What Happens to Your Firm’s Data When Someone Quits?

Someone gives notice, and you start thinking about the handoff, the goodbye lunch, and who covers their clients. Fewer people think about the files saved to a personal drive, the shared password three people know, and the Autodesk seat still sitting in their name.

Here is the short version. When someone quits, your data sits in more places than the server. Their email. Their laptop. Their phone. Your Autodesk seat. Your Bluebeam Studio projects. And their memory. The fix has two halves. First, an offboarding checklist you run the same way every time, in the right order. Second, day to day habits that keep data on the firm, not on one person. Order matters too. On a planned exit, clear their file locks before you cut their login, so your team is not stuck on Monday.

Where your data actually lives

Picture everything one person touched over three years. Their email holds client decisions and project history. Their laptop holds local Revit files, downloads, and drawings saved off the shared drive. Their phone may hold company email. They signed into apps you may not remember buying.

Then there is the design firm layer. This is the part general IT advice misses.

Your Autodesk seat is assigned to them, not to your firm. It is a separate login from Microsoft 365. Turning off their email does nothing to it. Same with Bluebeam Studio. Same with Autodesk Docs and Autodesk Construction Cloud projects.

And a lot lives only in their head. How a client likes things. Why a detail was drawn that way. Where the good stuff is filed.

What can go wrong

Files can walk out. A person on their way out still has access. Researchers at Carnegie Mellon’s CERT insider threat team found that many people who took work did so within 30 days of leaving. Treat that window as real.

Access can linger. If nobody closes the doors, a former employee can still sign in months later. We cover the urgent version in our post on the former employee who still has access.

Work gets stranded. If a file lived on their machine, or only they knew where it was, you did not lose it to a thief. You lost it to a mess.

Knowledge leaves. The quiet one. The data still exists. Nobody understands it.

For example, let’s say your senior designer quits on a Friday. Their Revit elements are still borrowed in the central model. Nobody else can edit them Monday morning until someone works around it. That is not a security problem. That is a deadline problem.

Cut access fast. But on a planned exit, let them clear their file locks first, so Monday morning is not a scramble.

The offboarding checklist, in the right order

For a planned exit, do these steps in this order. If you are letting someone go, or the exit is tense, flip it. Cut access first, during the conversation. Then release their locks afterward. Revit has a force relinquish option for cloud models, and there is a workaround for models on your own server. It is more work, but nothing is stranded for good.

• Step 0. If you think they took something, stop. Do not wipe anything, delete the account, or reimage the laptop. Deleting evidence can hurt you badly if this becomes a legal fight. Call your attorney and your IT provider first.
• Step 1. Clear their CAD and PDF locks while they still have a login. Have them sync and relinquish their Revit worksets and borrowed elements. Revit uses their Autodesk sign in as their worksharing name, so this is easiest while that account still works. If it is too late, your BIM lead or IT provider can still force relinquish them. It just takes more work. Do the same in Bluebeam: check files back in and reassign any Studio Sessions they host. A Studio Project cannot be fully handed off, so plan around that.
• Step 2. Look before you lock. Check their mailbox for forwarding rules pointing at a personal address. It is a quiet leak that is easy to miss.
• Step 3. Now cut access, and do it properly. In Microsoft 365, reset their password, sign them out of all sessions, then block sign in. Microsoft says a block alone can take up to 24 hours to kick in, and someone already signed in can stay in for up to an hour. Remove their MFA methods too (the app or phone that proves it is them), so they cannot reset their way back in.
• Step 4. Handle Autodesk on its own. Unassign their seat in Autodesk Account so you stop paying for a person who left. Then remove them from your Autodesk Docs and BIM 360 projects. Removing them from the account and removing them from projects are two different jobs.
• Step 5. Move their email and files before the clock runs out. If you delete a Microsoft 365 user, the mailbox can be restored for 30 days and OneDrive is held for 30 days by default. Converting to a shared mailbox is the usual move, but an unlicensed shared mailbox caps at 50 GB, and converting does not drop the license by itself. Remove the license only after you convert, because removing it first starts Microsoft’s 30 day clock on their mail. And keep the user account, since Microsoft says it anchors the shared mailbox.
• Step 6. Personal devices. Be careful here. In Microsoft’s device tools, Retire removes company apps and data and leaves their personal data alone. Wipe factory resets the whole phone, which you should never do to a personal device. You should also have a signed BYOD policy (the paper that says you may remove company data from a personal device) before you ever push a button.
• Step 7. If they are a licensed PE or RA, handle the seal. Their seal and digital signing certificate belong to them, not to the firm, and have to come off firm computers. If drawings change after they leave, a licensed person still at the firm has to seal them and take responsibility. Rules vary by state, so check with your state licensing board.
• Step 8. Collect equipment, and write it all down. Log every step with a date and who did it. If a claim shows up in four years, that log is your friend.

