Employee Offboarding: The Digital Assets You Must Take Down

When someone leaves, the digital assets you need to take down fall into three groups: accounts you hold the keys to (email, Slack, CRM, shared logins), public-facing assets built under your brand (their profile page, directory and review listings, WhatsApp Business, the QR code printed on their card), and anything living in an account the person owns personally, which you cannot take down at all — you can only ask. A practical offboarding checklist handles the first two the same week and, more importantly, stops creating the third by issuing the public-facing pages from a company account where revoking them is a single action.

The resignation email lands on a Tuesday. HR sends you the offboarding checklist, you work through it, and by Friday the laptop is back, the mailbox is on a forward, Slack is deactivated, the CRM licence is reassigned and the badge is deactivated. On paper the person is offboarded.

Three weeks later a customer forwards you a screenshot. They scanned the QR code on the business card your former rep handed them at a trade show in March. It still works. It opens a page with your logo on it, and the phone number now goes somewhere you don't control.

Nothing was done wrong. The checklist covered internal systems, because internal systems are what IT can see. The public-facing footprint the person built under your brand — the part customers actually touch — sits outside it. What follows is a takedown checklist for that footprint, and an honest account of the one category you can't take down at all.

Where the standard checklist stops

A typical offboarding checklist is built from an IT asset register. Everything on it has an owner, a licence and an admin console. That's why it works: for each item there is a button somewhere that ends access.

The public footprint has none of those properties. Nobody provisioned the rep's entry in an industry directory, licensed the WhatsApp Business account on their work phone, or logged the bio page they made because the team needed one before a conference. These things were created by a person doing their job, quickly, with whatever was to hand — and they outlive the employment because nothing in your stack knows they exist.

The useful way to sort them is not by tool but by who holds the keys, because that determines whether you take an asset down, request it, or write it off.

The public-facing takedown checklist

Work it in three passes. The first pass is same-day and mechanical. The second takes a week and needs someone to actually look. The third never fully closes, so plan for it instead of chasing it.

Pass one: things you can end yourself, on the last day

• Email signature and auto-reply — set the forward, and check the signature block on any shared or role mailboxes they had send-as rights on.
• Shared logins — rotate every credential in the shared vault they had access to, not just the ones assigned to them. If a password was in a spreadsheet, treat it as compromised.
• Scheduling and meeting links — calendar booking pages, webinar host accounts, recurring meeting ownership.
• Company-issued public page — their staff bio on your website, and any company-issued profile or link page. If it was provisioned centrally, this is one action.
• Phone, extension and voicemail — including the recorded greeting, which usually names them.
• WhatsApp Business — if it runs on a company SIM, retrieve the SIM before the last day. If the company number was ported to their personal handset, sort that out before you announce the departure, not after.
• Google Business Profile and ad accounts — remove them as a user, and check whether they were the primary owner. Primary ownership walking out the door is a painful recovery.
• E-signature, invoicing and quoting tools — anything that can send a document with your name on it.

Pass two: the footprint someone has to go and find

Search for the person's name together with your company name and see what comes back. Then check, in order:

• Industry directories and association listings — professional bodies, chambers, trade associations, franchise or dealer locators.
• Review and marketplace profiles — agent profiles on property portals, adviser profiles on comparison sites, individual reviewer profiles that carry your brand.
• Partner and vendor directories — "find a certified partner" pages on suppliers' sites, which are often maintained by a person, not a process.
• Event and content bylines — speaker bios on conference sites, podcast guest pages, webinar landing pages, co-authored posts. These usually can't be removed, but the link in the bio can often be updated, and that's the part that matters.
• Anything still pointing at a page you control — a link you can repoint is better than a listing you have to chase. This is the whole argument for putting one updatable link on every employee page rather than hard-coding destinations everywhere.

Pass three: print, and everything already in someone's hand

Business cards, brochures, vehicle branding, trade-show banners, sponsor boards, the laminated sheet at reception. You cannot recall any of it. What you can do is make sure the destination those materials point to is one you still control — which is a design decision made months before the resignation, not an offboarding task.

The category you cannot take down

Here is the part most checklists skip, because there's no satisfying answer to it.

If an asset lives in an account the person opened in their own name, with their own email address, you have no technical route to it. Not a slow route or an escalation path — none. That includes their personal social profiles with your branding in the header, the personal mobile number four hundred customers have saved under your company name, and the link-in-bio page they set up themselves because they needed one for a campaign and nobody had issued them anything.

