When an Employee Leaves: Revoking Access to ChatGPT, GitHub Copilot, and AI Subscriptions

When a developer or ops person leaves your startup, removing them from Slack and Google Workspace is table stakes. But AI tools are different. Removing a user from ChatGPT Teams does not rotate the API keys they embedded in local scripts. Canceling a GitHub Copilot seat does not take effect until the next billing cycle. And the custom GPT your head of product built with your pricing data? That lives on in OpenAI's system until explicitly deleted. AI tools have created a new category of offboarding gap — one most startup founders don't catch until something goes wrong.

Why This Matters for Your Startup

By mid-2026, a typical 20-person startup is running 5–10 AI subscriptions: ChatGPT Teams or Enterprise, GitHub Copilot Business, Cursor or Windsurf for the dev team, Perplexity Pro for research, Midjourney or similar for design. These tools didn't exist in most offboarding checklists three years ago, and the standard HR offboarding playbook hasn't caught up. Unlike SaaS tools where removing a user cuts their access immediately, AI tools have three failure modes that outlast the offboarding event: locally stored API keys, billing cycle delays, and company data living in AI memory or custom assistants. This guide covers each one.

Your AI Tool Audit List

Before diving into gotchas per tool, start here. When anyone leaves — employee, contractor, or co-founder — run through this list:

Seat-based AI subscriptions to check:

• ChatGPT Teams or Enterprise (OpenAI)
• GitHub Copilot Business or Enterprise
• Cursor, Windsurf, or other AI coding assistants
• Anthropic Claude Team or Enterprise
• Perplexity Pro for Teams
• Midjourney organizational
• Notion AI (bundled with your Notion plan)
• Adobe Firefly (bundled with Creative Cloud)

API credentials to rotate:

• OpenAI API keys (org-level and personal)
• Anthropic API keys
• GitHub Personal Access Tokens with Copilot scope
• Any AI provider keys stored in .env files, local config, or CI/CD pipelines

The seat and the API key are two separate things. Removing someone from the seat does not rotate the key. Every departing technical employee needs both steps done.

ChatGPT Teams — Seat Removal vs. API Key Exposure

Removing a member from your ChatGPT Teams workspace cuts their access to the team's shared workspace. What it does not do: remove any API keys they generated under your organization's OpenAI account, delete custom GPTs they built that may contain your company's proprietary data or system prompts, or revoke their personal ChatGPT Plus subscription if your company was reimbursing them separately.

What to do:

1. Go to your OpenAI organization settings → Members → remove the user.
2. Go to API keys → audit all keys — any key the departing person created stays active unless you delete it. Delete keys you can't attribute to a current employee.
3. Check your Custom GPTs list. If they built assistants with your internal docs, pricing data, or system prompts uploaded, delete or reassign those GPTs.
4. If they had a personal Plus plan on the company card, cancel the subscription separately.

The GPT knowledge base risk is underappreciated. A sales rep who built a Custom GPT with your full pricing deck and competitive intel embedded may have shared that GPT link externally. There is no way to recall it once shared publicly.

GitHub Copilot — The Billing Cycle Gotcha

GitHub Copilot Business has a quirk that catches most founders off guard: when you cancel a seat, the removal takes effect at the start of the next billing cycle, not immediately. If you remove someone mid-cycle, they continue to have active Copilot access until that billing period ends — which could be up to a month.

This is a policy choice by GitHub, not a bug. It means involuntary terminations — the scenarios where you most need immediate access cut — are exactly where Copilot's billing model creates a window of continued access.

What to do:

1. In GitHub organization settings → Copilot → Access, remove the user's seat. This schedules the removal.
2. More urgently: remove the user from the GitHub organization entirely (Settings → Members → Remove). This cuts their repository access immediately, which is the higher-risk issue. Copilot without repo access is largely moot.
3. Rotate any GitHub Personal Access Tokens they created. These are separate from Copilot — a revoked Copilot seat doesn't touch tokens.
4. Check GitHub Actions secrets and environment variables they may have set. Departed developers who configured CI/CD pipelines sometimes leave API keys in workflow files or repository secrets.

AI Coding Tools and the Local API Key Problem

Cursor, Windsurf, and similar AI coding assistants typically authenticate through either a seat-based license tied to an email or a locally configured API key from OpenAI or Anthropic. The seat is easy to cancel. The locally stored API key is the problem.

When a developer configures their AI coding assistant with your company's Anthropic or OpenAI API key (to avoid paying out of pocket), that key lives in their local config file — usually ~/.config/cursor/config.json or an environment variable on their machine. Canceling their Cursor seat doesn't touch that file. If they still have the key, they can configure a new Cursor install on a personal machine and continue running inference on your bill.

