This is a Controlled Document
Inline with GitLab's regulatory obligations, changes to controlled documents must be approved or merged by a code owner. All contributions are welcome and encouraged.
These guidelines specifies requirements related to the offboarding of GitLab team members from all GitLab related computing resources and data assets so as to protect our customers, team members, contractors, company, and other partners from harm caused by both deliberate and inadvertent misuse. Our intention in publishing these guidelines is to outline information security guidelines intended to protect GitLab assets.
These guidelines applies to all GitLab team-members, contractors, advisors, and contracted parties interacting with GitLab computing resources and accessing company or customer data.
| Role | Responsibility |
|---|---|
| GitLab Team Members | Responsible for following the requirements in this document |
| PeopleOps | Responsible for implementing and executing this document |
| PeopleOps (Code Owners) | Responsible for approving significant changes and exceptions to this document |
The People Experience Associate in the relevant rotation will assign the offboarding team member to a People Experience Associate from within the offboarding tracker. Once assigned, the assigned People Experience Associate creates the offboarding issue, within 12 hours of the offboarding date (may be sooner once the relevant Associate in the rotation is online) as is stipulated in the #offboarding Slack channel submitted by the People Business Partner. Many other teams work to deprovision access including the ITOps team, this should be regarded as urgent and expected to be completed in 5 working days with the exception of Laptop returns, which can take 2 - 4 weeks.
The offboarding process kicks off once the People Business Partner completes the Offboarding Workflow Form, which is also included in the #offboardings Slack channel. This workflow should include information around the offboarding type, the exact date on which it will be effective i.e. immediate or future dated and whether or not the team member in question will be placed on Garden Leave. The team members status should immediately be updated in BambooHR to either Notice Period or Garden Leave where applicable, and thereafter set for termination using the data in the tracker as per this process. Notice Period is defined as the period of work after someone has voluntarily resigned from GitLab. Garden Leave can be found with additional details in the handbook and will be confirmed by the People Business Partner.
People Business Partners are encouraged to provide reasonable notice that an offboarding will be taking place to allow for adequate planning both on the part of the People Experience Team and the Tech Provisioners involved.
In support of the People Experience Teams efforts to remain both compliant and efficient, offboardings which are scheduled will commence at 4PM in their regional timezone (EMEA, JAPAC, and NORAM) and 12pm in their regional timezone on Friday. at which point de-provisioning will commence - in instances where it may be tricky to have cut-off initiated at this time, we encourage team members or People Business Partners to advise the People Experiece team of an updated date and time.
Should the offboarding fall on a day when the People Experience Team is unavailable, The People Experience Associate will create a private Slack channel with the team member's manager and team member and discuss offboarding options.
Offboarding issues are created automatically using the data from the People Exp / Ops Tracker which is provided by the People Business Partner when submitting the form. It is essential that the date and time inserted in the tracker is accurate as this will be the time in which the employment bot will open the offboarding issue
The relevant People Experience Associate will be pinged in Slack once the offboarding issue is created, and automatically assign the People Experience Associate. The ping will include a link to the new offboarding issue.
Note: If the team member is transitioning to a temporarily positioned contractor, please proceed with the full offboarding and create a separate onboarding issue to grant only specific temporary access for what they would need to fulfill their contractual obligations.
In the event that the offboarding issue is not automatically opened or an urgent issue is needed to be opened, the People Experience Associate can open the offboarding issue manually, by following the steps below:
/pops run offboarding BambooHR_ID_number (not Employee ID #). This number is found in the team member's BambooHR profile URL, after id=. It is a 5-digit number. An example of the command would be /pops run offboarding 00000. If BambooHR's API is down, this ChatOps command will fail and will need to be created manually.IT Ops will follow the below steps to set up an auto-response that notifies the sender that the team member they are trying to reach is no longer with GitLab and who to contact.
Customize rejection noticeThe Out of Office message will stay on the account for 90 days, aftewards ITOPs will follow up and archive the account in the G-Suite vault.
IT Ops check if the team member has created any bots before disabling the account. Go to Slack or on your admin Slack profile click Menu » Configure Apps » Custom Integrations » Bots and search through the bots' list for the team member. If a bot exists, please DM the manager to confirm if the bot should be removed.
There is currently a task listed in the offboarding template for the People Experience Associate handling the offboarding to search for and remove any custom emoji for the offboarded team member. Herewith the steps to complete:
x next to the emoji listed to deleteAs per the automation in place, a merge request is automatically created to remove the team member from the team page. This will update the following:
The People Experience Associate will need to complete:
The People Experience Associates in the relevant rotation will complete a weekly audit of all offboarding issues opened within that specific week and check that all tasks have been completed by all Team Member and/or Departments. In the event that tasks are still outstanding, the People Experience Associate will ping the relevant Departments within the offboarding issue to call for tasks to be completed.
Once all tasks have been completed, the People Experience Associate will close the offboarding issue and mark as completed in the offboarding tracker.
All offboarding tasks by all Departments need to be completed within 5 days of the offboarding date. For systems that are more critical and time sensitive, these will be completed within the first 24 hours (example 1Password, Slack) by the relevant Departments. Information about application & system deprovisioners can be found on the Tech Stack Applications handbook page.
To ensure a successful completion of the offboarding issue, it is important that all tasks are checked off, whether the system/tool is applicable to the offboarding team member or not. Checking the box indicates one of the following:
Exceptions to this policy must be approved by PeopleOps.