Offboarding a Contractor in India: SaaS Access Revocation and Compliance Guide for Startups

India is the largest single source of remote contractor talent for US and European startups: developers, designers, data ops, QA. Most of those engagements end smoothly on paper. The contractor gets paid, the project closes, and then nothing else happens. The Figma seat stays active. The GitHub org membership isn't removed. The IP assignment clause everyone meant to sign never got executed. And the Form 16A TDS certificate due in 15 days sits in a tax obligation nobody knew they had. This guide covers all of it, in the order you actually need to do things.

Why This Matters for Startups Hiring in India

India-based contractors are often engineers with broad SaaS access: they hold repo permissions, Slack workspace membership, Figma project access, and sometimes admin rights on tools they set up themselves. The average employee today touches 13 SaaS tools, up from 7 three years ago. When a contractor engagement ends, each of those connections stays open unless you close it explicitly. Unlike full employees, contractors commonly use personal devices, so there is no laptop to wipe, no MDM to remotely lock. The only lever you have is access revocation. This is the guide for startup founders and ops leads running that process without a dedicated IT team.

What Indian Law Says About Ending a Contractor Engagement

Disclosure: this is the Optserv blog. We cover all tools and regulations honestly, including things that have nothing to do with our product.

The Indian Contract Act, 1872 governs independent contractor relationships. The critical fact: there is no statutory minimum notice period for contractors in India. None. Whatever your service agreement specifies is what's enforceable. If your contract says 14 days, 14 days is the floor. If your contract is silent on notice, courts may imply a "reasonable period" standard, but there is no codified number to anchor to.

This is very different from employing someone in India. Full employees classified as "workmen" under the Industrial Relations Code, 2020 have statutory protections. Contractors do not.

What this means for your offboarding: the termination process is whatever you and the contractor agreed to. But terminating without proper notice, even a short contractual window, creates a compensation claim equal to the value of the missed notice period. Send written notice (email is sufficient for most contracts; check yours), confirm the last working day, and then start the access checklist below.

The 30-Minute Access Revocation Checklist for India-Based Contractors

Run this on or before the contractor's last working day. Simultaneous revocation is the standard: not "after they hand over deliverables." If they need a handover period, do a read-only transition, not continued write/admin access.

Day 0, before the final session ends:

1. Remove from GitHub / GitLab org. India-based engineers often hold org-level membership, not just repo-level. Check organization members, not just repo collaborators.
2. Revoke Figma project access. Remove from all project teams, not just the active one, contractors accumulate access to old projects throughout an engagement.
3. Remove from Slack workspace. Deactivate, don't just remove from channels. Deactivated accounts cannot be reactivated without an admin, and their DM history is still accessible to admins.
4. Revoke OAuth tokens. This is the step most startups miss. If the contractor authenticated any third-party tool, Zapier, Linear, Notion, Vercel, Postman cloud, using their own account with OAuth scopes on your company systems, those tokens survive SSO deactivation. Audit via Google Workspace Admin Console (Security → Third-party apps) and remove connected apps for their account.
5. Remove from Google Workspace / Microsoft 365. Suspend the account first, don't delete, you need 30 days of grace window to recover email and docs.
6. Rotate any shared credentials. If they had access to a shared Notion integration token, a Stripe restricted key, or a shared email inbox password, rotate it immediately.

Day 1-7, follow-up sweep:

7. Check for lingering admin rights. Indian engineers who set up your AWS, Firebase, or Vercel environments during the engagement may hold admin or billing roles on those accounts, not just developer roles. Check billing contacts and admin user lists on every infrastructure platform they touched.
8. Review project management tools. Jira, Linear, Notion databases, remove from active workspaces and check whether they can still access archived or historical projects via direct links.
9. Confirm cloud storage. Any Dropbox, Google Drive, or OneDrive folders that were shared directly with their personal email (common for India contractors who use Gmail for everything) should be unshared, not just the corporate account removed.

For a fuller picture of how to run this process across 10+ tools at once, see the guide on offboarding an employee across multiple SaaS tools with no IT team.

IP Assignment in India: Execute Before the Last Day, Not After

India has no "work for hire" doctrine equivalent to US copyright law. Under Indian copyright and contract law, an independent contractor owns the IP they create by default, even if they built it on your systems with your tools during your project. Without a written IP assignment, you don't own the code.

The practical problem at offboarding: if you didn't get an IP assignment clause signed at the start of the engagement, you're now trying to get a former contractor, who has no current financial incentive to cooperate, to sign a deed transferring work they already delivered.

What you need:

• A written IP Assignment Deed (not just a clause inside the service agreement, courts treat a separate stamped deed as more enforceable)
• Language that uses "hereby assigns" (present tense, assertive) not "agrees to assign" (future tense)
• Execution before the final payment is released, not after

What you cannot do:

• Enforce a post-termination non-compete. Section 27 of the Indian Contract Act voids contracts in restraint of trade. Non-competes don't hold up in Indian courts.
• Recover IP retroactively if the assignment clause was missing. Get legal advice if you're in this position.

