Building a client offboarding checklist that preserves suppression and audit trails

Client offboarding is where agencies quietly create future compliance debt. Sequences stop. Slack goes quiet. Someone deletes the workspace folder. Six months later a new campaign for a different client emails a person who already said stop, because the suppression list died with the old project.

Offboarding is not only access revocation. For outbound, it is a retention decision: what must survive when the commercial relationship ends.

What must never disappear

For each client workspace, freeze and export before you purge operational data:

1. Suppression list. unsubscribes, complaints, legal do-not-contact, manual blocks
2. Send and compliance audit trail. who sent what, when, with which unsubscribe URL and verdict
3. Opt-out evidence. timestamps, channel, raw request where you store it
4. Mailbox and domain ownership map. which identities sent commercially for that client
5. Contractual retention rules. what you promised to delete vs keep, and for how long

GTM's product stance is blunt on this class of data: suppression should survive purge, and retention should anchor to collection date with provenance on fields. Your offboarding checklist is how the agency honors that even when the client leaves.

CAN-SPAM still expects you to honor opt-outs. Hiring an agency does not erase prior opt-outs for that brand. If you re-contact suppressed people because you "started fresh," you created the incident.

Offboarding phases that keep the order right

Phase 1. freeze outbound

• Pause all campaigns and queues for the workspace.
• Stop LinkedIn and email automations.
• Disable scheduled sends and warm-up jobs.
• Snapshot queue depth and in-flight messages for the exit report.

Do not revoke mailbox access yet if you still need to export headers or suppression writes.

Phase 2. export the durable package

Hand the client (or their next vendor) a package that includes:

• Suppression CSV (or equivalent) with reason codes and timestamps
• Active and historical campaign list with stop reasons
• Audit export for sends in the retention window you agreed
• Connected sending domains and DNS ownership notes
• Open reply threads that still need a human owner on their side

Send it somewhere durable. Email attachments into a dying thread are how packages vanish.

Phase 3. revoke access and tokens

Agency offboarding SOPs usually cover ads, analytics, and social. Outbound adds:

• Revoke OAuth for sending mailboxes and LinkedIn connections used by the workspace
• Rotate or delete API keys and webhooks tied to that client
• Remove agency seats from client CRM views that were opened for writeback
• Confirm no shared agency inbox still auto-files that client's mail into an active queue

Capture timestamps. SaaS offboarding guidance keeps repeating the same audit need: a dated evidence pack of what you revoked.

Phase 4. retain vs delete with a written reason

Delete prospect enrichment you no longer have a basis to keep, per contract and policy. Retain:

• Suppression and opt-out records for the period you need to prove honor-of-opt-out
• Financial and contract records as required
• Security and send audit logs you committed to keep

Write the retain/delete matrix into the offboarding ticket. "We cleaned the Drive folder" is not a matrix.

Suppression handoff patterns that work

• Client takes the list: export suppression to the client CRM or preference center as source of truth going forward.
• Agency retains a sealed copy: keep a restricted archive keyed to the old workspace ID so you can answer "did we email them after opt-out?" without keeping the full prospect database live.
• Never merge suppressions into a global agency soup without client labels. You need to explain whose opt-out it was.

If a prospect opts out of Client A, that does not automatically suppress them for Client B. Isolation still matters. What you must not do is lose Client A's opt-out and then run Client A again later under a new workspace name.

Audit questions buyers ask at exit (and renewal)

• Can you show opt-outs honored after the engagement ended?
• What survives deletion of the workspace?
• Who can access the sealed suppression archive?
• How long do send logs remain queryable?
• Were agency credentials fully revoked, with evidence?

Agencies that answer with a checklist look adult. Agencies that say "we deleted everything to be safe" often deleted the one artifact that protected them.

Minimal checklist you can run this week

Copy into your PM tool per client:

• Outbound freeze confirmed (campaigns, warm-up, LinkedIn)
• Suppression export delivered and acknowledged
• Send/compliance audit export stored
• Domains and mailbox ownership documented
• OAuth, API keys, webhooks revoked (timestamped)
• Retain/delete matrix signed off
• Sealed suppression archive location recorded
• Client confirmation that open reply threads have a new owner

Run the list even for friendly endings. Friendly endings are when people skip steps.

Offboarding is part of outbound compliance, not a courtesy email. Preserve suppression and the audit trail on purpose, then delete what you are actually allowed to forget.

If you want client-isolated outbound where suppression and compliance gates are first-class, join the GTM waitlist.

Sources: AutomateKit agency client offboarding SOP, Inflowave client offboarding checklist for agencies, Reco SaaS offboarding workflows, AppMaster customer offboarding playbook, FTC CAN-SPAM compliance guide, GTM product knowledge.