Who in your business should have access to your CRM and customer records?
Give each person their own login and only the access their job needs. The owner and a second admin manage users and exports. People who work leads add and edit records. People who only look get view access. Contractors get the part of the job they do, for as long as they do it. Limit who can export or delete the whole list, and review the user list every few months and whenever someone leaves.
Roles in plain terms
These roles are general advice, not a standard. Many tools can limit access like this and some cannot, so ask your vendor what yours can do. The related answer on what a CRM is covers what a customer record holds.
| Who | What to give them |
|---|---|
| Owner and a second admin | Everything, including users, settings, exports and deletion |
| People who work leads | Adding and editing records and notes, usually without bulk export or delete |
| People who only look | View access, with no editing, such as a manager reviewing numbers |
| Bookkeeper | Only the billing fields and amounts they need, if the tool can limit it |
| Contractors and outside helpers | Their own login, for the part of the job they do, removed when the job ends |
Who may export or delete
An export is how a whole customer list can leave in one step, and a deletion can be hard to undo. Usually only the owner and the second admin should be able to do either. Ask the vendor whether deleted records can be restored and for how long, and whether it logs who exported what.
Keep two admins
Keep the account in the business's name, with at least two admins from the business, so one person leaving cannot lock you out. The related answer on removing an employee's access when they leave covers the day someone goes and why each person needs a separate login.
What the FTC guide adds
The FTC's guide "Protecting Personal Information: A Guide for Business" (October 2016) is about the personal information a business holds, which a CRM often does. Its least-privilege point is covered in the related answer on what an AI assistant should be allowed to see. The guide also advises knowing which employees have access to consumers' sensitive personally identifying information, and locking out users who fail a set number of log-on attempts. It advises explaining to employees why sharing passwords is against company policy, and putting security expectations in writing in contracts with service providers. As general advice, do the last one with any contractor who has a login.
How to check who can see what
This routine is general advice. Do it every few months, and whenever someone's job changes or they leave.
- Open the user list and match every name to a person who works for you or with you now.
- Look at each person's role and ask whether the job needs it.
- If the tool allows, sign in as a test user with the lowest role and try to open, export and delete a record.
- Check which other apps are connected to the CRM, since they may read the records too.
- Write down the date and any changes.
Sources
Related answers
- What is a CRM, and does a small business need one?
- How do you remove an employee's access to accounts when they leave?
- What should an AI assistant for your team be allowed to see?
Business systems and integrations
Many businesses already pay for the right tools. They just do not talk to each other, so details get typed twice and things fall through. We set them up properly and connect them.