What does hold up: confidentiality clauses tied to specific proprietary information and trade secrets. Those are enforceable under Indian law even after contract end.

TDS Paperwork: The Form 16A Obligation Most Foreign Startups Miss

If you paid an India-based contractor directly from a foreign entity, your tax obligations depend on whether your payments were structured as:

Option A: direct payment from foreign company to Indian contractor: This is the most common setup for small startups using Wise, Payoneer, or international bank transfer. Indian tax law requires the foreign payer to deduct TDS (Tax Deducted at Source) at the applicable rate under Section 194C (2% for technical services) or 194J (10% for professional services). To do this legally, the paying entity must hold a TAN (Tax Deduction Account Number).

At contract end, your legal obligation is to issue Form 16A, a TDS certificate for non-salary income, to the contractor. Deadline: within 15 days of the due date for the quarterly TDS return (Form 26Q). Failure to issue Form 16A triggers penalties under Section 272A(2)(g) of the Income Tax Act.

Option B: payment via EOR or payment platform (Deel, Remote, Razorpay X): The EOR handles TDS deduction and Form 16A issuance. Confirm this is happening. Don't assume.

The PAN detail that matters: If you're paying a contractor and don't have their correct PAN on file, the TDS rate automatically jumps to 20% under Section 206AA. Always collect PAN at the start of an engagement, not when it ends.

Access Revocation Timeline by Engagement Type

Different contractor patterns carry different risk profiles at offboarding. Here's how to prioritize:

The engineers with infra access are the highest-priority revocations, their permissions often cascade into billing accounts and production databases that no other role touches. Revoke those first, even if the last working day overlaps with a knowledge-transfer period. Use read-only access for any handover, not continued admin rights.

For context on how to map tool access to roles before it becomes an offboarding problem, see the role-based access template for startups without an IT team.

FAQ

Do Indian independent contractors have any notice period rights?

No statutory minimum exists under Indian law for independent contractors. The Indian Contract Act, 1872 gives contractors whatever the service agreement specifies. If your contract requires 14 days written notice, that's the floor. If the contract is silent, courts may imply a reasonable period. Statutory labor protections (like the one-month notice for "workmen" under the Industrial Relations Code, 2020) apply to employees, not contractors.

If I terminate a contractor and don't issue Form 16A, what happens?

Failure to issue Form 16A within the required window triggers penalties under Section 272A(2)(g) of the Income Tax Act. Your obligation exists independently of whether the contractor asks for it. Download Form 16A from the TRACES portal (tdscpc.gov.in) using your TAN credentials after filing the quarterly Form 26Q.

Can a contractor in India keep using company tools after their contract ends?

Technically yes, until you revoke their access. Access is not automatically revoked when a contract expires or is terminated. The responsibility to close each access point falls on you, not the contractor. This includes OAuth tokens from third-party integrations, which survive SSO deactivation.

Do Indian courts enforce non-compete clauses with contractors?

Generally no. Section 27 of the Indian Contract Act voids agreements in restraint of trade. Post-termination non-competes are largely unenforceable. Confidentiality agreements tied to specific trade secrets and proprietary information are enforceable. Focus your protection on strong confidentiality clauses and executed IP assignment deeds, not non-competes.

What's the difference between a PAN and a TAN?

A PAN (Permanent Account Number) is the contractor's tax identity. You need their PAN on file when making payments, missing PAN triggers a 20% TDS rate under Section 206AA. A TAN (Tax Deduction Account Number) is your entity's deduction account for collecting and remitting TDS on behalf of the contractor. If you're paying an India-based contractor directly, you need a TAN to be compliant. Many small foreign startups route payments through EOR platforms specifically to avoid maintaining their own TAN.

How Optserv Handles the India Contractor Offboarding Layer

The compliance paperwork, Form 16A, IP assignment deeds, contract termination notices, lives outside any software tool. But the access revocation piece doesn't have to be manual. Optserv connects the HR offboarding record to the tool-access layer: when you mark a contractor as departed, it triggers revocations across the SaaS tools you've connected: GitHub, Figma, Slack, Notion, Google Workspace. No checklist, no manual pinging tool admins.

If your India contractor roster cycles regularly and you're doing this manually each time, you're spending 2-3 hours per offboarding on a process that should take 10 minutes. Try Optserv free →

Sources

• Indian Contract Act, 1872: Section 27 (restraint of trade), Section 73 (compensation for breach)
• Income Tax Act, 1961: Section 194C, 194J (TDS on contractor payments), Section 206AA (missing PAN penalty), Section 272A(2)(g) (Form 16A penalty)
• Industrial Relations Code, 2020, notice period provisions for classified "workmen"
• TRACES portal (tdscpc.gov.in): Form 16A download procedure
• JumpCloud, SaaS Usage Statistics 2025, 13 SaaS tools per employee average
• Zylo, 2025 SaaS Management Index, 275 SaaS applications per company average; 84% unmanaged by IT
• Rippling, IP Protection in India, work-for-hire doctrine absence under Indian copyright law
• Altacit Global, Importance of Assignment Agreements under IP Laws in India, stamped deed enforceability