The short answer: turning off a leaver's email doesn't take back the key to your encrypted files. If the team shares a vault password, they still know it. If their laptop holds the key, it still opens the folder. With ZapLock Team, removing the person deletes their share of every team folder's key on our side, so their next attempt to open any of them is refused, even if their laptop is offline when you press Remove.
Offboarding checklists stop at the login
Most offboarding lists cover email, SSO, laptops and badges. Encrypted folders sit in a blind spot, because the key isn't the login.
With a shared vault password
- The leaver still knows the password.
- You change it, then tell everyone else the new one.
- Anyone who misses the message is locked out on Monday.
- Folders the leaver created may have passwords only they knew.
With ZapLock Team
- Each person's access is separate, tied to their own sign-in and devices.
- You remove one person, once, from the admin console.
- Everyone else's access is untouched. Nobody's told anything new.
- Folders the leaver made already belong to the team.
Remove Sam. Everyone else carries on.
Here's exactly what happens when an admin removes someone from a team.
Illustration. One removal covers every team folder Sam could open.
- 1Their key share is deletedTheir share of every team folder's key is deleted on our side. The next unlock is refused, with a message naming the team. It doesn't depend on reaching their laptop.
- 2Open folders lockA device that's online is told to lock any team folder it has open. An offline device locks once its offline timeout runs out.
- 3Exposed keys are flaggedFolders whose key their devices actually held are flagged for a new key, and the removal report lists them.
- 4Nothing changes for anyone elseNo re-sharing, no new password. Folders they created pass to the admin who removed them, and their seat frees up.
What no encryption tool can take back
ZapLock stops a leaver opening your folders from now on. It can't reach into the past, and nothing else can either.
Copies already made
A file someone saved elsewhere, printed or emailed stays copied. That's a policy question, not a key question.
Sync history
Dropbox, Google Drive, iCloud Drive and OneDrive keep version history. If plain copies were ever there, clear them through your provider.
The device itself
ZapLock doesn't wipe laptops. Get company devices back, and use your device management tool for anything beyond the folders.
An offboarding checklist for encrypted files
Copy it into your own offboarding list. The ZapLock steps are in bold; the rest applies whatever you use.
Get ready
- Check which team folders they can open in the admin console.
- Make sure the team has at least two admins, so no folder hangs on one person.
- Hand over work in progress while they can still open it.
- List the company devices to collect.
Cut access
- Remove them from the team in ZapLock. One removal covers every team folder.
- Disable their email, SSO and other app accounts.
- Collect laptops, phones and drives.
- Change any shared passwords they knew elsewhere.
Close it out
- Read the removal report and note the folders it flags for a new key.
- Clear old plain copies from your cloud's version history, if any.
- Check the folders they created now sit with the right admin.
- File the report with your offboarding record.
Offboarding and encrypted folders: FAQ
What happens to encrypted folders when an employee leaves?
Unless you act on the encryption itself, nothing. Disabling someone's email or laptop login doesn't take back a vault password they know or a key their device holds. With ZapLock Team, removing the person deletes their share of every team folder's key on our side, so their next attempt to open any team folder is refused.
Does removing someone work if their laptop is offline?
Yes. ZapLock doesn't need to reach their laptop to cut them off: their share of each key is deleted on our side, so the next unlock is refused whenever it comes. A device that is online is also told to lock any team folder it has open, and an offline device locks once its offline timeout runs out.
Does the rest of the team need to re-share folders or learn a new password?
No. There's no shared password in ZapLock, and each person's access is separate, so removing one person leaves everyone else's access as it was. Nobody re-shares anything and nobody has to be told anything new.
Can ZapLock wipe files from a former employee's device?
No. ZapLock stops a former employee opening your encrypted folders; it doesn't delete files from their devices. Anything they already copied out of a folder, printed or emailed stays copied, and no encryption tool can recall that. Folders their devices held a key for are flagged for a new key in the removal report.
Who owns a team folder after the person who made it leaves?
The team does. Team folders belong to the team rather than to whoever made them, and any admin can manage them. When the creator is removed, the folders they made pass to the admin who removed them, and ZapLock won't delete the account of a team's last admin.
How much does ZapLock Team cost?
ZapLock Team is $9 per seat a month, or $90 per seat a year, with a 3-seat minimum, bought on the web. Everyone on the team takes a seat, including the buyer, and removing a person frees their seat straight away. See pricing.
Make the next goodbye a one-click job.
ZapLock Team: $9 per seat a month, on Mac, Windows, iPhone, iPad and Android.