Candex is a self governing network. What that means is that anyone in your company can select "left company" on the dropdown under a user name. This triggers an email requiring re-verification before their account can be accessed again. If a user has actually left your company, they will not be able to re-verify by email and can therefore no longer access the data. Users cannot change their registered email to a different domain.
Deals involving deactivated users continue to show to the teams and their presence on activities remains unless someone manually removes them, but they cannot log in without re-authentication. Companies can choose to connect Candex to their single sign on mechanism.