Employee offboarding
What to do with access when an employee leaves
The real problem
The person left, not what they knew
Deleting the account isn’t enough
Removing someone’s user in a system doesn’t change the real passwords of the servers they had access to.
Nobody remembers everything they had
Without a central record, it’s easy to forget that person also had access to a backup server, or a database nobody checks often.
You need to know, not guess
Without a connection history, there’s no way to confirm what that person touched in their last days — only to trust that it was nothing.
In SHTERA, removing someone from the company (or from a single folder) cuts off their vault access immediately: they can no longer open a new connection to any server in that folder, without needing to notify anyone else or touch other people’s access.
That removal is instant, but it doesn’t change a password that person may have used outside SHTERA at some point. That’s what credential rotation is for: it changes the real password on the server, verifies it, and only then retires the old one — the step that actually closes the risk.
Before deciding what to rotate, the access audit log shows which servers each person connected to and when, so the offboarding is based on what that person actually touched, not a generic guess.
Revoking access and rotating a password are two different steps, and both matter: one cuts off entry through SHTERA, the other invalidates what that person already knew. Neither depends on coordinating with the rest of the team.
Get started
The vault and the tree
of your servers
Free costs nothing: 1 login, 1 connection, 10 servers.