Remove someone

Under the organisation's Members. Needs organisation-admin access.

Steps

1. Open Members and find the person.
2. Remove them from the organisation.
3. Confirm.

Their access to this organisation ends.

Do not use site scope for this

Narrowing someone's sites is not a way to remove access, and the last step does the opposite of what you would expect: removing their final site restriction makes them unrestricted, with access to every site.

To end access, remove the membership. See site scope.

What survives

Their account. It belongs to them, not to you. They keep it, along with any memberships in other organisations.

Their history. Everything they did stays in the audit log, and orders, receipts and adjustments they touched are unchanged. Removing a member is not a way to remove their actions.

Anything they created. Records belong to the organisation, not to the person who entered them.

Check what is attached to them first

API keys they created. These authorise access on behalf of the organisation, not the person, so removing the member does not necessarily stop a key working. If they created any, revoke them deliberately — see create an API key.

Notifications. Alerts they were the only recipient of will now reach nobody, because notification preferences are per person. Worth checking someone else is subscribed to anything that matters.

Owners

An organisation needs at least one owner. Appoint a replacement before removing the last one.

A leaver checklist

1. Remove the membership.
2. Revoke any API keys they created.
3. Check nobody was the sole recipient of an important notification.
4. If they held integration credentials that were personal to them, re-authorise those connections.

Only the first is enforced. The rest are quiet gaps that will not surface until something does not happen.