Revoking Finance Tool Access When an Employee Leaves: Stripe, QuickBooks, Xero, and What Survives

When a team member leaves, most founders head straight to Google Workspace and Slack. Finance tools come last — or not at all. That's a problem, because Stripe, QuickBooks, Xero, and expense platforms like Ramp and Brex all have one thing in common: removing a user from the dashboard does not always revoke the access they already have. API keys keep working. Accountant-level sessions stay alive. Virtual cards remain chargeable. This guide covers exactly what survives after "removal" in each tool, and what you need to do about it.

Why Finance Tool Access Is the Highest-Risk Access to Miss

Most offboarding checklists focus on communication tools — Slack, email, Notion. Design or project management tools come next. Finance tools almost always come last, because they feel "safe." The person left, you removed their login, done.

The problem: finance tools control real money. A design tool left open is embarrassing. A finance tool left open is a liability with a dollar amount attached. A former employee with live Stripe API keys can query your customer list, trigger refunds, or read payment method details. A departing bookkeeper whose QuickBooks Accountant access wasn't explicitly revoked can still pull transaction reports. These aren't theoretical risks — they're architectural facts about how each platform manages access.

For a 10-to-50-person startup, the person with finance access is often your head of ops, CFO, or a part-time bookkeeper. When they leave, you're often the one cleaning up — without an IT team checking behind you.

Stripe: Dashboard Removal Is Only Half the Job

Removing someone from your Stripe team (Settings → Team → Remove) cuts off their dashboard login. What it does not do: revoke any API keys they created.

Stripe API keys are independent of user accounts. A developer or ops person who built integrations using restricted or secret keys may have embedded those keys in external scripts, Zapier automations, or third-party apps. When you remove their Stripe team seat, those keys keep working — indefinitely — until you manually roll or delete them.

What to do:

1. Go to Developers → API Keys in your Stripe dashboard.
2. Check the "Created by" field on every restricted key. Stripe shows which team member created each key.
3. Roll any key created by the departing employee. Rolling generates a new key; the old one is immediately invalid.
4. If you use Stripe Connect (for platform or marketplace features), check the Connected Accounts tab — the departing person may have been listed as a platform administrator for connected external accounts.
5. Also audit any Stripe webhooks they may have set up pointing to external endpoints they control.

One more thing: if the person used Stripe's test mode, those keys are separate and also need to be audited. Test mode access can reach customer data in some configurations.

The whole audit takes about 15 minutes but almost nobody does it.

QuickBooks Online: The Accountant Access That Doesn't Die

QuickBooks has two categories of users that behave very differently at offboarding.

Regular users (Company Admin, Standard User, Reports Only, Time Tracking): Go to Settings → Manage Users, find the person, and select Delete. This removes their dashboard access immediately. Straightforward.

Accountant users are different. If your bookkeeper or external accountant was added via the Accountant Access invite (rather than a regular user invite), they appear under a separate "Accounting Firms" section in Manage Users. Removing their regular user record doesn't remove their accountant access — you have to explicitly revoke it from that separate section.

There's a third scenario most founders miss: QuickBooks ProAdvisor access. If your accountant is a certified ProAdvisor, they may access your books through Intuit's Accountant Connect portal — a separate dashboard that accounting firms use to manage all their clients at once. Your QuickBooks Manage Users screen may show them as removed, while their ProAdvisor portal still lists your books as active. To close this: contact the accounting firm and explicitly request removal from their client roster, or change your QuickBooks company admin email to revoke their firm-level association.

Also check: bank feeds. QuickBooks Online connects directly to bank and credit card feeds. A departing employee who set up those connections may have done so using their personal banking credentials. If bank feed authentication breaks after their departure, that's your signal they owned the connection.

What to do:

1. Settings → Manage Users → delete the regular user record
2. Settings → Manage Users → Accounting Firms → revoke any active firm access
3. Contact any external accounting firm and confirm removal from their Accountant Connect roster
4. Verify bank feed connections remain valid after removal

Xero: Advisor Access and What Xero HQ Keeps Alive

Xero's permission model has three tiers: Standard users, Advisors (accountants and bookkeepers you've invited), and a third layer most business owners don't know exists — Xero HQ, the accounting firm portal.

Removing a standard Xero user is simple: Business Settings → Users → select the user → Remove. Done.

Removing an Advisor requires the same steps, but Advisors are listed separately in your user list with a distinct role tag. Don't assume that removing someone from "Users" removes them if their original invite was under the Advisor pathway — confirm by filtering by role.

The harder scenario: if your bookkeeper's firm uses Xero HQ, they maintain a separate client management view of your Xero file from within their own Xero subscription. From their side, you appear as one of their practice clients. Even after you remove them from your Xero Users list, they may still be able to view your file if the practice connection hasn't been formally severed.

To fully remove Xero HQ firm access: go to Business Settings → Connected Apps → look for any listed Practice connections. Remove them. You can also check Accounting → Manage Connections in newer Xero versions.

Additionally, if the departing employee used Xero's API to build any integrations (common in ops-heavy startups), go to Business Settings → Connected Apps and remove any OAuth connections associated with their personal Xero developer account. Unlike Stripe, Xero's connected apps are tied to your organisation and are visible in settings — but only if you look.

What to do:

1. Business Settings → Users → remove the standard user record
2. Check for Advisor role tag — remove separately if present
3. Business Settings → Connected Apps → remove any Practice/HQ connections
4. Revoke OAuth app connections tied to their developer account

Ramp and Brex: Virtual Cards That Keep Charging

Expense platforms work differently from accounting software. The offboarding risk isn't login access — it's outstanding virtual cards.

