How to Offboard an Employee Across 12 SaaS Tools When You Have No IT Team

When an employee leaves your 20-person startup, you don't have an IT team to handle the deprovisioning. You have a founder, an ops lead, and a browser full of admin tabs. The average employee at a small startup touches 20–30 SaaS tools. Revoking access manually takes 3–5 hours — and that's if you know where to look. This guide gives you a working sequence to get it done right, the first time, without missing anything critical.

Why This Is the Founder's Problem Now

Enterprises hand multi-SaaS offboarding to their IT team with a ticketing system and automated deprovisioning flows wired into an identity provider. You don't have that. What you have is a departed employee who still has active sessions in Notion, Slack, Figma, GitHub, your HubSpot, your AWS console, and the Canva Pro account the design team shares.

This matters because access doesn't expire on its own. A former employee whose Slack gets disabled but whose Figma guest invite stays live can still open client files six months later. A sales rep whose HubSpot seat gets removed but whose personal Google account has OAuth access to your CRM can still pull contact lists. The risk isn't hypothetical — it's the gap between "we disabled their email" and "we actually revoked everything."

For a deeper look at why HR software and IT tools each solve half this problem, see The Offboarding Gap.

Step 1: Build Your Tool Inventory Before Anyone Quits

The biggest mistake founders make is trying to remember which tools an employee used on the day they leave. Memory fails. The time to build your tool inventory is right now, before there's any pressure.

Start with three sources:

1. Your billing statements. Log into every credit card account and bank statement and search for SaaS charges. Each charge maps to a tool someone owns. List the tool name, the account owner, and the admin login.

2. Your SSO provider (if you have one). If you use Google Workspace or Microsoft 365 as your identity layer, every app integrated via OAuth or SAML shows up in the admin console. Export the list.

3. Ask your team directly. Send a Slack message: "What tools do you use for work that aren't in the company password manager?" You'll get 5–10 answers no one thought to document.

Put everything in a shared spreadsheet: Tool Name | Category | Admin Owner | How Access Is Granted | Seat Type (individual vs. shared). Update it when you onboard new hires — make tool provisioning a checklist item from day one.

If you want a methodology for this discovery process, the Who Has Access audit guide walks through it in detail.

Step 2: The Offboarding Sequence — 4 Tiers by Risk Level

Not all tool access is equal. A lingering Loom seat is annoying; a lingering AWS IAM user is a security incident waiting to happen. Work through these tiers in order on the employee's last day.

Tier 1 — Revoke immediately (within the hour):

• Email account (disables auth for everything connected via Google/Microsoft SSO)
• SSO / identity provider (Google Workspace, Okta, Microsoft Entra)
• Code repositories (GitHub, GitLab — remove from org, revoke all tokens)
• Cloud infrastructure (AWS IAM user, GCP service accounts, Vercel, Netlify)
• Password manager (1Password, Bitwarden — remove from team vault)

Tier 2 — Same day (within 8 hours):

• Project management (Linear, Jira, Asana, Notion)
• Design tools (Figma, Canva — remove from team AND revoke guest links they created)
• Communication (Slack — deactivate, don't just remove from channels)
• CRM (HubSpot, Salesforce — disable seat, check for API keys they may have created)
• Finance tools (Brex, Ramp, QuickBooks — remove card access and approval permissions)

Tier 3 — Within 48 hours:

• Analytics (Mixpanel, Amplitude, Google Analytics — remove user)
• Marketing tools (Mailchimp, Apollo, LinkedIn Sales Nav)
• Support tools (Intercom, Zendesk)
• Video and recording (Loom, Zoom — deactivate or downgrade seat)

Tier 4 — Within the week (don't forget these):

• External contractor platforms (Upwork, Deel) — remove payment authorization
• Social media accounts they had access to
• Domain registrar, DNS provider, SSL cert management
• Any physical or digital signing tools (DocuSign, HelloSign)

Step 3: The Edge Cases That Get Founders

The tiers above cover direct access. Three categories of indirect access consistently get missed.

OAuth grants. When an employee connects a personal app to a company tool using "Sign in with Google" or grants an integration permission, they create an OAuth token that persists independently of their user account. Disabling their email doesn't revoke it. To find these: in Google Workspace admin, go to Security → API controls → Manage third-party app access. Remove any OAuth grants tied to their account. Do the same in any tool that has an integrations or connected apps section.

