_private/qwestly-private-docs/HR/Offboarding/Engineer-Offboarding-Instructions.md

Table of Contents

Engineer Offboarding Instructions

This document provides step-by-step instructions for offboarding an engineer from all company systems. It should be used alongside the Offboarding Checklist Template — fill out the checklist as you complete each section below.

Prerequisites

Before beginning, ensure you have:

  • Admin access to all systems listed below. The primary responsible party is the CTO (Dominick Pham).
  • The employee's name and email address used across company systems.
  • The date and time you received the departure notification (record this in the checklist).
  • A copy of the Offboarding Checklist Template open and ready to fill out.

1. Gusto — Dismiss the Employee (Do This First)

Before touching any accounts, dismiss the employee in Gusto to trigger payroll finalization. This ensures their final paycheck, any PTO payout, and tax documents are handled correctly.

  1. Go to https://app.gusto.com/payroll_admin/people/all
  2. Find the departing employee in the list.
  3. Click on their name to open their profile.
  4. Look for the option to dismiss/terminate (typically found under an action dropdown or "Manage" button).
  5. Follow Gusto's dismissal wizard:
    • Enter their last day of work.
    • Select the reason for departure (resignation, termination, etc.).
    • Review any final paycheck or PTO payout details.
    • Confirm the dismissal.

Why first? Gusto triggers the final payroll run and COBRA notifications. Delaying this can create payroll errors or compliance issues. All other account deactivations should happen after this step is complete.

Checklist items: Mark the Gusto dismissal as complete in the Notes section of the checklist.

2. Cursor — Remove Workspace Access

Cursor is the AI code editor used by the engineering team. Removing the departing engineer revokes their seat and any workspace-level configuration access.

  1. Go to https://cursor.com/dashboard/members
  2. Find the departing engineer in the members list.
  3. Click the 3-dot menu (⋮) next to their name.
  4. Select "Remove from workspace" (or equivalent) to revoke their access.
  5. Confirm the removal when prompted.

Note: This also frees up a paid seat if the engineer was on a business/team plan. Verify the seat count has decreased after removal.

Checklist items: Mark Cursor access revoked under System-Specific Access → Third-Party Services.

3. Slack — Deactivate Account (Then Delete Profile for Permanence)

Slack has a two-stage process: first deactivate, then optionally delete the profile to permanently remove their name and display information.

  1. Go to https://qwestlyworkspace.slack.com/admin
  2. Find the departing engineer in the member list (use search if needed).
  3. Click the 3-dot menu (⋮) next to their name.
  4. Click "Deactivate account".
    • This immediately signs them out and revokes access.
    • Their messages remain visible in channels and DMs.
  5. If you want this to be permanent:
    • After deactivation, the member's entry will still show with a deactivated label.
    • Click the 3-dot menu (⋮) again next to their deactivated entry.
    • Click "Delete profile".
    • Warning: This is irreversible. Their full name, display name, and profile information will be permanently deleted from the workspace. Their messages will still appear but attributed to @deactivateduser.
  6. Confirm the deletion.

Guidance: For resignations and end-of-contract, deleting the profile is standard practice to clean up the member directory. For temporary leaves or situations where the person may return, consider only deactivating without deleting the profile.

Checklist items:

  • Mark Slack account deactivated.
  • Note whether profile was deleted or only deactivated.

4. Asana — Remove from Organization

Removing the engineer from Asana revokes access to all projects, tasks, and workspaces.

  1. Go to the Qwestly Asana admin console:
    https://app.asana.com/admin/1208967535790507/members/1214170636080094
  2. Find the departing engineer in the members list.
  3. Click the 3-dot menu (⋮) next to their name.
  4. Click "Remove".
  5. Asana may prompt you to reassign their open tasks. Choose an appropriate team member to inherit any in-progress or assigned tasks.
  6. Confirm the removal.

Important: Before removing, check if they have any open or upcoming tasks. Reassign them to an active team member to avoid orphaned work items. If they were the sole assignee on critical tasks, flag these with the relevant project lead.

Checklist items: Mark Asana access revoked. Note any tasks that were reassigned.

5. GitHub — Remove from Organization + Release Seat

GitHub requires two steps: remove the member from the organization, then remove their paid seat from billing.

Part A: Remove from Organization

  1. Go to the Qwestly people page: https://github.com/orgs/Qwestly/people
  2. Find the departing engineer in the members list.
  3. Click the 3-dot menu (⋮) next to their name.
  4. Click "Remove from organization".
  5. Confirm the removal.

Part B: Release the Paid Seat

  1. Go to the billing seat management page:
    https://github.com/organizations/Qwestly/settings/billing/remove_seats?seats=-1
  2. Review the pending seat changes — this page should show the freed seat ready to be removed from billing.
  3. Confirm the seat removal to stop being charged for that license.