On both Ramp and Brex, each employee typically has one or more virtual cards issued to their name. These cards have their own card numbers, and they're often stored in SaaS subscriptions, vendor billing portals, and auto-renewal workflows. When you deactivate an employee in Ramp or Brex, their card number doesn't automatically stop working unless you explicitly freeze or close it.

Ramp:

1. Go to Cards → find the departing employee's cards
2. Freeze the card immediately to pause new charges
3. Then close it to permanently prevent use
4. Check Subscriptions (Ramp's automated subscription tracker) — any SaaS renewals mapped to that card will surface here
5. Transfer their admin roles if they had Ramp admin access (Settings → Members)

Brex:

1. Cards → find their physical or virtual cards → Terminate
2. Check Policies — Brex lets admins set spend limits and approval flows; a departing admin may have configured policies that reference their account
3. Verify the billing email for Brex itself isn't set to their personal work email, or card statements will stop reaching you

The other risk on both platforms: if the departing employee was a Billing Admin, vendor invoices may have been sent to their email address. Update billing contacts for any SaaS tools where they were listed as the billing owner — not just the card, but the email receiving invoices.

The order of operations matters: freeze the card first, then deactivate the user. Deactivating first on some platforms can make the card management screens inaccessible before you've frozen the cards.

The Finance Tool Offboarding Checklist

Use this as your reference when offboarding anyone with finance access. Work left to right: what breaks automatically, what you must verify, what you must manually revoke.

The Bigger Pattern: Why HR and Finance Need to Talk at Offboarding

The common thread across every tool above: access was granted in layers, and removal only addresses one layer. The dashboard login is the visible layer. API keys, accountant portals, and virtual cards are the invisible layer — and they're the ones that cost money when missed.

This is the same problem that exists across your whole tool stack when someone leaves. HR knows the person is gone; finance tools, developer credentials, and vendor billing portals don't. There's no automatic signal.

Platforms like Optserv solve this by maintaining a single person-record that tracks which tools each employee has access to — and surfacing a departure checklist that includes the finance-tool layer, not just the communication and productivity tools most offboarding flows remember. When you start the offboarding flow for a departing finance lead, the checklist includes Stripe key rotation and QuickBooks Accountant access, not just Slack and email.

Until your offboarding process is systematized, use the table above as your finance-specific checklist every time someone with finance access leaves.

FAQ

Does removing a Stripe team member revoke their API keys?

No. Removing a team member from Stripe revokes their dashboard login but does not affect any API keys they created. Those keys remain active until you manually roll or delete them under Developers → API Keys. Check the "Created by" field on each key to identify who created it.

How do I find all Stripe API keys a departed employee created?

Go to Stripe Dashboard → Developers → API Keys. Each restricted key shows a "Created by" attribute with the team member's email. Roll any keys associated with the departing employee. If you're on a Stripe account created before 2023, the attribution metadata may not exist — in that case, roll all restricted keys and regenerate only the ones you can confirm are still actively in use.

What happens to outstanding Ramp or Brex virtual cards when an employee is deactivated?

The card number can continue charging subscriptions it's already stored in until you explicitly freeze or close it. Do not deactivate the user first — freeze their cards before deactivating, so you can still navigate their card management screen. After freezing, terminate the cards, then proceed with deactivation.

Can a former QuickBooks accountant user still access my books after I remove them from Users?

Yes, if they were added via the Accountant Access pathway (rather than a regular user invite), their access is managed separately under the Accounting Firms section. Removing their standard user record doesn't remove their accountant access. Additionally, if their firm uses Accountant Connect, the firm-level access may persist until you contact the firm directly.

What's the right order of operations for finance tool offboarding?

Ramp/Brex first (freeze cards before deactivating users, or you may lose access to card screens). Then Stripe API key audit (doesn't expire — but the longer you wait, the more likely a key is used by an automation you didn't know about). Then QuickBooks/Xero user and advisor access. Finally, update billing contacts on any SaaS tools where the departing employee was listed as billing owner. The whole process for a single departing finance employee should take 30-45 minutes if you know where to look.

The Offboarding Problem Is Broader Than Finance

Finance tools are just the most expensive gap. The same pattern — dashboard removal that doesn't revoke underlying access — exists in your developer tools (GitHub tokens, AWS IAM roles), customer-facing tools (HubSpot contacts still accessible via API), and project management tools (Jira automation rules tied to departed users).

If you want to understand the full offboarding gap between HR and IT systems, see The Offboarding Gap: Why HR Software Won't Revoke Access. For a framework for handling all your SaaS tools at once, see How to Offboard an Employee Across 12 SaaS Tools When You Have No IT Team. And if you want to document your process as a policy, see Write Your Startup's Access Revocation Policy in Plain English.

Optserv helps startups track the full tool access lifecycle — from provisioning on day one to revocation on the last day — so your offboarding checklist covers finance tools, developer credentials, and admin access automatically. See how it works.

Sources

• Stripe API documentation: API key management and team permissions (stripe.com/docs)
• QuickBooks Online Help: Managing accountant access and ProAdvisor roles (quickbooks.intuit.com)
• Xero Help: User roles, advisor access, and practice connections (central.xero.com)
• Ramp Help Center: Card management and user deactivation (ramp.com/support)
• Brex Help Center: Closing cards and managing cardholders (brex.com/support)

Byline: Optserv Team