Here is the number that should embarrass every ops team in the US: 31 SaaS accounts per employee, on average. When someone leaves, those accounts do not politely delete themselves. And according to BetterCloud, half of IT professionals report that revoking SaaS access takes more than 24 hours after a departure — long enough for a disgruntled ex to export a customer list, cancel a renewal, or ship themselves a parting gift.

This is the quiet crisis a good SaaS offboarding checklist fixes. Verizon's 2025 Data Breach Investigations Report found that 20% of breaches trace back to credential exploitation, and a meaningful slice of those start with orphaned accounts from sloppy offboarding. Meanwhile, Productiv benchmarks show 46% of SaaS licenses sit unused in any given month — a direct symptom of offboarding debt nobody cleans up.

Most SaaS offboarding checklist templates you find online are written for 5,000-person enterprises with Okta, a dedicated IT team, and a six-figure BetterCloud contract. This one is written for the team you actually run: 5 to 200 people, no SSO across half the stack, procurement that lives in a Notion page, and a founder or ops lead doing IT on the side. The five steps below are the exact SaaS offboarding checklist we would hand to a Series A ops hire on day one.

Step 1: Build the Master SaaS Inventory Before Anyone Quits

You cannot offboard what you cannot see. The first — and most skipped — step of any real SaaS offboarding checklist is the master inventory, and it has to exist before the two-week notice lands, not after.

Start with your corporate credit card statements from the last 12 months. Pull every recurring software charge, then cross-reference against Google Workspace or Microsoft Entra to catch anything billed personally and expensed. Nudge Security found the average employee has 31 SaaS accounts — most teams, when they actually count, discover they own three to five times more tools than IT thinks they do. This is the same SaaS sprawl problem most teams tolerate until renewal season forces the conversation.

For each tool, capture five fields in a single spreadsheet.

Tool name, vendor, and billing owner

Who signs the contract, and whose card gets charged? These are rarely the same person.

SSO status

Federated via Okta, Google, or Microsoft? Or does every user manage their own login? Non-SSO tools are the dangerous ones — they do not deprovision automatically.

Data sensitivity

Does this tool store customer data, source code, financial records, or internal IP? Rank it high, medium, or low. Your SaaS offboarding checklist will use this to sequence revocation order in Step 3.

Admin account owner

If the departing employee is the admin of a tool, you have a separate and worse problem than a missed seat. You need a playbook for transferring admin rights, and that playbook starts with knowing who is admin where.

Seat cost per month

Without this number, you cannot measure whether offboarding is actually reclaiming money. Zylo's SaaS management benchmarks put average organizational waste at roughly $135,000 per year in unused licenses. Your inventory is how you stop contributing to that figure.

Rebuild this inventory quarterly. If you already have a plan to reduce SaaS costs for 2026, the same source-of-truth spreadsheet powers both workflows — no duplicate effort.

Step 2: Trigger the SaaS Offboarding Checklist the Moment Notice Lands

The single biggest gap between teams with good offboarding hygiene and teams with breached customer data is speed. BetterCloud reports that 33% of teams still take more than 24 hours to complete offboarding — and that 24-hour window is when incidents happen.

Your SaaS offboarding checklist should fire the instant an offboarding is confirmed, whether that is a resignation, a termination, or the end of a contractor engagement. The trigger ideally lives in one of three places.

Option A — HRIS trigger. If you run Rippling, Gusto, Deel, or BambooHR, the moment an employee's status flips to "terminated," a webhook fires into Slack, Notion, or Linear. This is the gold standard, and it takes an afternoon to set up. Both Rippling and Deel ship native SaaS deprovisioning workflows — use them.

Option B — Slack command. For smaller teams without a real HRIS, a /offboard @username slash command that creates a ticket in Linear or a task in Asana keeps the SaaS offboarding checklist consistent even when the founder is the one running it.

Option C — The "red envelope" manual. At minimum, print a physical SaaS offboarding checklist and tape it next to whoever runs payroll. The moment they process a final paycheck, they work through the list. Low tech, but at least deterministic.

Whichever trigger you pick, one rule matters: the SaaS offboarding checklist runs the same day notice is given for voluntary departures and within 60 minutes for involuntary ones. The 44% of organizations that have leaked data through former employee accounts almost always skipped this timing rule.

Step 3: Revoke SaaS Access in the Right Order (Not the Obvious One)

Most offboarding checklists tell you to revoke access alphabetically or by tool category. Both are wrong. The correct revocation order on a serious SaaS offboarding checklist is by blast radius — highest-risk tools first, lowest-risk last. Work the list in this sequence.

