Onboarding and offboarding freelancers.
Adding a freelancer takes an afternoon. Taking the access away again is the step that gets skipped. We build the checklist for both ends and set up the accounts so removal is one pass, not a hunt.
Quick answer
Onboarding a freelancer means a named account, access to only their project, a device that meets a baseline and a written agreement. Offboarding means removing every account, link and share on the same day and recording it. CISA advises setting procedures for changes in user status and granting access by need.
Where access piles up.
- 01
The shared login
One password for the NAS or the review account is quick for day one. When a freelancer leaves you cannot remove them without changing it for everyone.
- 02
Access to everything by default
A new editor gets the whole shared folder because it is simpler. They see every client's work, and so does anyone who gets into their laptop.
- 03
The device nobody checked
A freelancer's own laptop might have no disk encryption, no updates and a password reused across sites. It then holds your client's footage.
- 04
Review links that never expire
Links created for one job stay live long after. Anyone who still has the link can still watch.
- 05
Nobody knows what to remove
The list of places a person has access lives in someone's head. Offboarding then depends on that person remembering.
The two checklists
Add a person. Remove a person.
These are the starting lists we adapt to a studio. Tools differ, so the order matters less than that every line gets done and recorded.
Onboarding
Before the first day
A short routine that makes day one the same for every freelancer.
- Named account on the shared storage, never a shared login
- Access to this project only
- Multi-factor sign in turned on for every account
- Device baseline: updates current, disk encryption on, password manager in use
- Review tool access with an expiry date
- Written confirmation of the studio's and the client's rules
- A start date and an end date in the record
Offboarding
On the last day
Same-day removal, with a written record of what was done.
- Disable the storage and VPN accounts
- Remove from review tools and revoke the links they created
- Change any shared password they knew
- Collect or confirm deletion of project files on their device
- Remove from shared calendars, chat and cloud folders
- Record the date and who did it
- Check the account list after a week
What we set up
So removal is one pass.
Named accounts and groups
One account per person and a group per project, so access is added and removed in one place.
A device baseline
A short page for freelancers: what must be on their machine, how to check it and what happens if it is not.
An account register
A single list of every system a person has access to, kept current, so offboarding is a checklist and not a memory test.
The routine itself
The two checklists adapted to your tools, with a named owner and a reminder to review access after each job.
Before you hire anyone
What to ask any IT provider.
Ask us the same questions. A good answer is specific and can be checked.
Can you give me a list of every account a person has?
A register or an export, not a guess.
How fast can access be removed?
The same day. The method is a checklist, not "as soon as someone remembers".
What happens to files on a freelancer's own laptop?
A written agreement about not keeping copies, plus a way to confirm it where practical.
Do review links expire?
Yes, where the tool supports expiry, with a clean-up routine.
How do you handle a device that fails the baseline?
There is a defined next step, such as limiting access to a remote session until it is fixed.
Questions people ask
Do we need an NDA or an agreement?
Often yes, and clients may require one. We are not lawyers, so have yours reviewed by one. What we add is the technical side: named accounts, limited access and a removal checklist that matches what you promised.
Can we make freelancers use a studio laptop?
Some studios do. It gives you control, and it costs money and shipping. A baseline for personal devices plus remote access that keeps the media at the studio is a common compromise.
What about client-owned tools such as a review account?
Treat them like yours. Know who has access, remove people when they finish and record it. The client's own rules take priority.
How do we remove someone who already has access to old projects?
Start with the account register. We help you list every place they can reach, remove them and check what they may still hold locally.
How does this help with TPN readiness?
Assessors tend to ask how access is granted and removed. A written routine and an account register answer that. Assessment itself is done by an independent assessor.
Plug us in. Tell us what your studio runs on.
Tell us what you see on screen. A person on our production consulting team reads it and replies, usually with the first thing to check.
Keep reading
The short list of security steps a small creative studio can finish, mapped to CISA and NIST guidance.
How editors reach studio storage and machines securely, and where a VPN helps and where it does not.
Shared storage, access and backups for groups of freelance editors working as one team.
Plain-English guides to the Trusted Partner Network and getting ready for an assessment.
Do freelancers and remote editors need TPN? What the MPA Best Practices say about contractors and work from home, and what vendors usually need from you.
Before you send unreleased footage to a vendor, ask these content security questions, with notes on what a good answer sounds like and how TPN status fits.
Describe your studio and we will take it from there.
A real person on our team reads every request and replies within one business day.