Contractors
Contractor offboarding: a checklist for access, assets, and contracts
Updated · 7 min read
Contractors and vendor staff often have the same access as employees, sometimes more, but they are rarely in the HR system that normally starts an offboarding. Nobody resigns and nobody is terminated. The contract simply ends, and unless someone is watching the date, the access does not.
This checklist covers what makes contractor offboarding different and how to make sure it starts on time.
Why contractor access gets missed
- No termination event: there is no HR record to trigger IT, only a contract end date in a procurement system or an email thread.
- Guest and external accounts: access may live in guest accounts, vendor-managed accounts, or tools the contractor brought with them.
- Shared credentials: agencies and vendors sometimes work through shared logins, which are not tied to one person.
- Unclear ownership: the hiring manager, procurement, and IT each assume someone else is tracking the end date.
Before the contract starts
The easiest contractor offboarding is the one set up at onboarding.
- Record the contract end date where your offboarding process can see it, not just in the contract.
- Name an internal owner who is responsible for the contractor's access.
- Give individual accounts rather than shared logins, and time-limit access where the tool supports it.
- Note the vendor company, so access held through the vendor can be tracked too.
Contractor offboarding checklist
- 1
Confirm the end date
Check whether the contract is ending, being extended, or converting to employment before removing anything.
- 2
Revoke identity provider and SSO access
Disable the contractor in your identity provider and end their sessions.
- 3
Remove app accounts outside SSO
Source control, cloud consoles, design tools, and project tools are frequently set up directly for contractors.
- 4
Remove guest and external access
Shared drives, chat guest accounts, and external collaborators on repositories or documents.
- 5
Rotate shared credentials
Any shared password, API key, or VPN credential the contractor or agency used.
- 6
Recover equipment and data
Company laptops, security keys, and badges, plus confirmation that company data on personal devices was deleted where your agreement requires it.
- 7
Close the contract
Final invoice, statement of work sign-off, and confirmation that confidentiality and IP obligations were acknowledged.
- 8
Record what was done
Keep the removal record with dates, since contractors are a common source of audit exceptions.
How PurpletGo handles contractor offboarding
PurpletGo tracks workers as employees, contractors, or vendor staff. When a contractor or vendor worker's contract end date arrives, PurpletGo opens their offboarding automatically with a contractor checklist, so it does not depend on someone remembering the date.
- Daily check for contractors and vendor staff whose contract ends today, which opens an offboarding if one is not already active.
- A contractor checklist covering access, hardware return, closing the statement of work, and confidentiality.
- Tracking for access held through the vendor company (Team plan and up).
- The same one-action access revocation and per-system results as employee offboarding.
30-day free trial - no credit card required