Check offboarding credential risks with RelayShield, Slack, Notion and Gmail
UnknownUnknown. This template uses community nodes we can't verify statically. Uses community nodes that can't be verified statically (unverified community packages are off by default in 3.0). Static check, last run 2026-10-19.
What this workflow does
This workflow has 9 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Notion, Slack, Gmail and Relayshield (community).
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Relay Shield: breach
- Relay Shield: infostealer
- Relay Shield: oauth watchlist
- Any Credential Risk Found? (If): checks a condition and branches into true / false
- Log Risk to Notion (Notion): create (page)
- Alert Security Team in Slack (Slack): uses Slack
- Email Manager (Gmail): uses Gmail
- Log Clean Result to Notion (Notion): create (page)
Services it uses
Before you upgrade to n8n 3.0
We can't fully verify this one: it relies on 1 community package, and n8n 3.0 turns unverified community packages off by default (N8N_UNVERIFIED_PACKAGES_ENABLED=false).
- Check that n8n-nodes-relayshield is verified or supports 3.0 (used in RelayShield - Breach Check, RelayShield - Infostealer Check, RelayShield - OAuth Watchlist).
Nodes used (6)
- Webhook
n8n-nodes-base.webhook - Relay Shield
n8n-nodes-relayshield.relayShield - If
n8n-nodes-base.if - Notion
n8n-nodes-base.notion - Slack
n8n-nodes-base.slack - Gmail
n8n-nodes-base.gmail
From the author
Quick overview This workflow receives offboarding events via webhook, checks the departing employee’s email in RelayShield for breach, infostealer, and OAuth exposure signals, then logs the outcome to Notion and, when risk is detected, alerts the security…