# A freelancer leaves. What access do you remove? > Plan a freelancer’s departure across accounts, shared files, API keys, AI tools and devices. Give every open item an owner and record the checks that remain. Page: https://cybee.ai/blog/contractor-offboarding-checklist/ (Contractor offboarding checklist for small teams) - [Blog](https://cybee.ai/blog/) - Contractor offboarding your team The project is done and the last invoice is paid. The access your freelancer collected along the way is often still open: client folders, shared passwords, an AI connector, a report that runs every morning. This guide closes it without losing the work. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 7 minute read In one minute - When a freelancer leaves, agree the end date and who takes over each piece of work before anyone deletes an account. - Go through every service they used. Access can come from a team invite, a personal account, a shared password or your client’s own admin. - AI tools, shared API keys and scheduled jobs need their own check. Some keep running after the person has gone. - A company Mac comes back and gets checked. A personal laptop follows the agreement you made. - Finish with a short record: what was removed, what came back, what is still open and who owns it. ## What should a small team include in contractor offboarding? Agree when the work ends and keep the information your business needs. Then remove the person’s accounts, open sessions and project access. Check shared passwords and keys, AI connections and automated jobs as separate items. Confirm who owns the unfinished work, and write down what changed. Removing someone from the team chat is one line on that list. It is rarely the last one. **Q:** What does offboarding mean? ### What offboarding means. Offboarding is everything you do when someone stops working with you: handing over their work, ending their access and getting company devices and files back. With a freelancer it often happens quickly, because the contract simply runs out. That is why a short, written plan helps more than good intentions. ## Agree the handover before the last day. The developer has finished the build. The designer has delivered the files. You have paid the final invoice. What you do not see is the access that piled up along the way: client folders, deployment tools, shared passwords, an AI connector and a scheduled report that runs under the freelancer’s own account. Pick one person to own the offboarding, and agree the time access ends. List the active projects, the work still due and who takes over each piece. If company information has to be kept, decide how it moves before any account is deleted. With a plan, nobody has to choose between blocking access and keeping the work. ## Check every account, not only the main login. Go through company email, shared drives, chat, code repositories, design tools, client systems and any admin roles. For each one, ask how the access was given: through a team invite, a personal account, a shared password or your client’s own administrator. Each route closes in a different way. Closing the main company account can leave the others open. Use each service’s current instructions to end access and open sessions. Google’s instructions, for example, treat resetting a password and resetting sign in cookies as two separate steps. Check the apps the person connected, too. Record every change and any client administrator who still needs to act, and mark the departure complete only when those are done. Provider guidance: [Google Workspace: reset passwords and sign in cookies](https://knowledge.workspace.google.com/admin/users/reset-a-users-password) · [NCSC (United Kingdom): securing important online accounts](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts) **Q:** Why is a new password not enough? ### Why a new password is not enough. When someone signs in, many services keep them signed in on that device for days or weeks. That is an open session. A new password does not always end it. So look for the service’s own control that signs a person out everywhere, and use it together with the password change. 1 2 3 Figure: Move the work first. Then removing access breaks nothing your client relies on. ## Include the tools that keep working without the person. Ask the freelancer which AI assistants, MCP connections and automation platforms they used. A job can keep running after the person has gone. It can also stop without warning, because the account it ran under was closed. Decide which automations you still need, hand them to someone else where the service allows it, and check that the work continues under an approved company or client account. Check shared API keys at the service that issued them. If the person could see a key that should stay private, replace it and test everything that depends on it. Removing a connector from a laptop does not cancel the key behind it. And never ask the freelancer to paste secret values into the handover document. **Q:** What is an MCP connection? ### What an MCP connection is. MCP is the open standard that lets an AI assistant use a tool, such as a file store, a database or cybee. Each connection is set up once and then works in the background. A connection the freelancer set up can keep its access after they leave. List it with the other accounts. [Which AI tools are on your work Mac?](https://cybee.ai/blog/ai-tool-inventory/) **Q:** What is an API key? ### What an API key is. A long secret string that lets a script or a tool use a service in your name, without a password. Whoever holds a copy can use it until someone cancels it at the service that issued it. [Who still has your client’s API keys?](https://cybee.ai/blog/client-api-key-handover/) ## Treat company and personal devices differently. A company Mac comes back. Check three things before it is put away: the freelancer is signed out of their own Apple account on it, you can sign in with a password you know, and the work on it is saved somewhere else. A personal laptop follows the agreement you made about company files and access. If you agreed nothing, ask the freelancer to confirm in writing that the company files are deleted, and add a line about this to your next contract. Do not assume you can erase someone’s personal laptop. Record the return, or the written confirmation that company files were deleted as agreed, and give any open issue an owner. Be exact about what you can check. Removing someone from a shared folder closes that route. It does not show that no copies exist somewhere else. If sensitive material or anything suspicious is involved, switch to your incident process. A routine departure and a possible incident need different decisions and different records. > Closing a route does not bring the copies back. ## Leave a record the next person can understand. The final record can be short: the person, the projects, the end date, the services you checked, the access you removed, what came back and what is still open. Add who checked it. A temporary support account needs a purpose and an end date, so it does not stay open “just in case”. Come back to each open item until it is fixed or someone has knowingly accepted it. Figure: A fictional freelancer’s last day. Two items stay open, each with a name next to it. cybee checks the security settings of each Mac and lists the AI tools and connections set up on it. It also shows your connected Google Workspace next to the Macs. Use that to guide the departure checks and to keep the records that matter. Services outside that view still need their own review. What you want in the end: access that ends in order, and a client project that no longer depends on someone who has left. Free, and the Proof plan Protection, the 118 checks, the list of AI tools on each Mac and Google Workspace visibility are free. The sealed Trust Passport is part of the Proof plan: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. [How the Google Workspace view works](https://cybee.ai/product/workspace/)[See the plans](https://cybee.ai/pricing/) ## What to remember. - Keep the work you need before you delete any account. - Check AI connections, shared keys and the jobs that run on their own. - Write down every exception, and check that access has ended in each service. ## Sources and further reading. Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. - [Google Workspace: reset passwords and sign in cookies](https://knowledge.workspace.google.com/admin/users/reset-a-users-password) - [NCSC (United Kingdom): securing important online accounts](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts) ## Plan the next departure before it happens. See what changes on the Macs, in the AI tools and in the accounts when someone joins or leaves your team. [People joining and leaving](https://cybee.ai/use-cases/team-changes/) On this page - The short answer - Agree the handover first - Check every account - Tools that work without the person - Company and personal devices - Leave a record - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) cybee Shows the AI tools on each Mac next to your Google Workspace. Free for every Mac. [See how it works](https://cybee.ai/product/) ## More for the day someone leaves. Three guides. [your team Who still has your client’s API keys? Keys in scripts, automations or AI tools at a handover: what to keep, what to replace and what to remove. Read the guide](https://cybee.ai/blog/client-api-key-handover/) [Google Workspace Which apps can read your company’s Google Drive? Find forgotten app permissions in Google Workspace without stopping useful work. Read the guide](https://cybee.ai/blog/google-workspace-app-access/) [AI tools Which AI tools are on your work Mac? Find the assistants, the connections set up in each one and the experiments nobody switched off. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)