When a charity leaves FFC, offboarding cleanly closes out the services we provisioned during onboarding — the reverse of the service-delivery lifecycle. The guiding rule: the charity keeps everything that is theirs (content, domain, brand, data), and FFC reclaims only what it sponsored.

Principles

The charity owns its content, domain, and brand — offboarding returns control, it does not seize it.
Always offer a data export before deprovisioning.
Backups are retained for 90 days after offboarding, then purged.
Board-level written confirmation is required before any destructive step.

The offboarding flow

Step 1 — Confirm the offboarding request in writing

Get written confirmation from an authorized board member that the charity is leaving FFC, and the effective date. Record who requested it and why.

Admin check: Do not act on a verbal or single-volunteer request — offboarding is destructive. Require board-level confirmation.

Step 2 — Take a final backup and archive it

Run a full backup of the site and data per the cPanel backup SOP, label it with the charity and date, and move it to the offboarding archive.

Admin check: Verify the backup restores before deleting anything. Archived backups are retained for 90 days, then purged.

Step 3 — Return or release the domain

If the charity wants to keep the domain, initiate a transfer-out to their chosen registrar (unlock + EPP code). If not, let it expire or release it after the retention window.

Admin check: A departing charity owns its name and brand — never hold a domain hostage. Disable WHOIS privacy before issuing the EPP code so the transfer does not fail.

Step 4 — Deprovision Microsoft 365 / Google Workspace

Export any mailboxes/data the charity requests, then remove user accounts and licenses. Reclaim FFC-sponsored licenses.

Admin check: Offer a data export first; only deprovision after the charity confirms they have what they need or the retention window closes.

Step 5 — Close Cloudflare zone and WHMCS account

Remove the Cloudflare zone (after DNS has moved), and close the WHMCS/billing record. Revoke any remaining shared-tool access (e.g. password-manager shares).

Admin check: Confirm DNS has fully moved to the charity’s new provider before removing the Cloudflare zone, or the site/email will go dark.

Step 6 — Purge after the retention window

After 90 days, purge the archived backups and any residual data, and mark the offboarding complete in the records.

Admin check: Document the purge date. If litigation hold or a records request applies, pause the purge and escalate.

Cross-references

wordpress-domains — the registration flow this reverses (transfer-out, EPP codes, WHOIS privacy).
wordpress-cpanel-backup-sop — the final backup before archival.
wordpress-service-delivery-stages — offboarding closes this lifecycle.

Support contact

Clarke Moyer (FFC founder): clarkemoyer@freeforcharity.org, 520-222-8104.