Offboarding a virtual assistant: the access nobody wrote down
Virtual assistants get a kind of access nobody else does: inside the owner's inbox, the calendar, the personal card saved in a dozen checkouts, the social accounts, the travel logins. And because VA relationships start informally — a password shared in a chat message to get something done today — the access map exists nowhere except the chat history.
When the engagement ends (or the VA vanishes, which in the gig economy is the same event with less notice), the offboarding is really an archaeology project. Here's the dig, and the setup that makes the next VA relationship auditable from day one.
The archaeology: reconstruct what they could touch
- Identity: inbox delegation or full email credentials? Calendar? The password manager — a shared vault, or your master password (be honest)?
- Money: cards saved where they shop for you, expense tools, invoicing platforms, marketplace accounts (Amazon Business et al.).
- Voice: social accounts they posted from, the review-response logins, the newsletter tool.
- Operations: booking sites, courier accounts, supplier portals, e-commerce order screens.
- The chat history itself: search your messages with them for 'password', 'login', 'code' — it's the most accurate record of what was shared that exists.
The revocation pass
- 1Remove delegated access firstEmail delegation, calendar sharing, and any properly-granted user seats — the clean revocations take five minutes, do them immediately.
- 2Rotate every shared passwordAnything that ever transited chat or email is compromised-by-default. Rotate, and move the new credentials into a password manager this time.
- 3Re-check recovery paths and 2FAIf their phone or email became a recovery contact anywhere (it happens more than you'd think, for convenience), re-point it.
- 4Sweep the stored cardsRemove your card from accounts they controlled; check statements for subscriptions they set up on your behalf.
- 5Watch the month afterVA-managed renewals and bookings fail on a delay — the 30-day sweep from the general offboarding checklist applies.
Set the next one up properly
- Access flows through a password manager's shared vault — the VA never sees the actual passwords, and revocation is one click.
- Delegation over credentials: inbox delegation, calendar sharing, user seats — every serious platform supports working in your account without being you.
- Their own card never yours: use virtual cards with limits for VA purchasing.
- Keep the access list in your register as you grant it — offboarding then takes minutes, not forensics.
The free scan maps your domain, email, cloud, social and tools from public records — and shows what you'd lose access to tomorrow. No login, nothing to install.
Check my business