Every Canadian employer has an offboarding checklist with a line on it that reads something like "revoke system access." Almost nobody has written down the other half of that sentence. A person who left your company in April will need a document from you in February, because that is when their T4 for the year they worked has to reach them. If your only offboarding instinct is to shut everything off at 5pm on the last day, you have not finished the job, you have moved it into someone’s inbox for the next ten months.
This is a practical guide to the two halves: what genuinely has to be cut the moment employment ends, and what a former employee legitimately still needs to reach afterwards. It is written for small and mid-sized Canadian employers who do not have an IT security team to design this for them.
Two clocks that run in opposite directions
The security clock runs to zero. From the moment employment ends, a former employee has no business holding the keys to other people’s data: colleagues’ compensation, Social Insurance Numbers, banking details for direct deposit, performance notes, the full employee export. Every hour that access stays live is an hour of exposure you cannot justify to anyone, and the risk is highest in exactly the departures that are least friendly.
The records clock runs for months. A departing employee has an ongoing, entirely reasonable need for their own file: the record of what they were paid, what vacation was paid out, what their last day was, the documents they signed, and the tax slip that does not exist yet on the day they leave. Denying them that at 00:01 on the day after termination is not security, it is holding someone’s own records hostage, and it generates support work for you rather than protection.
A defensible offboarding policy treats these as two separate decisions with two separate timelines, instead of one on-off switch. Most tools give you the switch and let you discover the consequences yourself.
What has to be cut on the last day
These are the doors that should close at the termination timestamp, not "in the next few days when IT gets to the ticket":
- Any administrative view of other employees: the employee list, compensation, Social Insurance Numbers, banking details, HR notes, and any bulk export of the workforce.
- Live sessions, not just passwords. Changing or disabling a password does nothing about a browser that is already signed in, and many systems keep a session valid for days or weeks after the credential behind it is gone.
- Password reset and account recovery. A reset link is a fully functional replacement key, and a system that revokes the login but still emails a reset link has not revoked anything.
- Machine credentials the person owned: API keys, integration tokens, service accounts and scheduled jobs running under their name. These outlive human access in almost every breach story worth reading.
- External systems your HR platform does not control: email and calendar, SSO, Slack or Teams, VPN, the building badge, shared drives, password managers, and any vendor portal where they were the named admin.
- Approval authority. If they were a manager, their pending approvals need reassigning, or requests quietly sit in a queue nobody owns.
One warning about checklists here, because it is the failure mode we see most: a ticked box is not a revocation. If your checklist says "revoke system access" and the system in question has no idea the person was terminated, the box goes green and the login still works. Make each item name the specific system a human actually has to touch, and make sure anything you have automated is genuinely automated rather than merely asserted.
What a former employee still needs after the last day
The Record of Employment, within days
The ROE is a federal Service Canada obligation and it is fast. If you issue electronically, you have five calendar days after the end of the pay period in which the interruption of earnings occurred. On paper, it is five calendar days from the interruption of earnings or from the day you become aware of it. The ROE is the document behind the person’s Employment Insurance claim, so a late one delays money reaching someone who has just lost their income.
Final pay and the vacation payout
Accrued vacation has to be paid out, statutory notice or pay in lieu has to be right, and the person will want to check your arithmetic. Expect questions weeks after the fact, and expect them to be reasonable questions. Their vacation balance history and their termination date are what settle the argument, so the value of those records does not end when the employment does.
The T4, which can be fourteen months away
This is the deadline that breaks naive offboarding. A T4 covers a calendar year, and the information return has to be filed with the CRA and the slips given to the employee by the last day of February of the following year (the next business day if that falls on a weekend). Someone who leaves in January of year Y is still owed a T4 for year Y, delivered in late February of year Y plus one. That is up to fourteen months after their last day, and it is not optional.
There is a second trap inside that one, and it catches employers who think a self-service portal solves the problem. The CRA lets you distribute T4 slips through a secure electronic portal without asking for consent first, but there are explicit exceptions: where the recipient has asked for paper, where they cannot reasonably be expected to have electronic access at the time the slips are issued, and where the recipient is a former employee, or an employee on extended leave, at the time the slips are issued. A former employee is named in the rule. So you cannot simply drop the slip into a portal they no longer use and call it delivered; you need their consent to receive it electronically, or you mail it. Sending slips by email is different again and always requires prior consent.
Proof of employment
Landlords, lenders, immigration applications and the next employer all ask for confirmation of dates and title, sometimes years later. This is a small ask that becomes a slow, manual ask once the person and their record have both left the building.
The address problem nobody plans for
Almost every T4 delivery failure traces back to the same root cause: on the last day, the only contact details you hold are the ones you are about to switch off. Their work email dies with the account, and their mailing address is whatever they typed in when they were hired, which may be two moves out of date. Fix this while you still have the person’s attention, on or before the last day:
- Capture a personal email address and confirm the current mailing address in writing, and record when it was confirmed.
- Ask, explicitly and in writing, whether they consent to receiving their T4 electronically, and record the answer. That single question is what makes portal delivery valid for a former employee.
