control, on your card, with your recovery email. The domain outranks every other digital asset: lose it and your website, email, and every link ever shared break together.
Never let a developer or agency register it 'for convenience'. That convenience is a hostage situation on a delay. Discovered exactly when relationships sour or the vendor disappears.
Check right now (seriously. WHOIS lookup, two minutes): if someone else holds it, request a registrar transfer while things are friendly. It's a routine days-long process every legitimate vendor cooperates with.