What Happens to Your Firm’s Data When Someone Quits?

Someone gives notice, and you start thinking about the handoff, the goodbye lunch, and who covers their clients. Almost nobody thinks about the files saved to a personal drive, the shared password three people know, and the Autodesk seat still sitting in their name.

Here is the short version. When someone quits, your data sits in more places than the server. Their email. Their laptop. Their phone. Your Autodesk seat. Your Bluebeam Studio projects. And their memory. The fix has two halves. First, an offboarding checklist you run the same way every time, in the right order. Second, day to day habits that keep data on the firm, not on one person. Order matters more than most people think. Cut their access too early and you can lock your own team out of a Revit model.

Where your data actually lives

Picture everything one person touched over three years. Their email holds client decisions and project history. Their laptop holds local Revit files, downloads, and drawings saved off the shared drive. Their phone may hold company email. They signed into apps you may not remember buying.

Then there is the AEC layer. This is the part general IT advice misses.

Your Autodesk seat is assigned to them, not to your firm. It is a separate login from Microsoft 365. Turning off their email does nothing to it. Same with Bluebeam Studio. Same with Autodesk Docs and Autodesk Construction Cloud projects.

And a lot lives only in their head. How a client likes things. Why a detail was drawn that way. Where the good stuff is filed.

What can go wrong

Files can walk out. A person on their way out still has access. Research on insider risk shows theft clusters in the weeks right around a resignation. Treat that window as real.

Access can linger. If nobody closes the doors, a former employee can still sign in months later. We cover the urgent version in our post on the former employee who still has access.

Work gets stranded. If a file lived on their machine, or only they knew where it was, you did not lose it to a thief. You lost it to a mess.

Knowledge leaves. The quiet one. The data still exists. Nobody understands it.

For example, let’s say your senior designer quits on a Friday. Their Revit elements are still borrowed in the central model. Nobody else can edit them Monday morning. That is not a security problem. That is a deadline problem.

Most offboarding advice says cut access first. For an AEC firm, that is wrong. Cut their Autodesk login before they relinquish their Revit elements, and nobody can edit the model Monday morning.

The offboarding checklist, in the right order

Most offboarding advice says “cut access first.” For an AEC firm, that is wrong. Do these steps in this order.

• Step 0. If you think they took something, stop. — Do not wipe anything, delete the account, or reimage the laptop. Deleting evidence can hurt you badly if this becomes a legal fight. Call your attorney and your IT provider first.
• Step 1. Clear their CAD and PDF locks while they still have a login. — Have them relinquish their Revit worksets and borrowed elements. Since Revit 2019 the username is tied to the Autodesk sign in, so do this before you kill their Autodesk account, not after. Do the same in Bluebeam: check files back in and reassign any Studio Sessions they host. A Studio Project cannot be fully handed off, so plan around that.
• Step 2. Look before you lock. — Check their mailbox for forwarding rules pointing at a personal address. That is the most common quiet leak, and it often gets set up weeks before notice.
• Step 3. Now cut access, and do it properly. — Disabling the account is not enough. In Microsoft 365 you also have to run Revoke Sessions, and tokens already issued can stay good for up to an hour. Remove their MFA methods too (the app or phone that proves it is them), so they cannot reset their way back in.
• Step 4. Handle Autodesk on its own. — Unassign their seat in Autodesk Account so you stop paying for a person who left. Then remove them from your Autodesk Docs and BIM 360 projects. Removing them from the account and removing them from projects are two different jobs.
• Step 5. Move their email and files before the clock runs out. — If you delete a Microsoft 365 user, the mailbox can be restored for 30 days and OneDrive is held for 30 days by default. Converting to a shared mailbox is the usual move, but an unlicensed shared mailbox caps at 50 GB, and converting does not drop the license by itself.
• Step 6. Personal devices. Be careful here. — Remove company apps and data but be sure to leave their personal data alone. Wipe factory resets the whole phone which you shouldn’t have to do. You should also have a signed BYOD policy (the paper that says you may remove company data from a personal device) before you ever push a button.
• Step 7. If they are a licensed PE or RA, handle the seal. — Their seal and digital signing certificate belong to them, not to the firm, and have to come off firm computers. If drawings change after they leave, a licensed person still at the firm has to seal them and take responsibility.
• Step 8. Collect equipment, and write it all down. — Log every step with a date and who did it. If a claim shows up in four years, that log is your friend.

One thing not to do: delete their project records

This is the mistake that costs the most and shows up the latest.

In Tennessee, claims over design or construction problems can be brought for four years after substantial completion, with an extra year in some cases. Guidance for design firms is to keep project records at least that long, and often much longer. Check your own state and your E&O policy, because the number varies.

So when you close out a departing employee, do not treat their mailbox as trash. Their project emails are project records. Move them somewhere safe and keep them.

Cutting access and deleting data are two different decisions. Do the first fast. Do the second slowly, on purpose, and by a written retention policy.

Part two: keep data centered on the firm

The checklist handles the exit. This part makes the exit boring.

• Keep the master copy central — Not “no files on laptops.” Revit does not work that way, since every user runs a local file and syncs to central. What matters is that the real copy lives on the firm’s server or proper cloud, and that people sync often.
• Individual logins, always — When each person has their own login, cutting one person off is clean. With a shared password, one exit means changing it for everybody.
• Write down what lives in one head — Client quirks, why a detail was done that way, where things are filed. A one page project note beats a perfect system nobody keeps up.
• Manage phones with a work container — Company email should sit in a managed work area you can clear on its own.

“This is a lot for a five person firm”

Fair. It is. So here is what we would actually tell a five person office.

Do these now: individual logins, MFA, a written offboarding checklist, and a real backup. They are cheap and they carry most of the weight.

These can wait: full device management, formal documentation systems, fancy tools. Add them when you pass ten or twelve people, or when a client starts asking about your security. Do not let the long version stop you from doing the short version.

Frequently asked questions

We will make sure your data stays yours

A person leaving should never mean your firm loses data, a deadline, or sleep. The fix is a clean checklist run in the right order, plus habits that keep your information on the firm instead of one person.

We help small architecture and engineering firms around Knoxville build both. We know the Autodesk and Bluebeam side, not just the Microsoft side, because that is where Architecture, Engineering, and Construction offboarding usually breaks.

If you are not sure what would happen if a key person quit tomorrow, give us a call. We will close the gaps and get your data organized, so you can focus on the work, not on what you might lose.

Sources: Revoke user access in an emergency (Microsoft); Continuous access evaluation (Microsoft); Device action: Retire (Microsoft); Device action: Wipe (Microsoft); Set OneDrive retention for deleted users (Microsoft); Delete or restore mailboxes (Microsoft); Convert a user mailbox to a shared mailbox (Microsoft); Exchange Online limits (Microsoft); Assign and unassign product access (Autodesk); Remove users from all cloud products and projects (Autodesk); Relinquishing worksets of a specific user (Autodesk); Reassign ownership of Studio Sessions (Bluebeam); Assign full control of a Studio Project (Bluebeam); Tenn. Code Ann. 28-3-202; Document retention guidelines (NSPE); Electronic seals and signatures (NSPE)