What is offboarding? Removing access when people leave

Offboarding is the process of ending a person's access when they leave a team or a project: removing their accounts and permissions, collecting what they carried with them, and replacing any secrets they could have read.

Why secrets make offboarding harder

Removing a user account is quick. Secrets are the slow part, because a secret that someone has read is still valid after their account is gone. A departing engineer may have seen database passwords, cloud access keys and API keys over months or years. Disabling their sign-in stops future access; it does nothing about values they copied, wrote down or left in a script on their laptop.

So a complete offboarding answers three questions:

1. What can they still reach? Accounts, devices, sessions, tokens, share links, pending invitations.
2. What did they see? Which secrets, which versions, and when.
3. What has to change? Encryption keys, and the secret values themselves at each provider.

How Crunu handles it

Crunu calls this flow Member removal: a four-step wizard for owners and admins, with the steps What the employee has, What will be done, Run and Report. Along the way it produces and does the following:

• What they carry. Besides environment access, the wizard lists what the person may still hold outside the app, such as service tokens, share links, invitations and machine enrollment codes, and revokes them.
• Exposure report. Built from the server's record of fetches: which versions of which environments the person received, when, and from which address. The report can be downloaded for a security review.
• Reissue checklist. The secret values in those environments that should be reissued at providers such as AWS or Stripe. It names the values and where to reissue them, without showing them.
• Removal and rotation. The server stops serving the person data right away, and the key of every environment where they had one is rotated, so new versions are unreadable to them.

When the person leaving is an admin, the organization moves to a new generation of keys: the signing key and recovery key are replaced, certificates are reissued, and all environment keys are rotated.

Good habits around it

• Run offboarding on the person's last day, not after.
• Use access profiles, so removing someone from a profile removes all the environments it granted.
• Keep the exposure report with the record of what you reissued.
• Check the audit log for activity in the days before departure.

See offboarding a teammate and the offboarding feature.