中文
devexamples
← Workflows

阅读中文版本

Vendor Offboarding Workflow

Inventory data and integrations with a vendor, migrate or export what is needed, revoke access, delete data per contract, and confirm the dependency is gone.

intermediate~120 minvendorsoperationscompliance

Objective

Remove a third-party vendor cleanly without leaving data, access, or hidden dependencies behind.

Environment

  • A vendor and integration inventory
  • Contract terms on data deletion

Steps

1. Inventory data shared with the vendor

Inventory data shared with the vendor and every integration point.

Expected state: The full dependency surface is known.

2. Migrate or export data the business

Migrate or export data the business needs before access ends.

Expected state: Required data is preserved.

3. Revoke credentials, webhooks, and network access

Revoke credentials, webhooks, and network access.

Expected state: The vendor can no longer reach systems.

4. Confirm data deletion per contract

Confirm data deletion per contract and the dependency is fully removed.

Expected state: Offboarding is verified.

Decision points

Migrate or export before revoking?

  • Export first
  • Revoke first

Export and verify first; revoking before export can lose data you need.

Trust the vendor deletion or verify?

  • Request confirmation
  • Assume deleted

Request written confirmation with scope; assume nothing, especially for personal data.

Expected outcome

No data, credentials, or integration remains with the vendor, and required data was migrated or exported first.

Verification

Confirm access attempts from the vendor fail and that no configuration still references the vendor.

Cleanup

Record the offboarding, deletion confirmation, and any retained data with justification.

Overview

Remove a third-party vendor cleanly without leaving data, access, or hidden dependencies behind. Confirm access attempts from the vendor fail and that no configuration still references the vendor.

Steps

  1. Inventory data shared with the vendor and every integration point. Expected state: The full dependency surface is known.
  2. Migrate or export data the business needs before access ends. Expected state: Required data is preserved.
  3. Revoke credentials, webhooks, and network access. Expected state: The vendor can no longer reach systems.
  4. Confirm data deletion per contract and the dependency is fully removed. Expected state: Offboarding is verified.
# find lingering references to the vendor
rg -i "vendor-old-name" --glob '!node_modules' -l
# remove webhooks, keys, and DNS entries found

Verification

  • No data, credentials, or integration remains with the vendor, and required data was migrated or exported first.

Decision points

  • Migrate or export before revoking? Options: Export first; Revoke first. Recommended: Export and verify first; revoking before export can lose data you need.
  • Trust the vendor deletion or verify? Options: Request confirmation; Assume deleted. Recommended: Request written confirmation with scope; assume nothing, especially for personal data.