Offboarding a Remote Contractor in Vietnam: The Access and Compliance Checklist for Startups

When a remote contractor in Vietnam finishes their engagement, most startups do it backwards — they send the termination notice, wait for the contractor to confirm, and only then think about access. That order is wrong. Access revocation should happen first, or simultaneously at most, never after. Vietnam's civil service contracts carry no mandatory statutory notice period under the Labor Code — your contract terms govern. That means you can end the engagement with whatever notice you agreed to, and your access-revocation window is exactly as long as that notice period.

Why This Matters for Startups Hiring in Vietnam

Vietnam is the second-largest remote-hire market in Southeast Asia after the Philippines. Developers, designers, and operations contractors based in Hanoi, Ho Chi Minh City, and Da Nang are on payrolls and retainers at hundreds of US, EU, and AU startups. When those contracts end, access doesn't close automatically — Figma seats stay active, Notion guest invites persist, GitHub repo memberships remain, Slack accounts keep logging in. Nobody built a kill switch into these tools. You have to pull it manually, and you have to know what to pull.

This guide is the playbook for doing that correctly when your contractor is in Vietnam.

Disclosure: this is the Optserv blog. We cover the access lifecycle layer — we'll be direct about where Optserv helps and where it doesn't.

Service Contract vs. Employment Contract — Why It Changes Your Offboarding Playbook

Most foreign startups hire Vietnam-based workers as independent contractors under a civil service agreement (hợp đồng dịch vụ), governed by Vietnam's Civil Code 2015, not the Labor Code 2019. That distinction matters enormously for offboarding.

Under the Labor Code, employment contracts carry firm notice periods: 45 days for indefinite-term, 30 days for fixed-term, 3 days for seasonal roles. These trigger severance calculations, mandatory insurance contributions, and a longer offboarding runway.

Civil service contracts work differently. There is no statutory notice period in the Civil Code for service contract termination. Article 428 of the Civil Code allows unilateral termination with "reasonable notice" when neither party has committed a breach. What counts as reasonable is defined by your contract — not by any government regulator.

The misclassification risk. Vietnamese authorities have been scrutinizing long-term service contracts that function like employment — fixed hours, single employer, regular monthly payments, management control over the work method. If your contractor relationship fits those patterns and has run for 12+ months, consult local counsel before offboarding. A misclassified contractor may have accrued employment entitlements you're unaware of. If the relationship is genuinely project-based, deliverable-driven, and non-exclusive, you're on solid ground with a civil contract termination.

The practical upshot. If your contract specifies 14-day notice (a common clause), your access-revocation window is 14 days maximum — but for sensitive roles, you want it down to hours, not days. More on the sequence below.

The Access-First Offboarding Sequence

Regardless of the notice period, here's the order of operations:

Hour 0 — Send notice and immediately start access triage. Don't wait for acknowledgement. The moment you initiate offboarding, begin auditing what the contractor can reach. A contractor who knows they're being offboarded and still has full Figma access for two weeks is a liability — not because most contractors act maliciously, but because accidents happen and the risk window is open.

Hour 1 — Revoke primary access. Email (if company-issued), VPN credentials, any IdP/SSO account (Google Workspace guest, Microsoft Entra guest). If you use SSO, disabling the IdP account will sever SSO-dependent apps. Note: it will NOT close active sessions in apps where the contractor has been granted access via OAuth and then cached their credentials.

Hours 2–72 — Revoke secondary access tool by tool. Everything that isn't SSO-dependent has to be pulled manually. See the checklist below.

Day 3–7 — Confirm final deliverables, send payment. Final invoice settlement, transfer of work-product files, return of any company data. Decree 13/2023 (Vietnam's Personal Data Protection Decree) requires that personal data held by a contractor in performance of the contract is deleted or returned upon contract termination — include this in your checklist.

Day 14 — Contract close. Final written confirmation that the engagement is complete, access has been revoked, and the NDA/confidentiality obligations survive.

The Revocation Checklist — Tool by Tool

This is where most offboardings break down. The checklist below covers the tools that Vietnam-based contractors most commonly access. Work through it in order.

Identity and email

• Remove from Google Workspace (or Microsoft 365) — revoking the guest account kills SSO for all connected apps
• Invalidate active sessions in Google/Microsoft admin console (force sign-out)
• Remove from any password manager shared vaults (1Password, Bitwarden) — shared vault membership ≠ SSO, must be done separately

Communication

• Deactivate Slack member account (Deactivate, not just remove from channels — deactivated accounts lose access to all channels and can't rejoin)
• Remove from any Discord servers
• Remove from WhatsApp groups if your team uses them for work coordination

Design and creative tools

• Remove from Figma org or revoke all project/file-level shares — both the org membership and any direct file shares that were granted outside the org
• Remove from Canva team
• Remove from Adobe Creative Cloud if on a shared team license

