Employee Offboarding: Revoke, Rotate, and Re-Share (Checklist)

Why offboarding is prime leak time

Departures create chaos: shared logins, stale tokens, and old threads resurface. A short, repeatable offboarding checklist prevents lingering access and accidental leaks.

T-0: disable access fast

• Revoke sessions for email, password manager, and cloud tools.
• Invalidate tokens (API keys, app passwords, PATs, CLI logins).
• Remove shared devices and connected apps/integrations.

Rotate credentials (same day)

• Change passwords to unique, manager-generated ones. Need a memorable master? Create Strong Passphrases.
• Regenerate API keys and update .env files. Delivery tips: Share API Keys and .env Files Safely.
• Re-share new credentials with one-time, expiring links + separate access code. Basics: The Safe Way to Share Passwords in 2025 (No Email).

Audit & clean

• Search old messages for leaked secrets and rotate before deleting. Guide: 90-Minute Sweep.
• Remove public links to shared folders or documents that no longer need access. Safer delivery: Share Sensitive Photos & Documents Safely.

Finance & payments

• Verify by phone any bank detail change. Link hygiene: Verify Links Like a Pro.
• Share new banking info with expiring links. How: Send Banking Details Safely.

Copy/paste offboarding checklist

• [ ] Revoke sessions & connected apps
• [ ] Rotate passwords & tokens; update .env
• [ ] Re-share via one-time links + split channels
• [ ] Sweep old threads; delete after rotation
• [ ] Verify payment details out-of-band
• [ ] Document the handover

If you suspect misuse

Run a quick incident response: The Simple Incident Playbook for Leaked Passwords.

Related reading

Secret-Sharing Policy · Secure Client Onboarding · One-Time Links vs. Encrypted Email

Bottom line

Revoke, rotate, re-share—then clean up. Offboarding is where most leaks start; a 30-minute checklist stops them.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.