Use onboarding to confirm how a project will run after the client says yes. Lock five things before you start work: a signed agreement, a deposit or payment method, the access you need, one place for messages, and a written first milestone. Add any project-specific prerequisites before starting. A consistent checklist can surface unanswered questions early; it does not guarantee a trouble-free project.
Original research dated September 20, 2026. Text revised September 21, 2026; Sources and method identifies the specific claims rechecked and any earlier observations retained. This article contains no affiliate links.
Who this is for
Freelancers and solo consultants who win work by email or on a call, and then start immediately because the client is keen.
Manual baseline: what usually goes wrong
An informal start can leave work unsigned, a deposit unrequested, access unavailable or decisions scattered across messages. These are risks this checklist is designed to address, not documented frequencies or outcomes from a client study.
The five things to lock before work starts
| Step | What “done” looks like | Why it is first |
|---|---|---|
| 1. Agreement | Signed document naming scope, price, timeline, revisions and cancellation | Everything else refers to it |
| 2. Money | Deposit received, or payment method and schedule agreed in writing | Payment friction surfaces now, not at the end |
| 3. Access | Logins, files and permissions you need, held the way your client’s security requires | Access delays stall week one |
| 4. One channel | Named place for decisions, and where else you will not take them | Creates a record for checking scope changes |
| 5. First milestone | A dated deliverable and what the client must provide for it | Makes the project real and measurable |
1. The agreement
- Scope stated as deliverables, with a short list of what is not included.
- Price, currency, and whether tax is added.
- Payment schedule with dates or triggers, and what happens if payment is late.
- Number of revision rounds.
- Who owns the work, and when ownership transfers.
- How either side ends the project, and what is payable then.
Use your own template reviewed by a professional in your country, not wording generated on the spot. This article does not tell you what your contract should say.
2. Money before work
Ask for the deposit as part of the same message that confirms the start date, so it reads as process rather than suspicion. If you take card payments, compare whether a payment link or an invoice meets the client’s billing requirements; our Stripe Payment Links vs invoicing guide covers which to use when. If the client requires a purchase order or a supplier form, ask now: missing paperwork can delay payment.
3. Access, collected once
- List exactly what you need: accounts, folders, analytics, a staging site.
- Ask for the right permission level, not an admin account you do not need.
- Prefer named account invitations with the minimum permissions needed. If a shared secret is unavoidable, agree a client-approved password-manager sharing process.
- Note an expiry: when the project ends, access is removed on both sides.
If a credential was exposed in an unsuitable channel, ask its owner to replace or revoke it and share any replacement through the agreed secure process. Removing the chat message does not remove every copy. CISA’s exposed-password advisory illustrates replacing exposed credentials; it is historical incident guidance, not a finding about your client’s account.
4. One channel for decisions
Pick the channel the client already uses and say plainly: decisions and approvals go here; anything agreed elsewhere gets confirmed here in writing. Then keep your side of it. Consider a short weekly update in the same place to make status visible and retain a record for later scope questions.
5. The first milestone, in writing
Agree an appropriately timed first deliverable, and what you need from the client to hit it. Send it as a short message they can reply “yes” to. This is also where you set the review expectation: who approves, and how long they have.
A copy-paste kickoff message
Thanks for confirming, {name}. Here is how we start:
1. Agreement: I have sent it for signature.
2. Deposit: {amount} due before work starts, payable here: {link}.
3. Access I will need: {list}, ideally by {date}.
4. Where we work: decisions and approvals in {channel}.
5. First milestone: {deliverable} by {date}. For that I need
{what the client provides} by {date}.
Reply to confirm 3, 4 and 5, and I will book the time.What to add for longer projects
- A shared folder structure agreed on day one, so files do not live in an email thread.
- A named backup contact on the client side for when your main contact is away.
- A standing call if the project runs beyond a month, with a written recap after each one.
- An intake form if you onboard several clients a month; our Notion client intake forms guide covers building one.
Closing the loop at the end
- Final invoice sent on the agreed billing schedule, with delivery and payment terms checked.
- Access returned or revoked on both sides.
- Files handed over in a format the client can open without you.
- A short closing message that states what was delivered and what is out of scope from now on.
- Ask for a testimonial while the work is fresh.
Frequently asked questions
Is a deposit normal for small projects?
A deposit is a commercial option, not a requirement established by this article. What matters is that the payment schedule is agreed in writing before you start.
What if the client wants to start before signing?
Say what you can do without an agreement, usually scheduling and questions, and what you will not start. Enthusiasm at the start is not protection later.
How long should onboarding take?
Allow time for preparing and checking the agreement, arranging payment and confirming access with the client. Agree dependencies before reserving delivery dates.
Do I need a formal contract for a small job?
Requirements differ by country and by client. Ask a professional in your jurisdiction; this article is not legal advice.
Sources and method
Revised September 21, 2026. This is a recommended operational checklist, not a report of observed client failure patterns, onboarding duration or savings. The linked published guides provide tool-selection context; the linked CISA advisory supports replacing exposed passwords rather than treating message deletion as remediation. Contract wording, deposits, security and record-retention duties depend on the agreement and jurisdiction; have appropriate professionals review the terms you use.
Read next
