On this page
What should a small team include in contractor offboarding?
Agree when the work ends and keep the information your business needs. Then remove the person’s accounts, open sessions and project access. Check shared passwords and keys, AI connections and automated jobs as separate items. Confirm who owns the unfinished work, and write down what changed.
Removing someone from the team chat is one line on that list. It is rarely the last one.
What does offboarding mean?
What offboarding means.
Offboarding is everything you do when someone stops working with you: handing over their work, ending their access and getting company devices and files back.
With a freelancer it often happens quickly, because the contract simply runs out. That is why a short, written plan helps more than good intentions.
Agree the handover before the last day.
The developer has finished the build. The designer has delivered the files. You have paid the final invoice. What you do not see is the access that piled up along the way: client folders, deployment tools, shared passwords, an AI connector and a scheduled report that runs under the freelancer’s own account.
Pick one person to own the offboarding, and agree the time access ends. List the active projects, the work still due and who takes over each piece. If company information has to be kept, decide how it moves before any account is deleted. With a plan, nobody has to choose between blocking access and keeping the work.
Check every account, not only the main login.
Go through company email, shared drives, chat, code repositories, design tools, client systems and any admin roles. For each one, ask how the access was given: through a team invite, a personal account, a shared password or your client’s own administrator. Each route closes in a different way. Closing the main company account can leave the others open.
Use each service’s current instructions to end access and open sessions. Google’s instructions, for example, treat resetting a password and resetting sign in cookies as two separate steps. Check the apps the person connected, too. Record every change and any client administrator who still needs to act, and mark the departure complete only when those are done.
Provider guidance: Google Workspace: reset passwords and sign in cookies · NCSC (United Kingdom): securing important online accounts
Why is a new password not enough?
Why a new password is not enough.
When someone signs in, many services keep them signed in on that device for days or weeks. That is an open session. A new password does not always end it.
So look for the service’s own control that signs a person out everywhere, and use it together with the password change.
end access, keep the workthree steps
- 1
Transfer.
Give every piece of active work a new owner.
- 2
Remove.
End the accounts, the app permissions and the shared access.
- 3
Verify.
Record what changed, and what is still open.
Include the tools that keep working without the person.
Ask the freelancer which AI assistants, MCP connections and automation platforms they used. A job can keep running after the person has gone. It can also stop without warning, because the account it ran under was closed. Decide which automations you still need, hand them to someone else where the service allows it, and check that the work continues under an approved company or client account.
Check shared API keys at the service that issued them. If the person could see a key that should stay private, replace it and test everything that depends on it. Removing a connector from a laptop does not cancel the key behind it. And never ask the freelancer to paste secret values into the handover document.
What is an MCP connection?
What an MCP connection is.
MCP is the open standard that lets an AI assistant use a tool, such as a file store, a database or cybee. Each connection is set up once and then works in the background.
A connection the freelancer set up can keep its access after they leave. List it with the other accounts.
What is an API key?
What an API key is.
A long secret string that lets a script or a tool use a service in your name, without a password. Whoever holds a copy can use it until someone cancels it at the service that issued it.
Treat company and personal devices differently.
A company Mac comes back. Check three things before it is put away: the freelancer is signed out of their own Apple account on it, you can sign in with a password you know, and the work on it is saved somewhere else. A personal laptop follows the agreement you made about company files and access. If you agreed nothing, ask the freelancer to confirm in writing that the company files are deleted, and add a line about this to your next contract. Do not assume you can erase someone’s personal laptop. Record the return, or the written confirmation that company files were deleted as agreed, and give any open issue an owner.
Be exact about what you can check. Removing someone from a shared folder closes that route. It does not show that no copies exist somewhere else. If sensitive material or anything suspicious is involved, switch to your incident process. A routine departure and a possible incident need different decisions and different records.
Closing a route does not bring the copies back.
Leave a record the next person can understand.
The final record can be short: the person, the projects, the end date, the services you checked, the access you removed, what came back and what is still open. Add who checked it. A temporary support account needs a purpose and an end date, so it does not stay open “just in case”. Come back to each open item until it is fixed or someone has knowingly accepted it.
departure record26.09.2026
- Person
- A freelance developer. The contract ends today.
- Handed over
- The client website. Luca owns it from today.
- Services checked
- Email, shared drive, code repository, design tool, AI connector, scheduled report
- Access removed
- Email, shared drive, code repository, design tool. Sessions ended.
- Moved
- Scheduled report, now under a company account
- Devices
- Own laptop. Company files deleted, confirmed in writing.
still open
- The client’s content system: their administrator still has to remove the login. Owner: Ana.
- The AI connector used a shared key. It gets replaced and tested on Monday. Owner: Luca.
Checked by Ana · open items stay on the record until they close
cybee checks the security settings of each Mac and lists the AI tools and connections set up on it. It also shows your connected Google Workspace next to the Macs. Use that to guide the departure checks and to keep the records that matter. Services outside that view still need their own review.
What you want in the end: access that ends in order, and a client project that no longer depends on someone who has left.
What to remember.
- Keep the work you need before you delete any account.
- Check AI connections, shared keys and the jobs that run on their own.
- Write down every exception, and check that access has ended in each service.
Sources and further reading.
Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup.
Plan the next departure before it happens.
See what changes on the Macs, in the AI tools and in the accounts when someone joins or leaves your team.
