Short answer: Almost every agency has an onboarding process and almost none have an offboarding one. When a client leaves, the work stops, the invoice goes out, and nothing else happens. Credentials stay valid. Portal and workspace access stays live. Files nobody asked for stay on your servers. And the one moment where a departing client is most willing to give you a referral or a testimonial passes unused. Offboarding is thirty minutes of work that removes real security exposure and occasionally recovers revenue.
Why it gets skipped
Offboarding happens at the emotionally worst moment. Either the client left and it stings, or the project ended and everyone has moved on. Neither produces enthusiasm for a checklist.
It's also nobody's job. Onboarding has an obvious owner — whoever won the account. Exit has no owner, so it defaults to nobody.
The cost isn't visible on the day. It's visible fourteen months later when you're auditing access and find a former client's credentials still live in a task description.
Part 1 — Security, within 48 hours
This part is not optional and it is not about trust. It's about the fact that dormant access is a liability regardless of how well the relationship ended.
Rotate every credential they gave you. Their CMS, ad accounts, analytics, hosting, social. You had access; that access should now end from their side too, and telling them so is professional rather than awkward.
Rotate anything you gave them. Staging environments, shared drives, API keys, anything they were handed during the engagement.
Revoke portal or workspace access. If they were a ClickUp guest, remove them — this also frees a seat if you were near your plan's guest allowance. If they had portal access, revoke it.
Search for credentials in task descriptions and chat. Anything relating to this client that's sitting in a Slack channel or a ClickUp task should be treated as exposed and rotated. This is the step that catches what the first two miss.
Remove them from recurring distributions. Announcement lists, status emails, reports. A former client receiving a client-only announcement is a bad look and occasionally a confidentiality problem.
Check third-party access. Contractors and freelancers who worked on that account often hold credentials too. Offboarding a client and offboarding the people who served them are two different lists.
Part 2 — Handover, within a week
What you owe them is usually defined in the contract. What you choose to do beyond it is what determines whether this is a burnt bridge or a dormant referral source.
Deliverables in a usable format. Source files, not just exports. A client who has to come back and ask for the working files remembers the friction, not the work.
A short handover document. Where things live, what's in flight, what needs attention in the next 30 days, and known issues. Half a page is enough and it costs you twenty minutes.
Confirm what you're retaining and for how long. Your obligations here depend on your agreement and your jurisdiction — check both rather than assuming.
Final invoice, with the work visible. The last invoice is the most disputed one, because the relationship's goodwill is at its lowest. Send it with the record attached.
Part 3 — The conversation nobody has
This is the part that occasionally pays for itself.
Ask why, properly
Not on the last call, when they're being polite. A week or two after, in writing or on a short call: "I'd genuinely like to know what we could have done differently." Departing clients are more honest once the decision is behind them and there's nothing left to negotiate.
Expect the first answer to be diplomatic. The second answer, if you ask a follow-up, is usually the real one.
Ask for the referral now, not later
Counterintuitive but it works: a client who left for a legitimate reason — budget, internal hire, changing direction — is often perfectly happy to refer you. Their goodwill is highest right at the end and decays fast.
This is only true if the work was good and the exit was clean, which is exactly why parts 1 and 2 matter.
Get the testimonial before they forget
Six months from now they won't remember the specifics. Right now they do. If you don't have case studies yet, departing clients are an underused source of them.
Set a re-engagement date
Put a reminder six to nine months out. A meaningful share of agency churn is circumstantial — a budget cut, a new marketing lead with their own preferences, an in-house hire that didn't work. Circumstances change and almost nobody follows up.
Part 4 — What you learn from it
Log two things somewhere you'll actually look:
The stated reason and your read on the real reason. They're often different. The pattern across five or six exits tells you more than any individual one.
When the relationship actually started declining, in hindsight. Usually there were signals — slower responses, thinner feedback, communication becoming one-directional. Naming them retroactively is how you learn to spot them early.
If you're tracking client health metrics, this is where you calibrate them: go back and look at what those numbers were doing three months before the exit.
Where BluOps fits
Two parts of this get materially easier when clients aren't inside your workspace.
Access revocation is one action. Removing a client's portal access ends everything they could see. There's no audit of which Lists, Folders and tasks were shared with them, and no risk that a Folder move later re-exposes something.
Credential exposure is bounded. BluOps includes credential sharing on all plans with expiry, instant revocation and access logging — so when a relationship ends you can see exactly what was shared and cut it, rather than searching Slack for the word "password."
Frequently asked questions
What should be in an agency client offboarding checklist?
Rotate all credentials in both directions, revoke portal and workspace access, search chat and task descriptions for exposed credentials, remove them from recurring distributions, hand over deliverables in usable formats with a short handover note, send the final invoice with the work record, then ask why they left, ask for a referral, and set a re-engagement reminder.
Should I rotate credentials when a client leaves?
Yes, in both directions, and within 48 hours. This isn't about trust — dormant access is a liability regardless of how the relationship ended, and the exposure grows the longer it sits unnoticed.
Is it worth asking a departing client for a referral?
Often yes, if the work was good and the exit was clean. Clients who leave for circumstantial reasons — budget, an internal hire, a change in direction — frequently have no complaint about the work. Their goodwill is highest at the end and decays quickly.
How do I get honest feedback from a client who left?
Ask a week or two after the final call rather than on it, and ask a follow-up question. The first answer is usually diplomatic. The second one is usually the real one, because by then there's nothing left to negotiate.
How long should agencies keep former client data?
It depends on your agreement and your jurisdiction, and both should be checked rather than assumed. Whatever the answer, confirm it with the client in writing at exit so there's no ambiguity later.
Should I follow up with churned clients?
Set a reminder six to nine months out. A meaningful share of agency churn is circumstantial, circumstances change, and almost nobody follows up — which is exactly why it works.
The short version
Offboarding gets skipped because it happens at the worst emotional moment and belongs to nobody. The cost shows up much later, as credentials that were never rotated and referrals that were never asked for.
Rotate everything within 48 hours. Hand over properly within a week. Then ask the three questions — why, would you refer us, and can we quote you — while the answers are still available.
See how access and credentials work in the portal — 7 days of full access is $1.