Think back to a client you worked with two years ago. Could you still log in to their website? Their email marketing platform? The shared folder with their customer list in it?
If you are not sure, you have plenty of company. Freelancers collect access the way kitchen drawers collect takeaway menus: one login at a time, each perfectly reasonable when it arrived, and none of them ever thrown away. Most contracts spell out the deliverables and the final invoice in detail, then say nothing about what happens to the keys.
A proper handback takes less than an hour at the end of a project, and most of the work can be done before that last week arrives. Here is how to make it routine.
Why old access is your problem, not just the client’s
It is tempting to treat leftover logins as the client’s responsibility. They own the accounts, after all, and it is up to them to remove you. In practice, many small businesses have no IT department and no record of who was ever given access. Nobody is coming to tidy up.
That leaves you exposed in a way that is easy to miss. Imagine your laptop is stolen, or an old password of yours turns up in a breach, and someone uses it to get into a former client’s online store. Your name is on the account. The activity log points to you. Even if you did nothing wrong, you are now explaining yourself to someone who trusted you, and possibly to their insurer or lawyer.
Keep an access log from the first day
Offboarding goes wrong mostly because of memory. By the end of a six-month project, nobody can reliably list everything that was shared along the way, so start the list when the project starts.
A simple note or spreadsheet is enough. Each time you are given access to something, add a line with four details:
- The service, such as the hosting provider, the analytics account or the social media scheduler
- How you got in, whether through your own invited user account or a shared login
- The permission level you were given
- Anything of yours attached to the account, such as your phone number, your email address or your authenticator app
That last column matters most, and it is the one people forget. Keep the log in the project folder, and add to it the moment access arrives rather than at the end of the week. It takes about twenty seconds per entry, and it turns the final handback from an archaeology project into a checklist.
While you are at it, push for invited accounts over shared passwords wherever the service allows them. When you have your own user seat, the client can remove you with a single click and the activity log shows what you actually did.
Move ownership before you give anything back
Before you remove yourself from anything, check that the client actually controls what you have been running. Things go wrong most often with accounts you set up on the client’s behalf, because you may be the only real owner they have.
Look closely at these in particular:
- Domain names. If you registered a domain in your own account for convenience, transfer it. A client who cannot renew their own domain has a serious problem waiting for them, and so do you when they call in a panic.
- Ad and analytics accounts. Make sure the client is listed as the top-level admin, and that billing runs on their card rather than yours.
- Two-factor authentication. If login codes go to your phone or your authenticator app, the client will be locked out the moment you disappear. Have them enrol their own device and save the backup codes before you remove yours.
- Recovery details. A recovery email address pointing at your inbox is a door you still hold open. Swap it for one the client controls.
Do this while you are both still in regular contact and at least a week before the project ends. Fixing a two-factor problem together takes minutes during a project and can take days after it, once you have moved on and the client is stuck talking to a support queue.
Close your side completely
Once ownership is settled, go down your access log and remove yourself. Delete your user seat, or ask the client to do it and confirm when it is done. Then ask the client to change any password you shared. Reused or lightly edited passwords are common here, so it helps to give them a specific suggestion: rather than adding a digit to the old one, they can get a long random replacement from something like this free password generator and store it in their password manager.
Then clean up what lives on your own machines, which is where the forgotten material usually hides:
- Saved logins in your browser and password manager
- API keys and access tokens in old config files or scripts
- Third-party apps you authorized with the client’s account, such as a reporting tool connected to their analytics
- Guest memberships in their Slack, Teams or project management workspace
- Local copies of customer lists, contracts and database exports
On that last item, check your contract first. You may be required to keep some records for a set period, and invoices usually need to be retained for tax purposes. Keep what you must, and delete personal data about the client’s customers unless you have a clear reason to hold on to it.
Finish with a one-page handover note
Your final step is a short document, sent alongside the last invoice. It should list every service you touched, who now owns it, what you removed yourself from and anything still needing the client’s attention, such as a domain renewal due in March or a subscription they may want to cancel.
This does three useful things. It gives the client something to pass to whoever works on the project next. It creates a dated record that you stepped away cleanly, which is useful if a question ever comes up later. And it looks highly professional, because so few freelancers bother. Clients remember the person who left everything tidier than they found it, and that memory tends to turn into referrals.
To make this stick, add a single line to your contract template stating that access will be returned and removed within seven days of project completion. It costs you nothing, and it means you get to raise the subject as a routine step rather than an awkward conversation.
A final habit worth keeping
Pick one past client this week and try to log in to their accounts. If you get through, tell them, remove yourself and start your access log with the next project. Ending the work properly is part of the work.