Shared accounts. Many startups share a single Figma seat, a single HubSpot Marketing login, or a single Canva Pro account across 3–5 people. When one person leaves, you can't just "remove" them from something they log into with a shared password. The correct move: rotate the shared credential immediately and update your password manager. Then re-provision the remaining team members. This is painful exactly once — if you do it right, you'll separate shared credentials from individual accounts going forward.

Admin and billing seats. If the departing employee was an admin on any tool, they can still log in and create new credentials even after their standard user account is removed. Check specifically: who is an admin on your Stripe, your domain registrar, your cloud hosting, and your billing email. If their personal email is listed as a backup admin anywhere, remove it.

The SaaS access sprawl guide covers how these hidden access grants accumulate over time at a typical 20-person startup.

Step 4: After the Manual Run — Build a System You Can Repeat

Doing this once, manually, takes 3–5 hours. Doing it for every departure at a 25-person company that loses 3–5 people per year means 15–25 hours of founder time annually — and a non-zero risk of missing something critical each time.

The fix isn't buying enterprise IAM software (BetterCloud and Torii start at $8–12/seat/month and are built for IT teams managing 500+ seats). It's building a repeatable process tied to your HR offboarding flow.

What a lightweight system looks like at a 20-person startup:

1. Offboarding trigger in your HR tool. When you mark someone as departing in your people platform, an offboarding checklist fires automatically. Each item in the checklist corresponds to a tool category.

2. Tool inventory linked to each role. Not every employee touches the same tools. A designer's offboarding checklist should auto-include Figma, Canva, and Adobe. An engineer's should include GitHub, AWS, and your CI/CD platform. Map tools to roles once, then the checklist pre-populates on each departure.

3. Completion tracking. Each access revocation step gets checked off by whoever does it (usually the tool owner — that same ops person or the engineering lead for code repos). You end up with an audit trail: who revoked what, when.

4. Scheduled credential rotation. For shared accounts, set a calendar reminder to rotate the shared password 24 hours after every departure. No exceptions.

This is exactly the model Optserv is built around — connecting the HR lifecycle event (departure) to the access revocation checklist, so no-IT founders don't have to manage it from memory. Try Optserv free — the offboarding module wires your tool inventory to your people data so revocation becomes a checklist, not a memory exercise.

Manual vs. Systematic: What Changes at Scale

The crossover point is typically around 10–15 employees. Below that, a careful manual process works if you follow the tier sequence above. Above that, the compounding risk of missed access plus the time cost makes a systematic approach worth building.

FAQ

How long does SaaS offboarding actually take without an IT team?

For a typical 20-person startup employee who touched 20–30 tools, expect 3–5 hours for a thorough manual offboarding. The variation comes from OAuth grants (easy to miss, time-consuming to audit) and shared accounts (require coordination with remaining team members). A systematic checklist approach cuts this to 30–45 minutes.

What happens if I miss a tool during offboarding?

The access stays live until someone notices or until the next billing cycle prompts a seat audit. In practice, this means a former employee may retain read access to sensitive data — client lists, unreleased product specs, salary information — indefinitely. The higher-risk scenario is write access in tools like your code repo or CRM, where a disgruntled former employee can cause active damage.

Do I need an SSO provider to offboard cleanly?

SSO (Google Workspace, Okta, Microsoft Entra) makes offboarding significantly faster because disabling one account cascades to all SSO-connected apps. But it only helps for tools that are integrated with SSO — which is rarely all of them. Figma guest links, OAuth grants, and shared accounts all exist outside SSO. You still need the manual checklist for those.

Should I disable the employee's email immediately or wait?

Disable the account (remove their login) immediately. But set email forwarding to their manager before you do — customer-facing employees will have active threads that need continuity. Keep the forwarding active for 30–90 days, then close the mailbox. Don't keep a shared inbox open with the former employee's credentials intact; that's an open door.

Start With Optserv

Optserv connects your HR lifecycle — hire, role change, departure — to access management across every tool your team uses. When someone leaves, the offboarding checklist fires automatically, pre-populated with every tool tied to their role. No IT team needed.

Start free at app.optserv.ai — set up your first offboarding checklist in under 20 minutes.

Sources

• BetterCloud SaaS Statistics 2026: average 106 SaaS apps per company; average 31 accounts per employee — bettercloud.com
• Nudge Security IT Offboarding Checklist 2026 — nudgesecurity.com
• Torii IT Offboarding Checklist 2026 — toriihq.com