High-blast-radius tools (revoke first, within 15 minutes)

Medium-blast-radius tools (within 4 hours)

Low-blast-radius tools (within 24 hours)

A strong SaaS offboarding checklist also specifies how to revoke, not just when. For SSO tools, disabling the account in your IdP is enough. For non-SSO tools, you need to log in as admin and manually remove the user — and change the password on any shared accounts they knew. Orphaned demo and former-employee accounts were the entry point for the 2024 Snowflake breach, where credentials exposed by a third party were reused because those accounts were never deprovisioned.

Step 4: Reclaim Seats, Archive Data, and Document the Audit Trail

Revoking access is half the job. The other half of your SaaS offboarding checklist is cleaning up what gets left behind, and this is where most teams stop executing.

Reclaim and reassign seats. Every tool on your inventory should have a "what to do with this seat" answer. Options: downgrade to free tier, reassign to a new hire, or fully cancel. Nearly half of SaaS licenses stay unused — including ghost seats of people who left months or even years ago. Your SaaS offboarding checklist is the primary mechanism that keeps that number from growing.

Transfer ownership of shared assets. The departing employee almost certainly owns: calendar invites, recurring meetings, Google Docs, Notion pages, Figma files, Loom recordings, shared Slack channels, payment methods on vendor accounts, and calendar rooms. Each of these needs an explicit transfer step, documented, before access is revoked. Skip this and you will spend two weeks fire-drilling about a "missing" contract that is sitting in an ex-employee's personal Drive.

Archive, do not delete. For customer-facing roles, archive sent email, CRM notes, call recordings, and Slack DMs per your retention policy. For engineering roles, archive any private repos or notebooks. If you run a regulated business or plan to raise from institutional investors, your SaaS offboarding checklist needs a SOC2-ready audit trail — a simple markdown log per offboarding that records who ran the checklist, when each tool was revoked, and what was archived.

Close financial loops. Final expense reimbursements, vendor accounts the employee set up, equipment return. Half of remote teams forget that employees sign up for SaaS with their personal email and expense it — those accounts show up on your SaaS sprawl report months later.

Document everything. If you ever face an insider threat incident — averaging roughly $4.9M per breach according to IBM — the audit trail is the first thing legal and your insurer will ask for. A SaaS offboarding checklist without a documented output is security theater.

Step 5: Close the Loop With Monthly Audits and Automation

A one-time SaaS offboarding checklist is better than nothing. A living, automated one is what separates teams that pass their first security review from ones that fail it twice. The final step is building the feedback loop.

Run a monthly orphan audit. Once a month, pull the list of users in every SaaS tool and cross-reference against your active employee roster. Any mismatch is an orphan — deactivate it. This takes 30 minutes if your inventory from Step 1 is current. Teams that do this catch an average of 3–5 orphaned accounts per month that slipped through offboarding.

Track revocation time as a metric. Your SaaS offboarding checklist should measure itself. "Time from termination to full revocation" is the metric; the goal is under four hours for voluntary departures and under one hour for involuntary. If your median is still 24+ hours, you are in the high-risk majority.

Automate the obvious. Once your SaaS offboarding checklist has run 10+ times and you know the exact sequence, automate everything that can be automated. HRIS webhooks, Okta deprovisioning rules, Slack bots that remove users from channels, scripts that revoke GitHub tokens. The tools matter less than the habit of reviewing automation monthly.

Reduce the surface area. The best SaaS offboarding checklist is a short one. Every tool you consolidate is one fewer account to revoke, one fewer seat to reclaim, one fewer orphan to chase. This is the quiet reason we built Coommit — replacing three or four meeting and collaboration tools with one reduces the offboarding surface area by roughly 20 minutes per departure and eliminates the single most common orphan category: old meeting recordings nobody remembered to revoke.

The Bottom Line

The average US data breach now costs $9.4 million — and a sloppy SaaS offboarding checklist is one of the cheapest vectors for causing one. The playbook here is not complicated: build an inventory, trigger the checklist fast, revoke by blast radius, reclaim and document, then loop the process monthly. What is hard is making it boring enough that it runs every single time someone leaves, not just when the departure is public or dramatic.

Remote and hybrid teams in 2026 do not have the luxury of physical offboarding — no badge to collect, no laptop handed back at the door. The SaaS offboarding checklist is the offboarding. Treat it like the security control it actually is, and most teams will clawback more in reclaimed licenses than the process costs to run.