Offboarding Security: The Employee Who Resigned and Took Everything With Him

What is offboarding security? Offboarding security is the process of ending a departing employee's access to everything they used at work: conversations, groups and documents, not only devices and network accounts. Most organisations close the visible assets on the last day and leave messaging groups and downloaded files open indefinitely.

Offboarding is not finished when the network account closes. The real test is whether every conversation, group and document follows the employee out of the door.

On Thursday at eleven, Tarek handed back the laptop.

The badge followed. He signed the clearance form, shook his manager's hand, and left after four and a half years.

Eleven minutes. Every step done correctly.

That evening, on his personal phone: nine work groups nobody removed him from. Eight contracts sitting in the device's memory as auto-saved files. Photos of the pricing sheet a colleague sent two months ago. A full thread about a client who still hasn't signed. And three voice notes from a meeting that was never meant to be recorded.

He took none of it deliberately. All of it has been there since day one, because that is where the organisation asked him to work.

01What the organisation actually got back

A clearance form is built to recover what you can see and own: a device, an access card, a drawer key, a vehicle, a network account.

Visible assets. You know they exist, you know how many there are, you know who holds them.

What nobody recovered on Thursday is everything that moved through a personal messaging app over four and a half years. Nobody knows how much. Nobody ever could. There is no log, no inventory, no single screen you can put in front of a security manager that says: here is what Tarek is holding right now.

The network account was disabled before he reached the car park. The nine groups are still running, and his phone is still in them.

02The problem is not Tarek

This is exactly where most people get the diagnosis wrong.

Tarek broke no policy. He smuggled nothing out. He used the channel he found on his first day, the one his manager uses, the one his first instruction arrived through. When the unofficial channel is the only one fast enough, it becomes the official one in practice. Using it is compliance, not misconduct.

The colleague who sent the pricing sheet did nothing wrong either. He was trying to finish before the end of the day.

The failure isn't individual behaviour. It's that the organisation has no single place it can go to end Tarek's access. It has a control for email, one for the network, one for the finance system. It has nothing at all for a group living on a phone it doesn't own.

03Who is the user, actually?

In personal messaging apps, identity is a phone number. Perfectly sensible for personal use. Ungovernable inside an institution.

The number belongs to the employee, not to you. It travels to his next job, and to a competitor if that's where he lands. And it has no link to his employment status: the app has no idea Tarek left, and there's no way to tell it.

In Tawasol, the organisation defines identity. Employees sign in with organisational credentials or by role, and you can relabel the login fields to match your own terminology: Employee ID, National ID, Passport Number. Identity can be tied to Active Directory so sign-in is unified and controlled from one place. Each user gets granular permissions that follow their role.

The practical difference is clean. Tarek's membership isn't nine separate relationships on a phone. It's one line inside your organisational structure. When he leaves, an admin removes him from the member list in the dashboard: one step, one confirmation. And when ten people leave in the same month, they can be removed in bulk from a single file.

Nobody has to remember nine groups, because there's only one thing to remember.

04Where do the files actually live?

The second question, and it always gets asked late: where are the documents that passed through those conversations?

In personal messaging apps, files sit on the provider's servers, outside your perimeter. The conversations are encrypted, yes. But the data has left your control, and your ability to apply your own policy left with it.

In Tawasol, the platform runs on-premise or in a private cloud you choose, so conversations and files stay inside your infrastructure and under your own policies. The specifics for your configuration, including connectivity dependencies, encryption coverage, key custody and support access, are confirmed with the team during technical review.

This isn't a row in a comparison table. It's the paragraph an auditor reads when they ask where the data sits and who holds the keys. In Egypt and Saudi Arabia today, that's the first question asked, not the last.

Before you read on, run this yourself. Ask HR for the last three people who left. Then ask IT, name by name: what actually closed the day they walked out, and what is still open? Open any old work group and search for their numbers. It takes half an hour, and you need nobody from outside the organisation. What you end up holding is the size of your current exposure, in your own handwriting.

05Downloading is not a permanent right

This is the difference that shows up months after someone leaves.

In a personal group, attachments are freely downloadable. Every file reaches every member and saves to every device, and that's it. When the employee leaves, he keeps everything he ever downloaded. There is no second stage and no way back.

In Tawasol, downloading an attachment requires prior permission. The corporate library is central, and every file in it carries a security status that determines whether it can be downloaded at all. Permissions follow job role: a document reaches the people whose role requires it, not everyone who happened to be in a conversation.

And the part that matters on Thursday: a departing employee's permissions are revoked when they leave, and their access to files goes with them.

That changes what the asset is. The document stops being a copy that spread irreversibly and becomes a resource that stays under management.

06What if someone photographs the screen?

It's a fair objection: if he can photograph it, what did any of this achieve?

That's why leakage isn't handled by access control alone.

Tawasol adds two layers on top of access control: screenshot restrictions on supported devices, and dynamic watermarking on documents. Neither stops someone photographing the screen with a second phone. But a watermarked photograph gives an investigation somewhere to start.

The difference between a leak you can investigate and one you can't is the difference between an incident that closes and an incident that stays open forever.

Replay Thursday

Same scene. Everything above in place.

Tarek signs at eleven. At five past, an admin opens the dashboard and removes him from the member list. One step, in one place. His membership in all nine groups ends, and his library permissions are revoked with it.

The eight contracts were never copies on his device. They were documents in a central library he reached because of his role, and some of them were never downloadable in the first place. The role ended, and the access ended with it.

Nothing can prevent a photograph taken with another device. But the one document that was photographed carries a watermark that helps trace it back to who was viewing it.

He returned the laptop and the badge. This time, he returned the access too.

The whole difference is that access became something the organisation owns and can see, instead of something living on a device it neither owns nor sees.

07The missing page in your clearance form

Someone will leave your organisation this month. The form they sign covers the laptop, the badge and the drawer key, and says nothing about four years of conversations and documents. It was written for a world where assets were things you carried in your hand.

The failure was never Tarek. The failure is that the form doesn't know to ask about the part that matters.

Send us your current offboarding steps and we'll return them as an Offboarding Exposure Report: at each step, what actually closes, what stays open after the employee leaves, and who owns the decision to close it. It's a written document for your risk committee, not a slide deck. Send it to info@it-blocks.com with "Offboarding Exposure Report" in the subject line.