Key Takeaways:
- In a typical EOR arrangement, the EOR handles employment administration, while the client company is responsible for provisioning, securing, and revoking employee IT access.
- EOR employees should follow the same security policies as other employees, including multi-factor authentication, role-based permissions, and regular access reviews.
- Secure IT offboarding requires coordination between HR, IT, and the EOR to ensure access is revoked on time, credentials are disabled, and important business data is preserved.
When you hire through an Employer of Record (EOR), the EOR becomes the employee's legal employer in their country. However, being the legal employer doesn't mean the EOR decides who can log in to the client company's email, code repositories, or customer database — that control usually stays with the company.
But the gap between these roles is where security problems tend to appear. If HR, IT, and the EOR don’t share updates promptly, a new hire might begin working without all the tools they need. An employee who changes teams might keep permissions they no longer use. And someone who has left the company might still be able to sign in weeks later.
That last risk is more common than many teams assume. In fact, a 2023 survey of 1,000 U.S. workers found that nearly half of former employees still used company passwords after leaving.
Keeping access secure requires coordination between the EOR, HR, and IT teams, from the employee's first day through their final sign-off.
Who Is Responsible for IT Access and Security for EOR Employees?
In a typical EOR arrangement, the provider handles local employment administration, such as contracts, payroll, statutory benefits, and compliance with local labor laws. The client company, on the other hand, manages the employee's day-to-day work, which usually includes deciding what systems they can access and how those systems are secured.
In practice, the division often looks like this:
- The EOR manages the employment relationship and communicates key dates, including confirmed start dates, contract changes, resignations, final working days, and offboarding procedures.
- The client company creates employee accounts, assigns permissions, sets authentication requirements, enforces security policies, and removes access when employment ends. It also typically decides how its business data is handled.
Because these responsibilities are split between different organizations, timing matters. If the EOR confirms a resignation before the IT team revokes security privileges, the employee's access may stay active longer than intended. That’s why it’s important to outline who sends status updates, who receives them, and how quickly IT should act on each type of change.
Keep in mind that responsibilities vary by EOR provider and service agreement, so review the contract and document who’s accountable for what to ensure nothing falls through the cracks.
How Should Companies Provision IT Access for New EOR Employees?
Build IT access provisioning into EOR employee onboarding and start well before the employee's first day, especially when HR, IT, the hiring manager, and the EOR are spread across time zones. If an employee needs equipment, such as a company laptop, coordinate delivery so the device arrives in time.
Check out our guide to safely shipping laptops and IT equipment internationally for more information.
Verify Employee Information and Confirm the Start Date
Before IT creates any accounts for a new employee, HR should confirm the employee's legal name, job title, department, manager, work location, and start date. Keep in mind that start dates for EOR hires can change because of delays in contract signing, background checks, or work permit processing, so IT should build accounts from a confirmed date rather than an estimated one.
The EOR verifies identity and right-to-work details for employment purposes. However, the IT team still needs its own identity verification procedure for issuing credentials, such as confirming a personal email or phone number through a trusted channel before sending activation links.
Set Up Single Sign-On and Multi-Factor Authentication
Single sign-on (SSO) lets employees use one central identity, managed through an identity provider, to access many applications. This is useful for IT teams because SSO means fewer separate passwords to track and one place to grant, adjust, or remove access. For international teams, SSO also makes it easier to control access across locations without managing credentials separately for every application.
Pair SSO with multi-factor authentication (MFA), a security process that requires users to provide two or more different verification factors to prove their identity in order to access an account, network, or device. Using MFA makes accounts 99% less likely to be hacked.
Apply the same authentication requirements to EOR employees as to employees in your headquarters country. If certain methods are hard to use in some locations, such as SMS codes in regions with unreliable mobile coverage, choose an alternative that's at least as strong rather than relaxing the requirement.
Assign Role-Based Application Permissions
The principle of least privilege means giving users only the access needed to do their jobs.
Role-based access control (RBAC) makes this principle easier to apply at scale because instead of granting permissions one by one, IT defines standard access bundles for each role. For example, a salesperson in Australia might receive Microsoft 365 or Google Workspace, Slack, and Salesforce, while an engineer in Poland gets code repositories and development tools.
Require manager approval for anything outside the standard bundle, especially access to sensitive data or administrator rights. Also, record what was granted, who approved it, and when.
Confirm Access Before the Employee's First Day
Aim to have everything ready a few days before an employee’s start date. Test that accounts are active and assigned to the right groups, and send activation instructions through the verified channel.
On or before the employee’s first day, confirm they’ve enrolled in MFA, can sign in to each application their role requires, and know how to reach IT support.
How Can Companies Maintain Secure Access for EOR Employees?
