A leaver's access: a revocation checklist

A person leaving is almost always closed in HR and almost never at the domain registrar. The site keeps working, and the question feels technical and "someday". A former employee or contractor who still has a panel can change DNS, take the ad account or export the leads. Malice is optional: an old laptop is enough.

What to revoke the same day

• Mail, forwarding and access to a shared mailbox. Check filter rules separately.
• Hosting, the CMS, FTP or SSH, the DNS panel.
• The domain registrar. This is forgotten most often, and it is the most expensive item.
• Ads, analytics, pixels, marketplace accounts.
• CRM, company messengers, VPN, the repository, the password manager.
• Keys and app tokens the person issued "in their own name".

The list is useless if it lives in one administrator's head. It belongs next to the leaving request: HR sets the date, a technical person walks the items and marks them. A contractor agreement should say in advance that access ends on the day of handover, not "while the project is breathing".

Lexora builds this register in an infrastructure audit and helps walk it the first time, while the list is still short and honest.