Code and infrastructure

• Remove from GitHub org or revoke collaborator access on specific repos
• Revoke any personal API keys or tokens the contractor generated — check GitHub Settings > Developer Settings > Personal access tokens if they had repo access on their own account
• Remove from any CI/CD pipelines (GitHub Actions, Vercel, Railway team seats)
• Remove from cloud provider accounts (AWS IAM users, GCP service accounts, DigitalOcean team members)

Knowledge and project management

• Archive Notion guest access — if they're a guest on multiple pages, revoking workspace guest removes all
• Remove from Linear, Jira, or Asana as appropriate
• Remove from Loom workspace if used for async video

The shadow IT problem. Research by Torii in 2026 found that 80% of employees use at least one app not sanctioned by their employer. For contractors working independently from Vietnam, this number is likely higher — they may have created integrations, Zapier connections, or OAuth grants using your company data without telling you. The only reliable way to surface these is to audit OAuth-connected apps in Google Workspace (Security > Third-party access) and ask the contractor directly. More on this in our guide to how to revoke employee access automatically.

IP Protection and Data Handling When the Contract Ends

Vietnam's IP Law (amended 2022) does not automatically assign IP created by a contractor to your company. You need an explicit written assignment clause in the contract. If you don't have one, the contractor may retain rights to code, design work, or content they created. Fix this in your contract template before the next engagement — the offboarding phase is too late to negotiate it cleanly.

At offboarding, take these steps regardless:

• Send a written reminder of the NDA and confidentiality obligations, citing the specific clause and duration. Under Vietnamese law, a well-drafted NDA is enforceable and provides grounds for civil damages if breached.
• Request deletion or return of all company data from personal devices and local storage. If the contractor used their own laptop, you can't verify this — you can only create a documented paper trail that they agreed to comply.
• Rotate any credentials or API keys the contractor used that weren't contractor-specific — any shared passwords, shared email inboxes, or team accounts where they knew the login.
• Under Decree 13/2023, if the contractor processed personal data of your customers or employees, they're required to delete that data upon engagement end. Include this in your termination confirmation letter.

For the access lifecycle side — tracking what tools a contractor touched during their engagement so you know what to revoke — this is exactly what Optserv is built for. When a contractor's profile shows every tool they were granted access to, offboarding becomes a checklist you can run in 15 minutes instead of an archaeology project. See how the Philippines offboarding guide tackles the same problem in a different SEA market, or the Indonesia contractor hiring guide for context on access scoping at contract start.

Approach Comparison: Manual vs. Access-Tracked Offboarding

FAQ

Do I need to give a Vietnam contractor notice before terminating the contract?

For civil service contracts (hợp đồng dịch vụ), Vietnam's Labor Code notice periods don't apply — the notice period is whatever your contract specifies. If the contract is silent on notice, Article 428 of the Civil Code requires "reasonable notice," which courts interpret based on the nature and duration of the engagement. A two-week notice clause is standard and defensible. For employment contracts, the notice periods are 45 days (indefinite-term) or 30 days (fixed-term) — different rules entirely.

Can a Vietnam contractor keep using company tools after the contract ends?

Not legally — but practically, they can unless you revoke access. Figma, GitHub, Notion, and Slack don't automatically close accounts when a contract ends; you have to remove the user manually. A contractor accessing company tools or data after contract termination likely constitutes a civil breach and may trigger data protection liability under Decree 13/2023. Don't rely on the contractor's goodwill — revoke access proactively.

What happens to the IP the contractor created under a service contract in Vietnam?

Under Vietnam's IP Law, IP created by a contractor doesn't automatically belong to your company unless the contract explicitly assigns it. Without a written IP assignment clause, the contractor may have a claim to the work. Review your contract template and add an assignment clause before the next engagement. The offboarding confirmation letter should reference the contractor's obligation to stop using any IP created for your company.

Does Vietnam's Personal Data Protection Decree (Decree 13/2023) affect contractor offboarding?

Yes. If your contractor handled personal data — employee records, customer data, user information — they're considered a data processor under Decree 13/2023 and are required to delete or return that data when the processing purpose (the contract) ends. Include a data deletion confirmation in your termination paperwork. Vietnam's newer Decree 356 (effective 2026) tightens these obligations further for companies processing sensitive personal data categories.

Ready to Stop Doing Contractor Offboarding from Memory?

Optserv tracks every tool access grant from day one of a contractor's engagement — so when the contract ends, you have a complete revocation list, not a guessing game. It's the lifecycle layer that payroll tools and general HR platforms don't cover: who has access to what, right now, and what needs to be revoked when they leave. Try Optserv free →

Sources

• Vietnam Civil Code 2015, Article 428 (unilateral termination of service contracts)
• Vietnam Labor Code 2019, Chapter XIII (notice periods for employment contracts)
• Vietnam Decree 13/2023 on Personal Data Protection
• Vietnam Decree 356/2025 (Personal Data Protection — enhanced obligations, effective 2026)
• Vietnam IP Law (amended 2022) — IP assignment requirements for contractor work product
• Torii 2026 SaaS Management Benchmark (shadow IT statistics)
• Nudge Security IT Offboarding Checklist 2026 (access revocation timing benchmarks)