Offboard a teammate in one pass
Removing a member is a guided flow. It shows what the person received, removes their access, rotates the key of every environment they held, and ends with a report your security team can keep.
- The server stops serving them right away
- Every key they held is rotated
- A checklist of values to reissue
See what they received
Before anything changes, the exposure report lists every environment the person could read and the versions they actually received, built from the server’s fetch log.
- When, how often, from whereFor each environment: the versions received, the time range, the number of fetches and the address.
- A report to keepDownload the exposure report together with the reissue checklist for your security team.
- What the server servedThe report shows deliveries. What happened to a value on the person’s device is beyond any server.
Every key they held changes
Crunu removes the person’s access and rotates the key of each environment they had, one by one, with progress shown as it goes. New versions are sealed to a key they never received.
- Things they carried are revokedTheir service tokens, share links, invitations and machine enrollment codes stop working.
- An admin leaves, the organization’s keys changeThe signing key and the recovery key are replaced, certificates are reissued and every environment key is rotated.
- Nothing gets lost halfwayIf a rotation has to wait for a key holder, it stays under Pending actions until it’s done.
A list of what to replace at your providers
The report ends with the values to reissue, such as STRIPE_SECRET_KEY or AWS_SECRET_ACCESS_KEY, listed by name and never by value. For known services, there’s a link to where you issue a new one.
- Built in your browserThe server doesn’t know variable names, so the checklist is assembled on your device from what you can decrypt.
- A signed record of the removalThe person is added to the organization’s signed revocation list, and every step appears in the audit log.
- A stolen laptop works the same wayDevice compromised replaces the account’s keys, revokes the other devices and rotates every environment the person had a key for.
What no tool can take back
Offboarding closes the doors that are still open. It can’t erase what already left.
- What they saw stays seenRotation protects new versions only. A value the person decrypted stays valid until you reissue it at the provider.
- Reissuing is manualCrunu doesn’t change values at your providers. The checklist tells you which ones and where.
- Keep more than one ownerThe last owner can’t be removed. If every owner and admin loses access, nobody can manage the organization.
Answers to common questions
Something else? Write to support@crunu.com
Does removing someone delete what they downloaded?
No. Nothing can reach into a device and erase a value that was already decrypted there. That’s why the flow ends with a list of values to reissue.
The server already stopped serving them. Why rotate keys?
The person may still hold an environment key on one of their devices. After rotation, new versions are sealed to a key they never received.
What changes if the person was an admin?
The organization gets a new generation of keys: a new signing key and recovery key, reissued certificates, and new keys for every environment.
What’s in the exposure report?
For each environment, the versions the person received, when, how many times and from which address.
Can I bring a former member back later?
Yes. Readmitting them keeps the signature history intact.
Know what to rotate when someone leaves
When access lives in Crunu, the exposure report and the reissue list are ready the moment you need them.