Contractor Offboarding Checklist
A contractor offboarding checklist for freelancers and agencies: vendor access removal, repo and cloud keys, data return, final invoice and an audit trail.
- Typical schedule per contract end
- The checklist 4 sections, 18 items
- Variables
{{contractor_name}}{{company}}{{end_date}}{{sponsor}} - Start from CI
Use this checklist when a freelancer, consultant or agency engagement ends, including when a single person at an agency leaves the project while the agency stays. Contractors are the group most often missed in offboarding, because HR may not know they exist and their access was set up ad hoc.
Who owns it
The internal sponsor who brought the contractor in owns the run. IT or the system admins do the access items. Finance confirms the final invoice. If you work with an agency, ask its project lead to confirm which of their people had access, since staff can rotate during a project.
Common pitfalls
- Access that was never in SSO. Contractors often get direct accounts: a cloud console user, a CMS login, a shared FTP password. List them from the onboarding run, not from memory.
- Keys and tokens living on their machines. Cloud access keys, deploy keys and API tokens created for the contractor still work after their accounts are removed. Revoke or rotate them.
- Guest accounts that never expire. Guest users in Google Workspace, Microsoft 365, Slack or Teams stay until someone removes them.
- Your data stays on their laptop. Ask for written confirmation that project data has been returned or deleted, as the contract usually requires.
- The end date passes silently. Contracts end without an event in any system. A scheduled or calendar-triggered run fixes that.
Set the run to start on the contract end date. The completed run shows when access ended, which is useful when a client or auditor asks about third-party access.
The checklist: Offboard contractor {{contractor_name}} ({{company}})
Before the end date
-
End date
{{end_date}}confirmed with{{sponsor}}and{{company}} -
Access list taken from the onboarding run and checked with
{{sponsor}} -
Deliverables, source code and documentation handed over to
{{sponsor}} -
Credentials the contractor holds for shared or client systems listed
Remove access
-
SSO or directory account disabled and sessions revoked
-
Guest accounts removed from chat, file sharing and video tools
For example Slack Connect, Microsoft Teams guests, Google Drive shares to external addresses.
-
Removed from source control organisations and repositories
-
Cloud console users, access keys and roles for
{{contractor_name}}deleted -
API tokens, deploy keys and webhooks created by the contractor revoked or reassigned
-
VPN accounts and IP allowlist entries for the contractor removed
-
Shared passwords the contractor knew rotated
-
Access to client systems you granted on a client's behalf removed optional
Data and equipment
-
Company-owned devices or hardware tokens returned optional
-
Written confirmation received from
{{company}}that project data was returned or deleted -
Files shared with personal or agency addresses unshared
Close out
-
Final invoice checked against the agreed scope and approved
-
Contractor removed from the vendor or supplier list if the engagement will not recur optional
-
{{sponsor}}confirms offboarding is complete
Checklist as Markdown
Start this checklist from your pipeline
When a contract end date is reached, POST /api/v1/runs with template "Offboard contractor {{contractor_name}} ({{company}})" and end_date and sponsor.
curl -X POST https://runbook.metastic.ch/api/v1/runs \
-H "Authorization: Bearer $RUNBOOK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"template": "Offboard contractor {{contractor_name}} ({{company}})", "variables": {"contractor_name": "…", "company": "…", "end_date": "…", "sponsor": "…"}}'Frequently asked questions
Why is contractor offboarding different from employee offboarding?
Contractors usually sit outside the HR system, so no automatic leaver event exists. Their access is also more varied: guest accounts, direct cloud users, client systems and shared passwords. A separate checklist keyed to the contract end date makes sure their access does not outlive the contract.
How do I remove vendor access safely?
Start from a list of everything you granted, ideally recorded when the vendor was onboarded. Disable accounts, revoke keys and tokens, remove guest accounts and IP allowlist entries, and rotate any shared secrets. Then ask the vendor to confirm in writing that they returned or deleted your data.
Should I rotate secrets after a contractor leaves?
Rotate any shared secret the contractor could read, such as shared admin passwords or service credentials in a shared vault. Keys that only they used should be revoked, not rotated. If you are unsure what they could see, the password manager's access log is a good place to start.
Updated