Why two steps? Removing the person from the org revokes their access but does not automatically release the paid seat. You must visit the billing page to stop charges. If you skip Part B, Qwestly continues to pay for an unused seat.

Checklist items:

  • Mark GitHub org removal confirmed.
  • Mark seat released from billing.

6. Vercel — Remove from Team

Removing the engineer from the Vercel team revokes their access to deployments, environment variables, and project settings.

  1. Go to the Qwestly Vercel members page:
    https://vercel.com/qwestly/~/settings/members
  2. Find the departing engineer in the members list.
  3. Click the 3-dot menu (⋮) next to their name.
  4. Click "Remove from team".
  5. Confirm the removal when prompted.

Note: If the engineer had personal API tokens or deploy hooks set up, those will also be revoked upon removal. No additional cleanup is needed for Vercel-specific credentials.

Checklist items: Mark Vercel access revoked.

7. Google Workspace — Delete User (Offboard)

Google Workspace has a dedicated "Delete user" flow that handles data transfer options and offboarding in one step.

  1. Go to the Google Admin Users page: https://admin.google.com/ac/users
  2. Find the departing engineer by name or email.
  3. Hover over their name — action links will appear to the right.
  4. Hover over the "More options" dropdown (⋮ or similar icon that appears).
  5. Select "Delete user".
  6. A popover/dialog will appear with offboarding options:
    • Data transfer: You can transfer their Drive files, Calendar events, and email to another user (typically their manager or the CTO). Choose an appropriate recipient.
    • Email forwarding: Optionally set up email forwarding so incoming messages are not lost. Forward to their manager or the CTO for a transition period.
    • Offboard user: Select this to finalize the deletion.
  7. Review all selections and confirm.

Important: Transfer Drive ownership and calendar events before confirming deletion. Once the account is deleted, data recovery is difficult. If unsure, suspend the account first (instead of deleting) and delete after verification.

Checklist items:

  • Mark Google Workspace account disabled/suspended.
  • Note where email was forwarded (if applicable).
  • Note where Drive/Calendar data was transferred (if applicable).

8. Other Services & Shared Accounts

Review the following and take action if the departing engineer had access:

Password Manager

  • Check if they had access to any shared vaults.
  • Remove their account from shared vaults.
  • If they had a personal vault on the company account, ensure it is transferred or deleted.

API Keys & Shared Credentials

  • Review any shared API keys or secrets the engineer may have had access to.
  • Regenerate any keys that were shared and distribute new ones to the remaining team.
  • Common services to check: Stripe, Sentry, Datadog, Twilio, any database connection strings.

VPN & Infrastructure

  • If the company uses a VPN, revoke their access.
  • Remove any infrastructure/cloud provider access (AWS IAM users, etc.).
  • Rotate any shared SSH keys if necessary.

Physical Assets

  • If the engineer was issued any company hardware (laptop, monitor, peripherals), coordinate return and document serial numbers in the checklist.

9. Final Verification

After completing all steps above, perform a final audit:

  1. Revisit each service and visually confirm the engineer no longer appears in the member/user list.
  2. Check billing pages for GitHub and any other per-seat services to confirm seat counts decreased.
  3. Ensure the offboarding checklist has every checkbox marked and dated.
  4. File the completed checklist in the appropriate personnel folder: HR/Personnel/[employee-name]/Offboarding-Record-[Name]-[YYYYMMDD].md
  5. Generate SOC 2 / Vanta compliance documentation if applicable.

Quick Reference: All Service URLs

Service Admin URL
Gusto https://app.gusto.com/payroll_admin/people/all
Cursor https://cursor.com/dashboard/members
Slack https://qwestlyworkspace.slack.com/admin
Asana https://app.asana.com/admin/1208967535790507/members/1214170636080094
GitHub (People) https://github.com/orgs/Qwestly/people
GitHub (Seats) https://github.com/organizations/Qwestly/settings/billing/remove_seats?seats=-1
Vercel https://vercel.com/qwestly/~/settings/members
Google Workspace https://admin.google.com/ac/users

Order of Operations Summary

  1. Gusto — Dismiss first (triggers payroll)
  2. Cursor — Revoke workspace access
  3. Slack — Deactivate → Delete profile
  4. Asana — Remove from org, reassign tasks
  5. GitHub — Remove from org → Release seat
  6. Vercel — Remove from team
  7. Google Workspace — Delete user with data transfer
  8. Other services — Password manager, API keys, VPN, physical assets
  9. Final verification — Audit all services, file checklist

Document Version: 1.0
Created: May 29, 2026
Maintained By: CTO (Dominick Pham)