- Tell them, in plain language, how long they will be able to reach their own records and by what route, and give them the date rather than a vague "for a while."
- Encourage them to download the documents they care about before they leave, and make that possible in one place rather than by request.
- Note who they should contact after their access ends, because that is the moment a former employee becomes a support ticket instead of a self-serve user.
What you have to keep, and for how long
Cutting access is not the same as deleting data, and the two are often confused in the same conversation. Your retention obligations survive the employment relationship, and several of the clocks are triggered by the termination date rather than by when the record was created. The short version: the CRA expects payroll and tax records to be kept six years from the end of the last tax year they relate to, while employment standards set their own, shorter and province-specific periods.
The counterweight, and the part most Canadian employers have not adjusted to, is that keeping everything forever is itself a risk. Quebec’s private-sector privacy law requires that when the purposes for which personal information was collected or used have been achieved, the information be destroyed or anonymized, subject to any retention period set by law. "We keep it all, just in case" is no longer a safe default, and a terminated employee’s file is exactly the kind of record that rule is aimed at.
A defensible offboarding access policy
If you write down nothing else, write down these seven lines and follow them the same way every time:
- Cut every administrative view of other people’s data at the termination timestamp, automatically, not by ticket.
- Kill live sessions and account recovery at the same instant, not just the password.
- Suspend every machine credential the person owned, and reassign their pending approvals.
- Keep the person able to reach their OWN records for a defined window that runs at least through T4 season the following February.
- Tell them the end date of that window, in the product and in writing, before they need it.
- Capture a personal email, a confirmed mailing address, and an explicit answer on electronic T4 consent before the last day.
- Log the whole thing: who was revoked, when, by what, and when the window closes. An offboarding you cannot evidence is an offboarding you cannot defend.
Where Workleaf fits (and where it does not)
Workleaf now enforces both halves of this at termination rather than leaving it to a checklist. The moment an employee is marked terminated, the administrative surface closes: their login no longer opens the admin app, an existing session cookie is killed on their very next request rather than lingering until it expires, no password reset link will be issued to them, and the sensitive actions behind that surface (revealing a Social Insurance Number, revealing banking details, reading HR notes, exporting the employee list) are gone. Any API keys that person owned are suspended in the same transaction. The revocation is filed to the organization’s audit log, so you can show when it happened instead of asserting that it did.
The other half is the records window. A terminated person keeps read-only access to their own records, and only their own, until the later of ninety days after their termination date and the last day of February of the following year. Read-only is literal rather than a figure of speech: they can open and download their own file, and every write door on that surface refuses, including filing a time-off request, requesting a proof of employment, acknowledging a document and requesting a profile change. The February anchor exists for exactly the reason above: a T4 for the year they worked is not issued until then, so anyone terminated in a given year must still be able to reach their documents through the following T4 season. The ninety-day floor is what binds for a late-December departure, where February alone would be the shorter of the two. While the window is open the product shows the person a banner telling them their access is time-boxed and on what date it ends. After that date the account closes, and someone who types a correct password gets an honest "this account is closed" message rather than a lie about invalid credentials.
To be precise about the line, including where it is unflattering: Workleaf does not manage your email, SSO, Slack, VPN or badge access, so the external half of the revocation list is still a human job and the default offboarding checklist says so plainly. Workleaf does not run payroll, does not issue or file T4 slips, and does not produce or file the ROE with Service Canada. It does not automate retention: it will not run a retention schedule and will not purge or anonymize a file when its period expires, so what to destroy and when remains your judgment call. The records window is a fixed statutory floor today, not yet an organization setting, and when it becomes configurable it will only ever be extendable. Native payroll and an applicant tracking system are on the roadmap, not in the product today.
Nothing here is legal advice, and the deadlines above change. Confirm current CRA and Service Canada requirements directly, confirm your provincial employment-standards retention period against your own jurisdiction, and take advice before setting a policy.
Sources
- T4 deadline and distribution: Canada Revenue Agency, T4 information for employers (file the return and give slips to employees by the last day of February following the calendar year, or the next business day).
- Electronic distribution of slips and its exceptions: Canada Revenue Agency guidance on distributing T4, T4A and T5 slips, which excepts a recipient who requested paper, who cannot reasonably be expected to have electronic access, or who is a former employee or on extended leave when the slips are issued; email distribution requires prior consent.
- ROE deadlines: Employment and Social Development Canada / Service Canada, How to complete the Record of Employment (five calendar days after the end of the pay period for electronic ROEs; five calendar days from the interruption of earnings, or from learning of it, on paper).
- Six-year record retention: Canada Revenue Agency, Keeping records (RC188), six years from the end of the last tax year to which the records relate.
- Destruction or anonymization: Act respecting the protection of personal information in the private sector (Quebec), section 23.
Pricing is simple and public. Basic is $15 CAD per month for up to 10 employees, then $1.50 CAD per additional employee. Advanced is $30 CAD per month for up to 10 employees, then $3 CAD per additional employee, and adds the full talent suite (reviews, 1:1s, surveys and analytics). No quotes, no surprises.