Offboarding a tech

Short answer: open the tech's page from Team and click Pause access right away; that signs them out everywhere and ends every AI connection. When you are sure, use Delete user in Danger zone. Your PSA API user does not change, because it belongs to StackTether, not to the tech. Rotate it only if the person was an admin who saw the secret.

Checklist

1. Cut access now. On the member page, under Role and status, click Pause access. They are signed out of the portal and every AI app at once.
2. Check AI connections. Connected AI apps on their page should be empty. If not, click Disconnect.
3. Turn off vendor access. Under Vendor access, click All off, so nothing comes back if they are resumed by mistake.
4. Hand over admin duties. If they were the primary admin, they (or StackTether support) hand the role to another admin first. Every MSP must keep at least one active admin.
5. Delete the account. In Danger zone, click Delete user, type their email and a fresh 2FA code. This cannot be undone.
6. Rotate PSA credentials if needed. If they saw the API user's secret (for example they set it up), create a new secret in the PSA and use Test and replace on Connections.
7. Review the audit log. Filter Audit log by Person to see their recent AI activity.
8. Revoke pending invites they sent that are no longer wanted, under Pending invites on Team.

What is kept

Their entries in the audit log and team log stay for one year, so you can still see what they did.

FAQ

Pause or delete?

Pause is reversible and keeps their settings; delete is final. Pause first, delete once handover is done.

Does the PSA need changes?

Only the usual PSA offboarding for their own PSA login. StackTether uses its own API user, which keeps working for everyone else.