Your options are limited to asking. A well-drafted employment agreement helps — it can require the removal of brand identifiers on separation, and it gives you something to point at. A specific request in the last week also works more often than people expect, because most leavers aren't trying to cause a problem, they're just busy: a vague "take down anything with our logo" doesn't get actioned, while "please remove the header image and the company name from your bio by Friday" usually does.

But you're negotiating, not administering. If the relationship ended badly, you're negotiating from a weak position over an asset that carries your brand to your customers. That asymmetry is the real argument for deciding upfront who controls the asset, and it's why what happens to a rep's page when they leave should be settled before you ever hand one out.

Issued pages make revocation one action

The structural fix is to move the public-facing page out of the third row of that table and into the second: make it something the organization provisions, so it's something the organization can withdraw.

That's the model behind Biotree for Organizations. The company creates a managed page for each person, on their work email, through a single Partner API call. That one call creates the account, the page, the handle (which becomes handle.biotree.bio), the profile photo, bio, links, social icons, background and style. The page is live immediately. Nobody signs up, nobody picks a template, nobody is left holding the login.

When the person leaves, you revoke. The page is unpublished, the URL stops serving, and the content is preserved so that if the person returns — or the page belonged to a role you're rehiring into — re-granting restores it. It's one call, and it doesn't depend on the leaver's cooperation or their mood.

Two details matter for offboarding specifically:

• Shared destinations are indirection, not copies. The media kit or events button on every member page points at a fixed biotree.bio/go/{org}/{slug} address. You repoint that destination once and every page follows. So when a departure means a resource should move or disappear, you're editing one record, not auditing forty pages.
• Tenant isolation is real, and it cuts both ways. An organization can only touch pages it created. If your former rep also has a personal Biotree page, that's a separate asset — it is never converted, absorbed or taken down by the company, and it shouldn't be. Company pages are provisioned on work email precisely so the line between the two stays clean.

ProLend, a private lending business in South Africa, runs this way: every independent consultant gets a branded page issued from prolend.biotree.bio. Consultants come and go, as they do in any independent network, and the offboarding step for the public page is one API call on the day.

QR codes, cards, and what you actually control

Be clear-eyed about QR codes, because they're the item that generates the awkward screenshot three weeks later.

A QR code is a printed pointer. Once it's on a card in a customer's wallet, it exists forever and you cannot change it. What you can change is where it lands. If it points at a page you issued, revoking the page ends the card's usefulness immediately. If it points at a page the person owns, the card keeps working and now advertises whatever they decide to put there — possibly their new employer. Same piece of cardboard, entirely different outcome, decided by whose account the destination sits in. How QR code business cards actually work for teams covers this in more detail.

One honest boundary: Biotree doesn't sell NFC cards, plastic smart cards or any card hardware, and it doesn't do vCard-style "tap to save my contact to your phone" exchange. A Biotree page is the destination a card or QR code points to — the part you can update centrally and take down later. If your team specifically needs tap-to-save-contact hardware, that's a different category of product, and plenty of organizations sensibly use both: the hardware for the tap, an issued page for the destination.

The offboarding sequence that works

Put the public footprint into the existing checklist rather than running a separate process, and split it by who holds the keys:

• Last day — revoke the issued page, rotate shared credentials, retrieve the SIM, remove them as a user on business profiles and ad accounts, update the signature and voicemail.
• Week one — the search-and-find pass: directories, review profiles, partner listings, event bios. Assign it to a named person with a deadline, or it doesn't happen.
• Week one, also — the specific, itemised request for anything in their personal accounts. Name each item. Give a date.
• Ongoing — accept that print is permanent and make sure new print points at destinations you control, so that the next departure is a revocation rather than an investigation.

The honest summary is that offboarding is only as clean as onboarding was deliberate. Every asset you issued, you can withdraw. Every asset someone improvised, you can only ask about. That's the same argument, viewed from the other end, as setting up a new rep's digital presence properly on day one, and it's the practical case for treating public pages as company infrastructure in the complete guide to link in bio for teams and organizations.

If you'd rather your next departure be a one-line revocation than a fortnight of chasing, look at how Biotree for Organizations issues and revokes managed pages for your team, or provision a couple of test pages through the Partner API and try revoking one.

Related guides

• What Happens to a Sales Rep's Company Page When They Leave?
• Company-Owned vs Employee-Owned Bio Pages: Who Controls the Asset?
• New Sales Rep Onboarding: Setting Up Their Digital Presence
• Link-in-Bio API for Organizations: Provision, Publish and Revoke Pages Automatically