CRM Access Rights: Roles, Audit Log and Data Protection

Access rights in a CRM are configured by role rather than by employee name: for each job you describe which records a person sees, which ones they may change and what stays closed. The default is the minimum, extended only for a specific task. Four more mechanisms sit on top of roles — sign-in verification, an audit log, backups and a documented procedure for revoking access when someone leaves.

What a CRM role is and why least privilege matters

A role is a named set of rights granted to a job, not to a person. A new sales rep gets the "sales manager" role and immediately works under the same rules as everyone else: there is no need to configure their access item by item.

Personal exceptions have their place — one employee may be given the margin report, for instance. But once there are more exceptions than roles, the system stops being manageable: nobody remembers who was granted what, or why.

• Deny by default. A new role sees nothing beyond its own area of work; rights are added for a specific task.
• Rights belong to the role. Personal exceptions are recorded in writing and reviewed, otherwise they survive for years.
• Limit the volume, not just the sections. A sales rep sees their own customers, a head of sales sees the department's, not the whole company database.
• Keep dangerous actions separate. Deleting, exporting and changing rights are permissions in their own right, not part of "full access".
• Review rights on transfer. The old role is removed rather than stacked under a new one, otherwise within a year a person can see four departments at once.

In an off-the-shelf CRM, roles are assembled from what the vendor provided. In a system written for the company, rights are designed together with the data model, so a restriction can be placed on any field — right down to hiding the cost price inside the same deal record.

Which roles to set up in a CRM

You need as many roles as there are jobs with different responsibility for data. Below is a baseline set for a sales department that is convenient to start from.

Integrations need a role of their own. The exchange with 1C, the website or telephony runs under a dedicated account with minimal rights — so blocking a departing employee does not stop the data flow. We cover this in more detail in our article on integrating a CRM with corporate systems.

Permission levels: what is granted separately

Access is limited not only by section but by action: viewing, creating, editing, deleting and exporting are configured independently of one another. The matrix below shows how that looks in practice.

Deletion is better replaced by archiving: the record disappears from lists but stays in the database and in the log. A sales rep's slip then does not destroy the deal history, and recovery does not require restoring a backup.

How to protect the customer database from being exported

A database is protected not by banning copying but by limiting volume: an employee should see exactly as many records as the job requires and have no way to take them all at once.

• Export to a file stays with the administrator and is granted on request, rather than being left on for everyone.
• Phone numbers and emails are partly masked in lists: calls and emails go out from the CRM, while the full contact is visible in the customer record.
• Bulk viewing is capped at a number of records per day, and the people who approach the cap are reviewed.
• Document links are issued with an expiry date rather than living forever.
• API access is granted to applications, not to people, and revoked together with the project.

These measures do not make a leak impossible — they make it visible and slow. What happens when personal data does get out, and what the consequences are, is covered in our article on personal data leak risks.

How to verify sign-in to a CRM

A password alone is not enough to guard a customer database: passwords are guessed, reused and handed over through phishing links. That is why sign-in is confirmed with a second factor.

Second factors are not equal. NIST SP 800-63B-4 classifies out-of-band verification over the public switched telephone network — SMS or a voice call — as a restricted method. The reason is that a number can be ported to another SIM card or intercepted on the operator's side.

Important Make an authenticator app or a hardware key the primary method and keep SMS as a fallback for people whose app does not work. The same document notes that codes typed in by hand are not phishing-resistant: they can be entered on a fake page just as easily as a password.

If the company already runs a corporate user directory, it is easier to hand CRM sign-in over to it: Active Directory, LDAP, Google Workspace or Microsoft Entra ID — the name Azure AD has carried since July 2023. Accounts are then created and blocked in one place, and sign-in policies apply across every service at once.

Audit log and backups

The log answers the question "who did this", the backup answers "how do we get it back". Without the first, an investigation runs on guesswork; without the second, any mistake becomes irreversible. Here is the minimum set of events a log has to keep:

• Sign-ins, including failed attempts and logins from a new device.
• Creating, editing and deleting deals, contacts and documents — with the old and new value of the field.
• Data exports: who exported, how many records and in what slice.
• Changes to rights and roles — who granted access, and to whom.
• Changes of account owner and bulk reassignment of deals.
• Integration calls: which account was used and which data was pulled.

Backups are verified by restoring them. A copy that has never been restored does not count as protection: you find out the archive is damaged or incomplete on the worst possible day. A sensible minimum is a daily copy, storage in a separate location and a scheduled test restore.

What to do on an employee's last day

Access is closed on the day the person stops working, and it is closed everywhere, not only in the CRM. It helps to keep the list below ready, so the procedure does not depend on who happens to be in the office.

• Block the account in the CRM and in every connected service, rather than merely changing the password.
• Reassign their deals and tasks to someone else: the history and correspondence stay in the system.
• Revoke the API tokens and keys issued to that account.
• Turn off mail forwarding and shared access to files and folders.
• Take back access to the corporate number and work chats in messengers.
• Change any shared passwords the person knew, if such passwords still exist.
• Review the log for the last few weeks: were there bulk exports or unusual viewing patterns?

Access is blocked fully automatically only when the CRM is tied to an HR system or connected to single sign-on: the termination in HR switches off the account across every service. In all other cases it is a manual procedure, and it needs an owner appointed in advance.

What Uzbek personal data law requires

A customer database is personal data, and handling it falls under the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 2 July 2019. Role separation, an audit log and backups are not only a convenience: they are part of the protective measures an operator is required to take.

The requirement to keep data inside the country narrowed in 2026. Article 27-1, as amended by Law No. ZRU-1125 of 26 March 2026, requires three categories to be processed on equipment located in Uzbekistan: biometric data, genetic data and data on users of telecom operator services. Other personal data may be processed abroad if one of the conditions in the same article is met — adequate protection in the foreign state, standard contractual clauses or binding corporate rules, or compliance with international standards for managing and storing data.

Important Names, phone numbers and deal history are not on the closed list in part two of Article 27-1. But if your system holds fingerprints, facial images used for recognition or genetic data, the platform has to sit inside the country — hosting in an Uzbek data centre fits that case. The exact wording of the law is worth checking with a lawyer before you act on it.

How we configure access

Syntra Systems works out rights on a map of the company rather than in the CRM interface: who works with which data, who needs it to make a decision and who only needs it for reference. The configuration then follows five steps.

1. Map of the company. Departments, jobs and responsibility for data: who enters it, who approves it, who only looks at it.
2. Role matrix. For each role we record what it sees, what it may change and what stays closed. Contested points are agreed with the manager before configuration starts.
3. Restrictions in the system. We configure sections, fields, the volume of records returned and separate permissions for deleting, exporting and managing rights.
4. Protective mechanisms. We switch on sign-in verification, the audit log and backups with a verified restore.
5. Testing under each role. We sign in one by one as a sales rep, a head of sales and an accountant, and check that nothing extra is visible.

The "access rights and security" part is included in a CRM rollout from $3,000. If the whole infrastructure needs checking rather than the CRM alone, that is separate work: an information security audit from $1,200, and fixing the issues found in access, encryption and backups from $4,000, both on our cybersecurity page.

Frequently asked questions