Employee access management continues after onboarding. Permissions tend to accumulate as employees take on new projects, and without regular checks, it’s easy for accounts to drift away from least privilege. Following these best practices will help keep access aligned with each employee's current role:
- Regular access reviews: Ask managers and application owners to confirm that each employee still needs their current permissions regularly. Prioritize access to sensitive information, such as financial systems, customer data, and admin consoles.
- Role changes: When an EOR employee is promoted, moves teams, or takes on new responsibilities, add the access the new role needs and remove what the old role no longer requires.
- Security policies: Apply consistent requirements for authentication, password management, and approved applications, regardless of where the employee lives. Local data protection laws may add obligations in some countries, but your baseline controls shouldn't weaken just because an employee works through an EOR.
- Monitoring and documentation: Keep records of who owns each account, who approved access, and when permissions changed. Watch for unusual activity, such as sign-ins from unexpected locations or dormant accounts suddenly becoming active.
Centralized identity and access management (IAM) tools make this far easier across countries. By connecting applications to a central identity provider, IT teams can apply consistent security policies, simplify access reviews, and get better visibility into employee permissions.
How Should Companies Revoke IT Access When EOR Employees Leave?
Access revocation is one of the most important parts of EOR offboarding, and it takes more coordination than a domestic departure. Notice periods and termination procedures differ by country, and the EOR, as the legal employer, usually manages the formal process. Your HR and IT teams need to align their access timeline with that process.
The broader steps of ending employment are covered in our guide to avoiding offboarding mistakes with an EOR; however, the steps below focus on access.
- Confirm the final working day and access cutoff. HR and IT should agree on exactly when access ends. That may be the last working day, or earlier if the employee is placed on garden leave or the departure is involuntary. Factor in lead times, too, since EOR providers may require a certain number of days’ notice on top of any statutory notice period.
- Disable accounts and revoke active sessions. Remove access to email, SSO, VPNs, internal systems, and other applications. Deactivating the SSO account blocks new sign-ins, but it may not end every existing session immediately. Apps with separate logins outside SSO need to be deprovisioned individually.
- Remove permissions and credentials. Change passwords for shared employee accounts, revoke personal API keys and access tokens, and remove privileged or administrator access. Also, check for third-party tools that employees may have connected to company systems.
- Preserve necessary business information. Before deleting anything, transfer ownership of shared files, documents, and records the business still needs. Disabling accounts rather than deleting them may be necessary to preserve audit trails. Also, follow local privacy rules. Under UK GDPR, for example, companies shouldn't keep personal data longer than needed.
- Document and verify completion. Don't assume the job is done once the primary account is disabled. Check each system on the employee's access record, confirm access has been removed, and log who completed each step and when.
Best Practices for Managing IT Access Across a Global Workforce
The same principles apply whether you employ people in one country or in 50. These practices strengthen global workforce security by keeping access consistent for every employee:
- Standardize onboarding and offboarding checklists. Use the same access steps for every hire and departure and include any necessary country-specific additions.
- Assign clear ownership. Name who is responsible for each task, from sending status updates to disabling accounts, across HR, IT, managers, and the EOR.
- Centralize identity and automate where possible. Connect applications to a single identity and access management platform, and use automated provisioning to reduce manual errors.
- Maintain an account and permissions inventory. Know which accounts each employee holds and what each one can access.
- Communicate status changes promptly. Set expectations with your EOR and internal teams for how quickly you share start dates, role changes, and departures.
- Review access and verify deprovisioning. Run periodic access reviews and confirm that offboarding steps were completed in every system.
Take the Complexity Out of International Employment With RemoFirst
IT access is only one piece of managing an international team. You also have to navigate various employment laws, payroll and tax rules, statutory benefits, and termination requirements in every country where you hire.
RemoFirst helps companies employ people in 185+ countries, handling local employment contracts, payroll, benefits, and HR administration. We can also arrange equipment delivery for international hires, making it easier to get new employees up and running, wherever they're located.
Book a demo to see how RemoFirst makes global hiring easy.
Frequently Asked Questions
Does an Employer of Record Provide IT Access to Employees?
Typically, no. An EOR handles the legal employment relationship, including contracts, payroll, benefits, and local employment requirements. The client company usually creates employee accounts, assigns application permissions, and maintains IT security. Some EORs also offer equipment provisioning or related IT services, so the exact responsibilities depend on the provider and service agreement.
Who Is Responsible for IT Security When Using an EOR?
The client company is generally responsible for securing the systems and applications its EOR employees use. This includes authentication requirements, access permissions, security monitoring, and account deactivation. The EOR handles employment administration and communicates relevant employee status changes, helping the company's HR and IT teams coordinate onboarding and offboarding.
Can an EOR Provide Laptops and Other IT Equipment?
Yes. Some EOR providers offer equipment procurement, shipping, and logistics services for international employees. For example, RemoFirst's RemoTech service helps companies arrange equipment delivery to employees in different countries. However, equipment logistics and access to company applications are separate responsibilities, and the client company's IT team typically controls system access and security settings.
