Deprovisioning & offboarding

Cut access cleanly when someone leaves — and bring them back cleanly if they return.

How it works #

Remove a user (or let SCIM do it automatically on directory removal) and their access ends immediately with forward secrecy — they can't decrypt data going forward, and shared-vault rotation removes their reach to past data. All of it is audit-logged.

What the offboard confirmation tells you #

When you offboard a member, the confirmation states exactly what happens:

• Data is retained — org-owned vault data is not deleted by offboarding.
• Access is severed — the member's key is deleted and the shared key is rotated, so they can no longer decrypt anything, past or future.
• Recovery-share warning — if the departing member held an org recovery share, the confirmation flags it so you can redistribute the share and keep your recovery quorum intact.

Bringing someone back: the Offboarded state and Re-invite #

Offboarded members don't vanish — they show an "Offboarded" state in Members. If the person returns, click Re-invite: it re-enables the account, restores their previous role, and sends a fresh enrollment code, so you don't rebuild them from scratch.

What if… #

• You need to offboard a whole team fast — revoke the group; SCIM removal from your IdP cascades here.
• A departure is urgent/hostile — revoke immediately from Members rather than waiting for the next SCIM sync.
• A former employee is rejoining — Re-invite from Members, then have current vault members re-share the vaults they need (see the link above).