One thing not to do: delete their project records

This mistake can show up years after the person is gone.

In Tennessee, claims over design or construction problems can be brought for four years after substantial completion, with up to one extra year in some cases. Guidance from ACEC and NSPE is to keep most project records for that period plus three more years. Check your own state and your E&O policy, because the number varies.

So when you close out a departing employee, do not treat their mailbox as trash. Their project emails are project records. Move them somewhere safe and keep them.

Cutting access and deleting data are two different decisions. Do the first fast. Do the second slowly, on purpose, and by a written retention policy.

Part two: keep data centered on the firm

The checklist handles the exit. This part makes the exit boring.

• Keep the master copy central. Not “no files on laptops.” Revit does not work that way, since every user runs a local file and syncs to central. What matters is that the real copy lives on the firm’s server or proper cloud, and that people sync often.
• Individual logins, always. When each person has their own login, cutting one person off is clean. With a shared password, one exit means changing it for everybody. More in our post on what small firms get wrong about passwords.
• Write down what lives in one head. Client quirks, why a detail was done that way, where things are filed. A one page project note beats a perfect system nobody keeps up.
• Manage phones with a work container. Company email should sit in a managed work area you can clear on its own.

“This is a lot for a five person firm”

Fair. It is. So here is what we would actually tell a five person office.

Do these now: individual logins, MFA, a written offboarding checklist, and a real backup. They are cheap and they carry most of the weight.

These can wait: full device management, formal documentation systems, fancy tools. One exception: put company email on phones in a basic work container early, since that is what lets you remove company data later. Revisit the rest as you grow past ten or twelve people, or when a client starts asking about your security. Do not let the long version stop you from doing the short version.

Frequently asked questions

We will make sure your data stays yours

A person leaving should never mean your firm loses data, a deadline, or sleep. The fix is a clean checklist run in the right order, plus habits that keep your information on the firm instead of one person.

Our managed IT services help small architecture and engineering firms build both. Based in East Tennessee. Serving firms nationwide. We also keep the computers, files, licenses, and security behind Autodesk and Bluebeam in order, not just Microsoft. That is where offboarding at design and construction firms often breaks.

If you are not sure what would happen if a key person quit tomorrow, give us a call for a free IT checkup. We will close the gaps and get your data organized, so you can focus on the work, not on what you might lose.

Sources: Revoke user access in an emergency (Microsoft); Continuous access evaluation (Microsoft); Device action: Retire (Microsoft); Device action: Wipe (Microsoft); Set OneDrive retention for deleted users (Microsoft); Delete or restore mailboxes (Microsoft); Convert a user mailbox to a shared mailbox (Microsoft); Exchange Online limits (Microsoft); Assign and unassign product access (Autodesk); Remove users from all cloud products and projects (Autodesk); Relinquishing worksets of a specific user (Autodesk); Reassign ownership of Studio Sessions (Bluebeam); Assign full control of a Studio Project (Bluebeam); Tenn. Code Ann. 28-3-202; Document retention guidelines (ACEC and NSPE); Tenn. Code Ann. 28-3-203; Increased Monitoring for IP Theft by Departing Insiders (CERT, Carnegie Mellon); Prevent user sign in and block access (Microsoft); Troubleshooting: Username change (Autodesk); Electronic seals and signatures (NSPE)