Think about the last freelancer who rolled off your agency.
The designer you pulled in for a three-week sprint. The editor who cut the launch film. The strategist who covered while someone was out. They came in fast, did great work, and moved on. You paid the final invoice and said thanks.
Now answer honestly: can that person still open the client's drive?
For most agencies I talk to, the real answer is "probably." And that one word — probably — is the single most common thing that trips a shop up when a big client's security team comes knocking.
Why the gap opens in the first place
It's not carelessness. It's how agency work actually runs.
A brief lands, the timeline is already tight, and you need hands on it today. So you bring in a freelancer and give them what they need to start — a seat in the shared drive, an invite to the project folder, a login to the tool where the work lives. That's the right instinct. The work has to move.
The problem is the other end. There's a clear moment when someone joins — the project, the paycheck, the kickoff. There's rarely a clear moment when they leave. The engagement just kind of... ends. The last file gets delivered, everyone scatters to the next fire, and nobody sits down to walk back every place that person could get into. There's no alarm that goes off. Nothing breaks. The access just sits there, quietly, long after the person is gone.
Multiply that by every contractor you've used in the past two years, and you've got a pile of open doors that nobody's keeping track of — including a few you've genuinely forgotten exist.
Why a client's security team goes straight for it
Here's what you have to understand about the person reviewing you: they can't see inside your shop. They can't watch how you work. So they look for the tells — the handful of gaps that, in their experience, almost every vendor has. And the one they've learned to distrust most is exactly this one.
Why? Because leftover access is the perfect villain in their world. It's an account that still works, still has the keys to real files, and belongs to someone your agency no longer manages, no longer pays, and may not even stay in touch with. If that person's personal laptop gets stolen, or their email gets phished a year from now, the door into their brand's files is still standing open — and nobody at your shop would even notice.
So they ask about it directly. When someone leaves, how fast is their access shut off? Can you show me? And they don't want "we're careful about that." They've heard that from every vendor who later turned out to have a dozen ghosts in the system. They want to see that you actually run it.
This is the trap: the honest agencies get caught here just as often as the sloppy ones. Not because they're insecure — because they never built the routine, so when the question comes, all they can offer is a "probably." And "probably" reads, to a security reviewer, exactly like "no."
The routine that closes it — and it's not complicated
The good news: this is one of the most fixable gaps there is. You don't need new tools or a big project. You need a habit, run the same way every time. Three parts.
Give the least on the way in. When a freelancer starts, resist the reflex to hand over the whole drive because it's faster. Give them access to the one project they're on, and nothing else. Not the client's other brands, not last year's campaigns, not the folders they'll never touch. If they later need more, you add it. This one change means that when someone does leave with a door open, that door leads to one room, not the whole building.
Shut it off the same day they roll off. Make the end of an engagement a real moment, not a fade-out. The day a freelancer's work is done, their access comes off — that day, not "when someone gets to it." The trick is to tie it to something you already do: when you close the project, or cut the final check, that's your trigger to pull the access. Attach it to a thing that already happens and it stops depending on anyone remembering.
Keep a list you could actually show. Nothing fancy — a simple running record of who has access to what, and when it was turned off. This is the part that turns a good habit into a passing answer. When the reviewer asks "prove it," you're not swearing you're careful. You're showing them the list: here's everyone who's had access, here's the day each one was shut off. That quiet piece of paper does more to calm a security team than any promise you could make.
That's the whole thing. Provision small, revoke same-day, keep the receipt. Do it every time and the scariest question in the review becomes the one you're most ready for.
Where we come in
Here's the honest part: the routine is simple, but running it every single time, on every freelancer, while you're heads-down delivering the actual work — that's the hard bit. It's the first thing that slips when things get busy, and busy is the natural state of a good agency.
That's the part we take off your desk. At PDRight we run the joiner/leaver discipline for creative and advertising agencies — access granted tight on the way in, shut off same-day on the way out, and a clean inventory kept the whole time — so when your client's security review lands, we get you through it and the freelancer gap is never the thing that costs you the account.
If you're not sure how many doors are open behind your shop right now, that's worth a look before a client asks. No pitch — just a straight read on where you stand.