When a Co-Founder Leaves: The Admin Access Offboarding Guide for Startups

Co-founder departure is the highest-risk access event at any startup — not because the person is more dangerous than a regular employee, but because they're not just a user. They're the identity provider. They built the company infrastructure under their email address before you had a domain. The standard offboarding guide assumes you can suspend the departing person's account. You can't, if they're the Google Workspace super-admin.

Why Co-Founder Offboarding Is Nothing Like Employee Offboarding

Regular employee offboarding works top-down: an admin suspends the account, everything connected via SSO cascades off. This guide assumes an admin exists who isn't the person you're offboarding.

With a co-founder, that assumption breaks. The co-founder is often the only Google Workspace super-admin — the account from which all other accounts are managed. They own the Stripe billing relationship on a personal email. They created the GitHub org before the company had a domain. The Cloudflare account with your DNS records has their credit card attached.

There's no IT team to escalate this to. There's no playbook for "the departing person IS the playbook." This guide is written for the remaining founder who has to figure it out in real time.

Step 1: Map the Admin Layer Before Anything Else

Before any conversation happens, spend 30 minutes mapping what the departing co-founder owns. You need this list because the revocation order matters — doing it wrong can lock you out of your own company's infrastructure.

Check each of these:

Identity layer

• Google Workspace: Are they a super-admin? If yes, you cannot suspend their account through the normal flow — you need to first promote another account to super-admin.
• Any SSO provider (Okta, OneLogin, JumpCloud): same question. Who holds the super-admin seat?

Billing layer

• Stripe: Who is the primary account owner (Settings → Team)? Note: Stripe has no "transfer ownership" button. You need them to invite you as admin, then they remove themselves.
• AWS root account: Was the company AWS account created under their personal email? The root account email is the single most dangerous thing to leave unclaimed.
• Bill.com, Mercury, Brex: Who is the primary account holder?

Infrastructure layer

• GitHub org: Who created the org? The org owner has full admin rights including billing. Check Settings → Members → filter by Owner.
• Cloudflare or your DNS provider: Who manages your domain's nameservers? Is it under a personal account or a team account?
• Domain registrar (GoDaddy, Namecheap, Google Domains): Who owns the domain registration? This is independent from DNS management.
• Any cloud infra (GCP, Azure, DigitalOcean, Vercel, Railway): Who is the billing owner?

Code and secret layers

• 1Password or Bitwarden Teams: Is the departing co-founder the account owner?
• Any CI/CD secrets (GitHub Actions, CircleCI): Are secrets scoped to the personal account or the org?

This inventory takes 30 minutes. Do it before the departure conversation, if possible. If the separation is unexpected, do it the same day.

Step 2: The Revocation Order — Sequence Determines Whether You Stay in Control

The order you revoke access in matters more than the speed. Get the sequence wrong and you can lock yourself out of your own domain, lose access to your own billing, or lose control of your codebase.

The right sequence by blast radius:

Tier 1 — Identity and admin first (do this before anything else)

1. Promote another account to Google Workspace super-admin. Then demote the co-founder. Now you can suspend their account.
2. If they hold the sole SSO super-admin seat, transfer that role first. Do not suspend their SSO account before doing this.
3. Change the AWS root account email to a company-controlled address if it's on their personal email.

Tier 2 — Billing (before suspending communication tools) 4. Stripe: have them add you as admin, then remove themselves. If they've already gone dark, contact Stripe support directly with proof of company ownership. 5. Domain registrar: initiate a registrant transfer to a company-controlled email. 6. Banking and expense platforms: add new primary account holder, then remove the old one.

Tier 3 — Code and infrastructure 7. Transfer GitHub org ownership (Settings → Transfer ownership). Then remove their owner seat. 8. Rotate any secrets they had access to — API keys, service account tokens, webhook secrets. 9. Cloudflare/DNS: add your account to the domain, then remove theirs.

Tier 4 — Everything else (after the critical layers are secured) 10. Slack: remove from workspace. Revoke any API tokens or integrations they created under their account. 11. Notion, Figma, Linear, HubSpot, Intercom: remove from team. Download or re-own any assets they created. 12. Password manager: if they held admin, check for any vaults they owned privately. Export and re-store credentials before removing them.

For regular employees, you'd do steps 10-12 first. For a co-founder, those come last — the infrastructure underneath matters more than the collaboration tools on top.

If you want a broader framework on why the order matters, the offboarding gap between HR and IT tools explains why most off-the-shelf offboarding checklists get this sequence wrong.

The Personal Account Problem

This is the co-founder-specific issue that no offboarding guide addresses: what do you do when critical company infrastructure was created under a personal account, not a company account?

Common examples:

• Stripe created before the company had a domain — still on co-founder's personal Gmail
• GitHub org created by the co-founder before you had a company email address
• Cloudflare account registered to their personal email with their personal credit card
• Domain registered at GoDaddy under their name and personal billing

Each of these has a different resolution path. None of them can be resolved by "suspending the employee account."

Stripe on a personal email: Stripe requires the existing account owner to invite a new admin and then leave. If the co-founder is cooperative, this takes 5 minutes. If they're not, you'll need Stripe support — have your incorporation documents and proof of company ownership ready. Stripe support can transfer account ownership in adversarial situations; it takes 3-10 business days.

GitHub org on personal email: Go to Settings → Organizations and initiate an org ownership transfer to a company-controlled GitHub account. The co-founder must confirm via their email. If cooperative, done in minutes. If not, GitHub support can intervene with proof of organizational ownership.

Cloudflare/DNS personal account: Add a second account as a zone administrator, then remove the personal account. The tricky part: you need their cooperation to add the new administrator. If the domain itself is the problem (registered under their name at a registrar), domain transfers require ICANN verification, which goes to their contact email. A cooperative transfer takes 5-7 days. A disputed transfer takes 30+ days plus legal action.

