Twelve Days of Offboarding: Closing the Door Behind Your Festive Cover

The village hall raffle has been counted, the last Saturday shift is done, and the seasonal temp has handed back the lanyard. What rarely gets handed back is access. A dormant inbox with a live password is one of the quietest risks a micro-firm carries into the new year, and it costs nothing to close.

Why the Festive Break Is the Risky Bit

Micro-firms and small charities run on goodwill and shared logins at the best of times. In December, that stretches: a student covers the weekend, a volunteer answers the enquiries inbox, a bookkeeper's assistant logs into the payment dashboard to reconcile the Christmas fair. None of it is sinister. But when the mince pies are finished and everyone goes back to normal, the accounts linger — often with weak passwords, no multi-factor authentication, and forwarding rules nobody remembers setting.

The Information Commissioner's Office doesn't need a dramatic breach to take an interest. An account left open is a data protection issue waiting for a reason. And for a small charity, the donor list and Gift Aid records in that inbox are exactly what a fraudster wants.

Start With the Email Account, Not the Lanyard

The single most useful hour you'll spend this December is on email. Before you say goodbye:

• Sign the account out of every device. In Google Workspace, that's Security > Your devices. In Microsoft 365, it's the user's 'Sign out everywhere' option or an admin session revoke.
• Change the password to something new and long, and store it in your password manager — not a shared spreadsheet called 'logins final FINAL'.
• Remove the recovery phone number and backup email if they belong to the leaver.
• Turn off any app passwords or 'less secure app' access.
• Check for delegates, shared calendar permissions and mailbox permissions.

Then look for the thing almost everyone forgets: forwarding rules. A rule that quietly copies every incoming message to a personal Gmail address is the classic quiet exit. In Outlook, check Settings > Mail > Forwarding and Rules. In Gmail, check Settings > Forwarding and POP/IMAP, plus Filters and Blocked Addresses. If you find one you don't recognise, delete it and change the password again.

The Cloud Drive Is the Other Front Door

Shared drives are where the Christmas rota, the safeguarding notes, the supplier contracts and the payroll spreadsheet live. When someone leaves, their access doesn't always leave with them.

Go through the folder permissions on your main drive (Google Drive, OneDrive, SharePoint or Dropbox) and remove the leaver from every folder they touched. Pay attention to 'anyone with the link' sharing — a link pasted into a WhatsApp group in November still works in February. Turn off link sharing on anything sensitive, and check whether the leaver created any external sharing links themselves.

If your charity uses a case management or CRM system (Donorfy, Beacon, Salesforce), remove the user there too. Same for the volunteer rota tool, the newsletter platform and the online booking system for the hall.

Shared Logins Are a Trap, Not a Shortcut

Small organisations love a shared inbox password — enquiries@, bookings@, admin@. It feels efficient. It also means you can't tell who did what, and you can't revoke one person without disrupting everyone.

If you must keep a shared login for now, at least change the password the moment the seasonal cover ends, and record who has the new one. Better still, use delegated access or a proper shared mailbox so each person signs in as themselves. It takes an afternoon to set up and saves a lot of guessing later.

Payment Apps Deserve Their Own Pass

This is the one that keeps treasurers awake. Seasonal staff and volunteers often get added to payment tools so they can take card payments at the Christmas fair or reconcile the online shop. That access is easily forgotten.

Check and remove users from:

• SumUp, Zettle, Square or Dojo, if you use a card reader.
• GoCardless, Stripe or PayPal, especially any 'team member' or 'additional user' invitations.
• Your online banking, if they were set up as a payee approver or secondary user.
• Accounting software — Xero, QuickBooks, Sage — where a user can raise invoices or see bank feeds.

Also check direct debits and saved payees. A payee added in a busy week can sit there for months. And if the leaver had a company card or a card reader in their bag, get it back and cancel it, not just 'pause' it.

The One-Page Handover Record

You don't need a policy document. You need a single page that answers: who had access to what, when was it removed, and who owns it now.

Write down:

• The person's name and last working day.
• Every system they could sign into.
• The date access was removed and by whom.
• Any passwords changed (not the passwords themselves — just the date).
• Anything still outstanding, with a name against it.

Keep it with your other governance paperwork. For a charity, it's useful evidence that you took data protection seriously. For a micro-firm, it's the difference between 'I think we sorted that' and 'we did, on 23 December'.

If They're Coming Back in January

Seasonal staff often return for the Easter rush or next December. That's fine — but don't leave the account live just in case. Close it, then reopen a fresh one when they return, or suspend it rather than leaving it active. A suspended account can be restored; an active account with a shared password can be used by anyone who still has the details.

A Short Checklist for the Last Week

Before you lock up on your last day:

1. Sign the leaver out of email and cloud on all devices.
2. Change the email password and remove recovery details.
3. Check forwarding rules and delegates.
4. Remove drive and folder permissions.
5. Remove users from payment apps and accounting tools.
6. Change shared inbox passwords.
7. Collect keys, cards, card readers and any borrowed devices.
8. Write the one-page record.

It's not the most festive job on the list. But it's the one that lets you enjoy the break without wondering who still has the keys to the inbox. And in a small organisation, that's a gift worth giving yourself.