Company Offboarding¶
Single offboarding checklist for every departing (or role-changing) person, regardless of team. Each row has a Scope field that marks whether the step applies to everyone or only to a specific team:
- Company-wide – applies to every offboardee.
- Marketplace – shared publisher accounts (mobile / release related).
- DevOps – applies only if the person had DevOps / infrastructure access.
Access revocation comes first: remove the person from SSO groups and privileged systems so access is cut immediately, then work through the remaining rows.
Personnel Name: Personnel ID / Email: Job Title: Team(s): Last Working Day: Offboarding Owner: Ticket / Request Link:
1. Access Revocation (Highest Priority)¶
| # | System / Platform | Scope | User ID / Email | Action | Done (✓) | Notes |
|---|---|---|---|---|---|---|
| 1 | SSO / IdP (Google Workspace / Entra ID) | Company-wide | Remove from all groups; disable account | Cut identity first | ||
| 2 | Microsoft 365 | Company-wide | Disable mailbox / revoke app access | |||
| 3 | Slack | Company-wide | Deactivate from workspace | |||
| 4 | GitHub (org) | Company-wide | Remove from org/teams; revoke PATs | |||
| 5 | Jenkins | Company-wide | Remove access | |||
| 6 | Linear | Company-wide | Remove access | |||
| 7 | KolayIK | Company-wide | Deactivate account | HR | ||
| 8 | Google Cloud (GCP) – identity | Company-wide | Remove user from org / basic IAM | Infra IAM in DevOps rows | ||
| 9 | Arc (internal AI assistant) | Company-wide | Remove from Arc configs; revoke all access | |||
| 10 | Claude Team (claude.ai) | Company-wide | Remove member | Owner info@appcircle.io | ||
| 11 | App Store Connect (ASC) | Marketplace | Remove user from shared publisher account | |||
| 12 | Google Play Console (GPC) | Marketplace | Remove user from shared publisher account | |||
| 13 | Huawei AppGallery (HAG) | Marketplace | Remove user from shared publisher account | |||
| 14 | SSO groups (DevOps / admin / infra) | DevOps | Remove from privileged groups | |||
| 15 | CI/CD (Jenkins / GitHub Actions) – admin | DevOps | Remove admin/maintain; clear credential stores | |||
| 16 | Secret stores (Vault / Secret Manager) | DevOps | Remove access; revoke tokens | |||
| 17 | Kubernetes | DevOps | Remove RBAC bindings; revoke kubeconfigs/certs | |||
| 18 | Cloudflare | DevOps | Remove membership & zone roles; revoke tokens; confirm DNS ownership | |||
| 19 | AWS | DevOps | Remove SSO/IAM; revoke access keys & sessions | |||
| 20 | GCP – infra IAM & SSH | DevOps | Remove Compute/OS Login roles; clean SSH key metadata | |||
| 21 | OVH | DevOps | Remove SSH keys from all hosts + automation | |||
| 22 | Teknotel | DevOps | Remove SSH keys (incl. bastions); rotate shared passwords | |||
| 23 | Red-shift (cert tracking) | DevOps | Remove user; move ownership to service account | |||
| 24 | Algolia | DevOps | Remove user; rotate API keys if exposed | |||
| 25 | Docker Hub | DevOps | Remove org/team; revoke tokens | |||
| 26 | Node.js registries (npm / GH Packages / Artifactory) | DevOps | Remove org/team; revoke tokens; check .npmrc |
|||
| 27 | Monitoring / incident tools | DevOps | Remove access |
2. DevOps – Detailed Steps (only if the person had infra access)¶
Work through these only when the offboardee held DevOps / infrastructure access. Skip otherwise.
2.1 Collect inputs first¶
Cloudflare account(s) & zone(s), domain registrar, AWS account(s) / SSO portal, GCP project(s), OVH host list, Teknotel host list (incl. bastions), Teknotel shared local users / passwords, Red-shift workspace, Algolia org/app(s), Docker Hub org/repo(s), Node.js registries (npmjs / GitHub Packages / Artifactory / Nexus / Verdaccio), infra repos / CI-CD systems, known shared secrets / accounts.
2.2 Cloudflare – account cleanup & DNS handover¶
Remove member access from every relevant account; revoke/rotate tokens the leaver created or could reach; confirm automation uses a team/service token (not personal); remove from Zero Trust access policies if used; ensure all DNS zones live in the company account (transfer from personal accounts if needed); confirm registrar access, 2FA, and recovery are company-controlled.
2.3 AWS – account access & credential cleanup¶
Confirm the access model (IAM User, IAM Identity Center / SSO, or both); remove SSO permission-set / account assignments; disable console login and delete/disable access keys for IAM users; remove any role trusts that reference the user; rotate CI/CD automation keys the leaver could access; verify login / assume-role now fails.
2.4 GCP – IAM & SSH cleanup¶
Remove IAM roles and group memberships (admin / compute / OS Login); remove OS Login bindings; remove SSH keys from project and instance metadata; verify the user can no longer SSH to any instance.
2.5 OVH & Teknotel – SSH key cleanup¶
Remove SSH keys from all hosts including bastions/jump boxes; remove keys embedded in automation (Ansible / Terraform / cloud-init / scripts); on Teknotel rotate shared admin accounts and shared local passwords if the person had access; verify keys no longer grant access.
2.6 SaaS accounts¶
- Red-shift (cert tracking): remove user; move ownership of rules/alerts and integrations to a team/service account.
- Algolia: remove user; review and rotate API keys if the person could access them; keep keys in secret store / CI, not personal tokens.
- Docker Hub: remove org/team access; revoke personal tokens; review automated builds/webhooks; confirm company-owned ownership.
- Node.js / package registries: remove npm org / GitHub Packages / Artifactory membership; revoke personal tokens (
NPM_TOKEN/NODE_AUTH_TOKEN); check shared build agents and repos for.npmrcexposure; ensure publishing uses a bot/service account.
2.7 Rotate shared credentials (only if exposure risk exists)¶
Rotate CI/CD secrets, container registry credentials, shared kubeconfigs/certs, shared SSH keys/passwords, and third-party integration tokens only when the leaver could realistically have obtained them. Avoid unnecessary rotations.
3. Close-out¶
| Item | Action | Done (✓) | Notes |
|---|---|---|---|
| Record evidence | What was removed, where, and when (screenshots / logs / links) | ||
| Note suspicious findings | Anything surfaced during Cloudflare / AWS / registry audits | ||
| Notify stakeholders | Inform relevant owners | ||
| Add to Offboarding Index | Create the OFF-#### record and link it | ||
| Mark offboarding complete | Update the ticket and close |
Final Review¶
- Company-wide access revoked (SSO, M365, Slack, GitHub, Jenkins, Linear, KolayIK, GCP identity, Arc, Claude Team).
- Marketplace publisher access removed (App Store Connect, Google Play Console, Huawei AppGallery).
- DevOps access revoked where applicable (SSO groups, CI/CD, secret stores, K8s, Cloudflare, AWS, GCP, OVH, Teknotel, SaaS, package registries).
- Shared credentials rotated where exposure risk existed.
- Evidence recorded, OFF-#### record created, and offboarding closed.