Domain registrar: Update the registrant contact to a company-controlled email address before anything else breaks. This is the one to prioritize — losing control of your domain means losing control of email, which means losing control of everything that uses "forgot password."

The Adversarial Scenario: What If They Don't Cooperate?

Most co-founder departures are planned and mutual. Some are not. If the separation is hostile and the co-founder goes dark or refuses to cooperate, here's what you can and can't do unilaterally:

What you CAN do without their cooperation:

• Contact Google Workspace support. With proof of company ownership (incorporation documents, tax registration), Google can restore admin access to your organization's Google Workspace if you've been locked out. Have your domain verification records and legal documents ready.
• Contact Stripe support with incorporation documents. They've handled adversarial co-founder separations before.
• Initiate a GitHub org recovery — GitHub has an org ownership recovery process for situations where the primary owner is unresponsive.
• File with your domain registrar to initiate a Registrant Change based on business ownership — works better if the registration shows your company name rather than their personal name.

What you CANNOT do quickly:

• Force a domain transfer without their cooperation at the registrar level (ICANN process requires their response window).
• Recover a Stripe account where the company address and legal name don't match the registration — this is why your company information should be on all financial accounts from day one.

Legal options: If access is being withheld maliciously, your shareholder agreement or co-founder agreement should have provisions about company assets. A lawyer can send a demand letter that gets most providers to respond within days. Document everything before escalating legally.

After Revocation: Document, Rotate, and Audit

Once the critical access has been transferred, do three things before considering this closed:

Document the current state. Write down what access you transferred, when, and what new credentials or account owners replaced the old ones. This takes 30 minutes and will save you 30 hours if something breaks in three months and you can't remember the sequence.

Rotate all shared secrets. Every API key, webhook secret, CI/CD token, and service account password that the co-founder had access to should be rotated now — even if the departure is amicable. This isn't about trust; it's about credential hygiene. Credentials tied to a former team member's identity create legal and security grey zones even when that person has left cleanly.

Run a quick access audit. Three weeks after the departure, do a sweep of your core tools to verify no residual access exists. It's easy to miss a Figma project invite, a Notion guest permission, or an API integration that was using their personal token. SaaS access sprawl compounds over time — a departing co-founder is a good reason to audit the full footprint, not just their obvious accounts.

For same-day involuntary terminations where a regular employee needs immediate access revocation, the protocol is different — see the 30-minute SaaS access revocation guide for that scenario.

Co-Founder vs. Employee Offboarding: Key Differences

Frequently Asked Questions

What if my co-founder is the only super-admin on Google Workspace and we haven't set up a second admin?

Call Google Workspace support before doing anything else. With your domain verification records and incorporation documents, Google can provision super-admin access to your organization in adversarial situations. This process typically takes 1-5 business days. If the co-founder is still cooperative, the fastest path is: they promote your account to super-admin in Settings → Admin roles, and then you can proceed with the rest of the revocation independently.

Does Stripe allow ownership transfer when a co-founder leaves?

Stripe doesn't have a one-click ownership transfer feature. The current owner needs to invite you (or another company email) at the Administrator level under Settings → Team, and then remove themselves. If the co-founder is unresponsive, Stripe support can transfer ownership with proof of company registration and a business case. Provide your company incorporation documents, the registered business address, and the account's legal entity name. Expect 3-10 business days for adversarial transfers.

What happens to GitHub organizations and repositories if the org owner leaves?

GitHub organization ownership can be transferred via Settings → Transfer ownership. The departing co-founder should initiate this. For situations where the owner is unresponsive, GitHub has an ownership recovery process where you can claim the org with proof of company ownership. This applies only to GitHub organizations (not personal repos forked to the org). Any repos that exist only under their personal GitHub account and were never added to the org are a separate issue — those require the person to transfer the repo or re-push under a company account.

Should I rotate credentials even if the co-founder left amicably?

Yes, always rotate. Amicable departures don't change the security math. Shared credentials tied to a former team member's identity are a legal grey zone if something goes wrong later — a breach, an IP dispute, a compliance audit. Rotation on departure is hygiene, not a statement about trust. Do it for every significant credential they had access to.

How long does the full co-founder offboarding process take?

For a cooperative departure: the critical access transfer (Tiers 1-3 above) typically completes in 1-2 days if you do the admin layer first. The full sweep including infrastructure and secret rotation takes 3-5 days. For an uncooperative departure, timeline depends on which platforms are involved: Google Workspace recovery is 1-5 days, Stripe support transfer is 3-10 days, domain registrar transfer is 5-7 days minimum. Plan for 2-4 weeks for a contested separation involving multiple platforms.

What Optserv Covers (and What You Still Need to Handle Manually)

Optserv handles the employee access layer — revoking tool access across Slack, Notion, Figma, GitHub, and your other SaaS tools in a single offboarding flow. For regular employees, this covers the full scope.

Co-founder departures require an additional layer: the identity infrastructure, billing ownership, and personal-account entanglement that Optserv (or any HRMS) can't touch. Those require direct platform support and, in some cases, legal intervention. Think of Optserv as handling Tier 4 — the collaboration and productivity layer — while you manage Tiers 1-3 manually.

Start with Optserv to build the access lifecycle layer so future employee offboardings run in one flow. The co-founder layer is a founder problem; the rest of your team's access management doesn't have to be.

Sources

• Google Workspace Admin Help: Recover admin access to a domain (support.google.com)
• GitHub Docs: Transferring organization ownership (docs.github.com)
• ICANN: Registrant name change process (icann.org)
• Stripe Support: Transfer account ownership (support.stripe.com)