What to do with accounts when someone quits

Someone just gave notice, or left today, and now you’re the one responsible for making sure they can’t get into anything anymore. There’s no single place to do this at most small companies — it’s app by app, and the ones people forget are exactly the ones that matter.

The checklist

Identity and email

Suspend or remove their account with your email/identity provider (Google Workspace, Microsoft 365, or whatever you use). If it’s Google Workspace, we wrote up the click-by-click version.
Reset any shared passwords they knew.

Chat and communication

Remove them from your chat tool (Slack, Teams, or similar) — this one’s easy to remember and easy to skip anyway when things are busy.
Check for any DMs or channels where they might have posted credentials.

Code and infrastructure — the ones that actually get missed

Remove their access from your code host (GitHub, GitLab). This is the one that lingers longest: an ex-employee with repo access six months later is a genuinely common failure, not a hypothetical.
Revoke any cloud provider access (AWS, GCP, Azure) — API keys, console access, everything.
Rotate any credentials they had direct access to: database passwords, deploy keys, service account tokens.

Password manager

Remove them from your team’s shared password manager. If they had access to any vault they shouldn’t have, rotate those specific credentials — removing their account doesn’t undo what they already saw.

Everything else

CRM, project management, docs, design tools, support/ticketing — anywhere they had a login. If your team can’t quickly answer “what does this person have access to,” that’s the actual problem, not any one item on this list.

Why this is hard

None of these steps is individually difficult. The problem is coverage — there’s no single list of “everywhere this person has an account” at most companies, so offboarding is really “everywhere someone remembers to check.” The bigger your app list gets, the more likely something gets missed, and the failure is invisible until it matters.

The fix that isn’t a longer checklist

Rostid is built to be the one place your company’s roster lives — remove someone once, and their access is gone everywhere you’ve connected, not just the apps someone remembered.

We’re in early access. Join the waitlist and we’ll send one email when it opens.