Who Gets to See What? Setting CRM Permissions Right

Sooner or later, a CRM collects almost everything a company knows about its contacts: phone numbers, contract details, notes from sales conversations, and sometimes sensitive information about a person's financial situation. That is exactly why the question of who is allowed to see what in the system is not a minor technical detail, but a question of data protection, trust, and common sense. Setting permissions cleanly protects not only your customers, but also your own team from mistakes that can become expensive.

Why permissions are more than an IT question

In many small companies, the quiet default rule is: everyone sees everything. That is convenient as long as the team is three people who sit next to each other anyway. But as soon as external staff, interns, or partners come on board, convenience turns into a risk. The revised Swiss Data Protection Act (revDSG) requires that personal data is only accessible to those who actually need it for their work. This principle is called "privacy by default", and since September 2023 it is no longer a recommendation but binding law.

In concrete terms: an account manager needs access to their own deals and contacts. Whether they also need to see the pricing negotiations with a major client that a colleague is handling is a very different question. Permissions are therefore not a vote of no confidence in the team, but a protective measure for everyone involved.

A good permission structure doesn't follow the question "Who do we trust?", but the question "Who really needs this data to do their job?".

The principle of least privilege

The proven ground rule is called "least privilege": each person receives exactly as many rights as they need for their task, and no more. Instead of laboriously assigning individual permissions person by person, you are better off working with roles. A well-thought-out role structure might look like this:

• Management: full access including reports, exports, and settings.
• Sales: access to their own and team-assigned deals, contacts, and the pipeline.
• Marketing: read access to contact lists and campaign data, but no view of contract values.
• Support: access to contact data and history, but not to financial details.
• External staff and guests: tightly limited, time-restricted access to clearly defined areas.

The big advantage of roles: when someone leaves the team or changes function, you change the role once instead of updating dozens of individual rights.

Handle sensitive fields with extra care

Not all data is equally sensitive. Fields with especially protection-worthy information, such as health details, creditworthiness ratings, or confidential notes, should be more tightly protected than a simple phone number. Many CRM systems allow permissions down to the field level. Use that where it makes sense, instead of blanket-locking or opening an entire module.

Common pitfalls in practice

Setting permissions once is not enough. In practice, typical mistakes creep in that undo all the effort:

1. Orphaned accounts: former employees or freelancers still have active accounts. Every departure belongs on a checklist.
2. Sprawling admin rights: out of convenience, too many people are given administrator status. Admin access should be the exception, not the rule.
3. Forgotten exports: anyone allowed to export data can pull it out of the protected system. This permission belongs in few hands.
4. No logging: without traceability, you can't determine in an emergency who accessed which data and when.

A simple countermeasure is regular review. Set yourself an appointment twice a year to go through all roles and access rights. Half an hour is often enough to clean up outdated permissions.

Security starts with the right platform

As important as the configuration is, it stands or falls with the foundation. Where does the data physically reside, and how transparently does the provider handle access? For Swiss SMEs, it matters whether customer data is hosted domestically and whether permissions can be managed clearly without a computer science degree.

This is exactly where Advanzo comes in: an AI-powered CRM with data hosted in Switzerland, clear roles, and an interface that follows the guiding idea "remove complexity, not add it". AI features such as email generation, deal scoring, or automatic conversation summaries work within the same permission logic, so convenience never comes at the cost of control. Whoever defines cleanly from the start who is allowed to see what builds a CRM that grows with them, without turning into a data protection construction site.