What to do:

1. For Cursor/Windsurf: cancel the team seat (if seat-licensed), and separately rotate any OpenAI or Anthropic API keys they were using.
2. For Anthropic API: go to console.anthropic.com → API Keys → delete keys associated with the departing employee. If you used a shared org key, rotate it and distribute the new key to remaining team members.
3. For OpenAI API: same process — platform.openai.com → API Keys → delete or rotate.
4. Audit your .env files in version control for hardcoded keys. A departed dev may have committed a key to a repo branch that now lives in your git history.

The security research firm Passwork explicitly flagged in 2026 that AI agents running on locally stored API keys are the new category most companies miss entirely at offboarding.

The Context Window Risk: Company Data in AI Memory

This is the part most offboarding guides don't cover at all. When employees use ChatGPT, Claude, or Gemini for work tasks, they often upload documents, paste data, or build out persistent contexts. Here's what can survive their departure:

ChatGPT: Conversation history persists in the account. If your ops lead pasted your entire customer list into a ChatGPT session "just to reformat it," that data lives in their personal conversation history — and potentially in OpenAI's training pipeline unless the user opted out. You cannot audit what was pasted.

Claude Projects: Anthropic's Projects feature lets users add documents to a persistent context. If someone built a work project in their personal Claude account using company documents, those documents persist in Claude's context until the project is deleted.

Custom GPTs and Assistants: As noted above, custom GPTs built with uploaded company data or detailed system prompts can be shared with external users. Once shared, you cannot unshare it or remove the underlying data from the recipient's view.

What to do:

• In your onboarding, establish a policy: company data goes into team accounts, not personal accounts. Enforce this by procuring the work AI tools rather than reimbursing personal subscriptions.
• For departing employees: ask them to delete company-related Projects and Custom GPTs as part of the offboarding checklist. You can't verify this, but it's part of their obligations under your IP/confidentiality agreement.
• For your IT policy going forward: any AI tool with document upload or persistent context should be procured as an org account, not reimbursed individually.

The AI Offboarding Checklist (Put This in Your Exit Process)

Add these steps to every technical employee's exit checklist:

Day of departure:

1. Remove user from ChatGPT Teams/Enterprise workspace
2. Remove user from GitHub organization (immediate) + cancel Copilot seat (next cycle)
3. Cancel/reassign Cursor or Windsurf seat
4. Remove from any other AI subscription (Perplexity, Midjourney, Claude Team, Notion AI admin)

Within 24 hours: 5. Rotate all OpenAI API keys the person had access to 6. Rotate all Anthropic API keys 7. Audit GitHub PATs — delete any tied to the departing employee 8. Check .env files and CI/CD secrets for hardcoded AI keys

Within one week: 9. Audit Custom GPTs in your OpenAI org — delete or reassign those the departing person created 10. Check GitHub Actions workflow files for API keys committed as variables 11. Confirm Copilot seat removal has processed (verify after billing cycle closes)

For more on the technical side of this, see our guides on developer API key revocation and offboarding across multiple SaaS tools without an IT team.

Frequently Asked Questions

Does removing someone from ChatGPT Teams cancel their access immediately? Yes, seat removal is immediate. What it doesn't do: rotate API keys they held, delete Custom GPTs they built, or remove data they uploaded in personal conversations. The seat and the data/keys are separate concerns.

Can a departing employee keep using GitHub Copilot after I cancel their seat? Yes — for the remainder of the current billing cycle. GitHub's policy is that seat cancellations take effect at the start of the next billing period. To eliminate Copilot access immediately on termination, remove the employee from your GitHub organization entirely, which cuts repository access and makes Copilot functionally useless even if the seat technically persists.

What happens to the Anthropic API keys a developer had? Nothing happens automatically. API keys remain active until you explicitly delete or rotate them via console.anthropic.com. A departed developer who stored an org key in their local config can continue using it until the key is rotated. Check this on the day of departure for any technical employee.

Should we use personal AI subscriptions reimbursed by the company, or team plans? Team plans for anything involving company data. Reimbursed personal subscriptions leave you with no visibility into what data was uploaded, no ability to audit usage, and no admin controls at departure. The per-seat premium of a team plan is worth the access controls and audit capability.

How Optserv Helps

Optserv is the people platform that ties employee lifecycle to access — when you offboard someone, the system walks you through every access point that needs to be closed, including AI tool credentials and API keys. Because employee records, tool access, and offboarding checklists live in one place, you're not rebuilding the list from memory every time someone leaves. Start for free at app.optserv.ai — no seat cap on the free plan, no payroll module required to use offboarding workflows.

Sources

• GitHub Docs: Revoking access to Copilot for members of your organization
• Passwork (2026): AI agents on locally stored API keys flagged as new offboarding gap
• Torii (2026): Managing GitHub Copilot licenses and spend
• Optserv Team, based on offboarding patterns across agency and startup clients