The Exit Interview Your Logins Never Get

Leaving a job is usually a paperwork story. You hand back the laptop, sign the form, say something warm about the team, and spend the last afternoon pretending to tidy your inbox. What often goes unmentioned is the mess left behind in the digital plumbing: the shared drive only you had edit rights to, the project management tool where your account is still the billing owner, the browser profile holding saved passwords for services the team still uses.

That is not just untidy. Under UK data protection rules, orphaned accounts and unclear ownership are a quiet risk. The ICO expects organisations to know where personal data lives and who is responsible for it. A departing employee who remains the sole administrator of a SaaS tool is neither a good leaving present nor a compliance strategy.

The good news: you do not need to turn your final week into an IT project. You need a short, deliberate handover that happens before the goodbye card. Think of it as the exit interview your logins never get.

Start with a map, not a password dump

The instinct is to email a list of passwords on the last day. Please do not. A password dump is hard to audit, easy to forward, and usually out of date within minutes. Instead, make a simple ownership map: tool, account type, who else has access, and what needs to happen before you go.

Split it into four buckets:

• Shared drives and document stores — who becomes the owner of folders you created? Are there files only you can access?
• SaaS accounts — especially anything where you are the billing contact, workspace owner or sole admin.
• Browser profiles and saved credentials — work profiles should be handed over or wiped, not left signed in on a shared machine.
• MFA devices and authenticator apps — the small one, but the one most likely to cause a frantic phone call three weeks later.

This map does not need to be beautiful. A spreadsheet with five columns is fine. The point is to make invisible ownership visible while you still remember it.

Treat owner accounts like keys to the building

Many modern tools have a confusing habit of making the person who set them up the permanent owner. That person is often not IT. It might be the marketing manager who trialled a scheduling tool, or the operations lead who created the team's shared drive.

Before you leave, check for any service where your account is the only owner or billing administrator. Transfer that role to a named colleague — not a generic inbox nobody checks — and confirm the change by logging in as the new owner if possible. If the tool requires a support ticket to transfer ownership, raise it at least two weeks out.

For managers, this is the moment to ask a blunt question: if this person disappeared tomorrow, which systems would we struggle to get back into? The answer is your handover list.

Sort the browser before the last day

Browser profiles are the digital equivalent of a drawer full of spare keys. Saved passwords, autofill details, extensions, bookmarks, session cookies — it is all useful until it belongs to someone who no longer works there.

On a work device, the cleanest approach is usually to sign out of the work profile, remove saved payment details, and let IT wipe or reassign the device. Do not export a personal copy of the password store unless your employer has explicitly agreed to it and you have checked what is allowed. Work credentials are not a leaving gift.

If you used a personal browser profile for work — which many people do — review saved passwords and remove anything tied to the employer. It is also worth checking whether your personal password manager has work logins stored in it. Those should be transferred to the team's approved vault or deleted, not carried into your next role.

Do not forget the small devices

Authenticator apps are where digital handovers often fail. A colleague changes their phone, the old device is wiped, and suddenly nobody can approve access to the finance system. Before you go, list every account using your authenticator app and move the ones that belong to the employer to a shared or team-controlled method where available.

If the organisation uses hardware security keys, hand them back and ask for them to be removed from your account. If you used SMS codes to a personal phone number, change the number on the account before your last day. These are small jobs that prevent very large headaches.

The manager's side of the checklist

A clean digital exit is not only the leaver's job. Managers should book a 30-minute handover session in the final week — not the final hour — and cover three questions:

1. Which systems do you own or administer?
2. Which files or folders are only accessible through you?
3. Which accounts use your personal phone, email or authenticator?

Then confirm the transfers in writing. A short email to the team saying who now owns what is more useful than a heroic last-day scramble. It also gives the leaver a clear end point: after this date, these accounts are no longer mine.

Make the last day boring

The goal is not a dramatic digital detox. It is a boring final day where access is transferred, ownership is clear and nobody has to guess what the password was. That is better for the leaver, better for the team and much better for anyone who has to explain the organisation's data map to a regulator.

So before you log off for the last time, do the unglamorous work: map the accounts, move the owner roles, clear the browser, hand over the MFA and confirm it all in writing. Your colleagues will remember the goodbye message. They will be even more grateful for the logins that did not become a mystery.