CRM Roles and Permissions: Everyone Sees Only What's Theirs

The costliest leak in sales isn't a hack. It's a sales rep who exports the client base right before their last day. CRM roles and permissions handle this calmly and in advance: everyone sees what they need for their work, and only the people who have been granted export and delete can use them.

How roles work

A role in emyCRM is a list of permissions. You assign it to an employee individually or to a whole department, and then every employee in that department gets those permissions. There are three built-in roles: Administrator, Manager and Employee. You can create your own roles from scratch or copy a built-in one and adjust it.

For companies, contacts, leads, deals and invoices, as well as your own custom entities, permissions are set for eight actions: read, add, edit, delete, export, import, a personal card layout and a personal page. Access to menu sections, tasks, email and chats is configured separately.

Visibility scopes: who sees whose records

• Own: records where the employee is the owner. The usual choice for a sales rep.
• Department: records of all employees in the department. For a department head.
• Subdepartments: the department and all departments under it. For the head of a division.
• All: the entire client base. For the administrator and the business owner.

The scope really works: someone else's record isn't visible either in the list or via a direct link. Bulk owner changes and moving a deal on the kanban board count as editing and require edit permission. When an employee covers for an absent colleague, they see that colleague's deals as their own.

Export and import: the main gates to your client base

Only someone whose role has the “Export” permission can export data, and the file contains only the records they can see in the list. In a new workspace, the Manager role has no export, import or delete permission; the administrator can always export. Every import and export is logged: who, what and how many rows.

Call recordings and email

Access to call recordings is set with separate telephony permissions (“none,” “own,” “department” or “all”), and every playback is logged. Mailboxes are protected separately: the administrator sees employees' corporate mailboxes but not their personal ones, and someone else's mailbox opens only with explicit access.

Sign-in security

• Sign-in journal: IP address, country, browser and the reason for a denial. The administrator sees the whole journal, an employee sees their own sign-ins.
• Sign-in only from allowed IPs: for the whole workspace, for a role or for a specific employee. For example, only from the office.
• Automatic blocking of inactive users: if an employee hasn't signed in for N days, the account is blocked. The data stays, and unblocking takes one click. The rule doesn't apply to administrators.

Who changed what

A card's history shows who created it, who opened it and who changed the owner; only those who can see the record itself can see its history. The deletion log and the import and export log are available to the administrator. Deleted companies, contacts, leads, deals and invoices stay in the Trash for 30 days, and the administrator can restore them with their full history.

When an employee leaves

In one action, the offboarding app hands the employee's companies over to colleagues (evenly, manually, or with companies that have invoices assigned separately), disconnects their mailboxes, hands over their chats and deactivates the account. If you made a mistake, the offboarding can be undone.

Check an employee's access

Once you have many roles and departments, it's easy to lose track of where a person's permission comes from. The “Check an employee's access” screen shows the employee's roles, both personal and inherited from their department, and the resulting permissions exactly as the server calculates them. Hovering over a cell shows which role grants that permission.

How to set up permissions in an hour

1. Assign employees to departments: this makes it easier to grant permissions to a whole department at once.
2. Give sales reps “Own” and department heads “Department.”
3. Decide who really needs export and delete, and grant them selectively.
4. Check the sign-in journal from time to time and, if needed, allow sign-in only from the office.
5. Test a couple of employees on the “Check an employee's access” screen.

Why the client base should belong to the company and not to the sales rep is covered in our article on the client card.