Data control in the CRM: your own Google or Azure app, your own AI key, your own roles

Data control in a CRM means this: you decide which contracts your emails, your calendars and your AI requests run under, and who in your team sees which records. In Advanzo you set that up with six controls: your own Google or Azure app for mail and calendar, your own Anthropic or OpenAI key for the AI, credentials stored encrypted, workspace isolation, custom roles with visibility groups, personal API tokens and an audit log.

This article is for managing directors, IT leads and sales leads in Swiss SMEs with 5 to 50 people who want to introduce a CRM and want to know beforehand how much control they keep over their data.

The problem: customer data runs under contracts you do not know

A CRM with email sync and AI touches three kinds of data: the content of your mail and calendars, the credentials for those accounts, and the text that gets sent to an AI model. With most vendors everything runs through the vendor's accounts. The mail connection uses the vendor's app, the AI requests go to a model through the vendor's key, and which person in the team sees which data is governed by a switch with two positions: admin or not.

For a fiduciary, a law firm, a recruitment agency or an insurance broker that is not enough. These businesses have clients who ask who processes their data. They have staff who should not see everything. And they have an IT setup that already holds a Google Workspace or Microsoft 365 contract and perhaps a contract with an AI provider. The question is not whether the CRM is secure. The question is whether you hold the contracts and the rights yourself.

The six controls in Advanzo

Two of these run without any action from you. The other four you set up, in the order described below. The whole setup takes about half a day for a team of 15, and most of that goes into the app registration with Google or Microsoft.

Step by step: how to set up data control in Advanzo

Step 1: Register your own Google or Azure app and enter it

1. Register an app for Advanzo in your company's Google Cloud Console or Azure portal. Your IT team knows this process from other tools.
2. Enter the app's details in the Advanzo workspace settings.
3. From now on everyone in the workspace connects their mail and calendar through your app. The permission shows up in your Google or Microsoft admin console, where you can review and revoke it.

If you do not need this, you connect in two clicks through Advanzo's app. Your own registration is an option, not a requirement.

Step 2: Enter your own Anthropic or OpenAI key

1. Create an API key in your Anthropic or OpenAI account. If your company has no contract yet, it needs an account with the provider, whose terms you review yourself.
2. Enter the key in the workspace's AI settings. It is stored encrypted.
3. All AI features, from reply drafts to deal scoring to Autopilot, now run under your contract.

What to look out for with your own key is covered in own API key or AI add-on.

Step 3: Define roles with granular permissions

1. Create custom roles, for example "sales", "inside sales", "management", "intern".
2. Set per role and resource what is allowed: read contacts, edit deals, send documents, change workflows, manage settings.
3. Assign exactly one role to each person. Two people get admin rights, not everyone.

Which rights make sense in practice is covered in setting CRM permissions right.

Step 4: Set up teams and visibility groups to separate data

1. Form teams by location, mandate or product line.
2. Create visibility groups and assign the records that only one group should see: the clients of one mandate, say, or the deals of the management team.
3. Check with a test user what a person in the "intern" role actually sees.

How agencies and groups use this to keep client data apart is described in data separation in a multi-client CRM.

Step 5: Personal API tokens instead of shared logins

Anyone connecting Advanzo to other systems through the REST API creates a personal token for it. It belongs to a person, not to the workspace. When that person leaves the company, the access ends with their account. Shared passwords in a team document are a thing of the past.

Step 6: Read the audit log regularly

The audit log records changes in the workspace. Read it once a month: who changed roles, who adjusted settings, who deleted records. Five minutes are enough to avoid surprises.

Your own AI key or the add-on: what changes

In both cases the same rule applies: the AI proposes, a person decides. Autopilot puts proposals into the approval inbox, the AI assistant writes drafts, deal scoring flags risks. Nothing is sent, moved or created without a click.

Checklist: data control before you start

• Decided whether mail and calendar run through your own Google or Azure app or through Advanzo's app.
• Decided whether the AI runs through the add-on or through your own Anthropic or OpenAI key.
• Custom roles created, and no role has more rights than the work requires.
• Admin rights held by at most two people.
• Visibility groups defined for records not everyone should see, and checked with a test user.
• API access only through personal tokens, no shared logins.
• A recurring calendar entry to read the audit log monthly.
• Leaver process defined: deactivate the account, check the role, tokens end with the account.

Mini scenario: a fiduciary and advisory firm with 15 people in Lucerne

The fictional Reussblick Treuhand AG looks after 240 mandates, from sole traders to holding companies. Twelve advisers, two people in the back office and one managing director work on Microsoft 365. IT is an external partner. Until now client contacts lived in Outlook and in one Excel list per adviser. Two requirements were fixed for the CRM: the mail connection runs through the firm's own Azure registration, and each adviser sees only their own mandates.

The setup: the IT partner registers the Azure app in two hours. The managing director creates an Anthropic key under the existing company contract and enters it. Four roles are created, twelve visibility groups by adviser portfolio, and one group for management. AI usage runs through the Anthropic contract the IT partner manages anyway.

Typical mistakes with data control

• Everyone becomes admin: it is convenient, and it makes every role worthless. Two admins are enough for a team of 50.
• Introducing visibility groups after the fact: whoever has to assign 3,000 records after the import postpones the job. Groups first, then import.
• Sharing the AI key in the team chat: the key is entered once in the workspace and stored nowhere else. Passing it on in a message makes the encryption in Advanzo pointless.
• Registering your own app without documenting the permissions: IT should know what rights the app has and where they are revoked. Otherwise the registration sits there in a year with nobody responsible.
• Opening the audit log only in an emergency: by then it is too late to spot patterns. Five minutes a month is enough.
• Promising security the tool does not state: tell your clients what can be backed up: encrypted credentials, isolated workspaces, your own app, your own AI key, roles, tokens, audit log. Nothing more.
• AI use without a team rule: even with your own key, the team needs an agreement on which content goes to the AI. The person stays responsible, not the key.

Frequently asked questions

What does my own Google or Azure app give me compared with Advanzo's app?

The mail and calendar connection runs through a registration in your own Google or Microsoft account. Your IT team sees the permission in its own admin console and can review and revoke it there. The features are the same as with Advanzo's app, which connects in two clicks.

How are my AI key and my credentials stored?

Credentials and API keys are encrypted in transit and at rest. The key is entered once in the workspace. After that it should not sit anywhere else, not in a message and not in a document.

How granular are the permissions?

You create custom roles and set per resource what a role may do: read contacts, edit deals, send documents or manage settings, for example. Teams and visibility groups additionally govern which records a person sees at all.

Is my data separated from other customers?

Yes. Every workspace is isolated from all others at the data layer. If you run several workspaces, say for different companies in a group, that also applies between your own workspaces.

What happens when someone leaves the company?

You deactivate their account in the workspace. Their access and their personal API tokens end with it. Their contacts, deals and activities stay in the workspace so the team can keep looking after them. The audit log keeps a record of what was changed before they left.

If you want to try this in Advanzo: advanzo.app.