Offboarding staff and contractors securely

People leave. A virtual assistant takes a full-time job, a web developer finishes the project, a volunteer moderator steps back after a busy stretch, a business partner moves on. Most departures are friendly, and that is exactly why offboarding gets skipped. Nobody wants to seem distrustful of someone who helped build the business, so their logins quietly stay active for months or years.

Leftover access is a risk even when the person is entirely trustworthy. Their old accounts can be phished, their laptop can be stolen, and a password they still know may be reused somewhere that leaks. And sometimes a departure is not friendly at all. Offboarding well means you can remove access completely, at a time you choose, without breaking anything the business depends on.

Offboarding starts on the first day

You cannot remove access you do not know exists. The most useful habit is an access register: a simple list of every system each person can get into, updated whenever you grant something. A spreadsheet with one row per person works well, with columns such as:

• Membership platform role and account name
• Email: their own mailbox, shared mailboxes and any aliases that forward to them
• Payment processor, bank or bookkeeping access
• Hosting, domain registrar and DNS
• Email marketing service, community tools, video host and scheduling tools
• Shared drives and folders
• Social media and advertising accounts
• Shared passwords they have been given
• Devices you supplied, and personal devices used for work

Fill in each row as you go. When you hire a virtual assistant or bring in any other help, include a line in the agreement saying they will hand over business accounts, files and devices when the work ends. Contracts with freelancers and contractors are the natural place for that clause.

Find what they own, not just what they can access

The trickiest part of offboarding is not the accounts a person logs into. It is the things they set up under their own name that your business now relies on. Look for:

• A domain, hosting plan or video library registered in a contractor’s personal account.
• Automations, scheduled reports or integrations that run under their login and will stop when it is closed.
• Connection keys, often called API keys, that they created to link one service to another.
• Course files, templates or brand assets saved only in their personal cloud drive.
• Social or community pages where they are the only administrator.
• Two-factor authentication on a shared account tied to their personal phone.

Transfer ownership of each before their access ends. If something runs under their login, recreate it under a business account and test it. Closing an account first and discovering a week later that the new member welcome sequence has stopped is a common and avoidable mistake.

The departure sequence

For a planned departure, work through these steps in order:

1. Before the last day: transfer ownership of everything they own, collect handover notes and agree the exact time access will end.
2. At the agreed time: disable their accounts rather than deleting them straight away, so their history and activity records are preserved. Sign them out of active sessions wherever you can.
3. Rotate shared secrets: change every shared password they knew, regenerate any connection keys they could see and remove their phone or security key from shared two-factor setups.
4. Handle their mailbox: keep it for a period so member emails are not lost, add an auto-reply pointing to the right contact and redirect new mail to a colleague. Check for forwarding rules they set up to outside addresses.
5. Collect or clear devices: get back business equipment, and ask them to delete business files and member data from personal devices, confirming in writing.
6. Update member-facing details: email signatures, moderator badges, team pages and support templates that mention them.
7. Check again a week later: review login activity and the access register to make sure nothing was missed.

When a departure is abrupt

If someone is dismissed, leaves in a dispute or simply stops responding, the order changes. Remove access first, ideally just before the conversation or as soon as you learn they have gone, and deal with the handover afterward. Start with the systems where damage would be fastest: payment and payout settings, the membership platform admin, the email marketing service that can reach every member, and the domain. Keep a record of what you changed and when. If you suspect data was taken or accounts misused, treat it as a security incident rather than a routine departure, and take professional advice before accusing anyone.

A worked example: a beekeeping association

A hypothetical beekeeping association is losing two helpers in the same month: Henrik, a freelance developer whose contract is ending, and Adaeze, a part-time community manager moving to a new job. The owner checks the access register and finds some surprises. Henrik created the connection key that sends new members to the email service, and the association’s video library sits in his personal account. Adaeze is the only administrator of the association’s public social page, and the support mailbox forwards a copy of every message to her personal address.

The plan: Henrik moves the video library into a new account owned by the association. The owner creates a fresh connection key under the business account and confirms new members still reach the email list before the old key is revoked. Adaeze adds the owner as a second page administrator and then removes herself. On her last afternoon, her platform account is disabled, the forwarding rule is deleted and the support mailbox password is changed. A short note goes to members:

Adaeze has moved on to a new role, and we are grateful for everything she did to make the forum such a friendly place. From today, community questions go to the usual support address, and replies will come from Ivo, who is taking over moderation.

Your offboarding checklist

1. Start an access register and fill in a row for everyone who currently helps you.
2. Find anything the business depends on that sits in someone’s personal account, and move it now.
3. Add a handover clause to contractor and staff agreements.
4. Write your departure sequence and keep it with your other procedures.
5. Decide in advance which systems you would lock first in an abrupt exit.
6. Put a check in the calendar one week after every departure.