Who can do what in your CRM

Four roles are enough

A product with twelve permission levels sounds thorough and never actually gets configured. Four will do for almost any small business:

• Owner. Can do everything, and is the only one who manages the team: inviting colleagues, changing roles and withdrawing access. One person per organisation — two owners means nobody is the last one responsible.
• Manager. Can do everything with customers and deals, including deleting. Doesn't manage the team — inviting people and changing roles stays with the owner.
• User. Can create and change customers, deals and tasks. The role for just about everyone who sells.
• Read-only. Can look and change nothing.

Read-only is the most useful one

This is the role that gets underrated most, and it solves the commonest problem of the lot: people who need to know what's going on but don't need to fill anything in.

Your bookkeeper, who wants to see whether an order is coming. An engineer who wants to read what was agreed before they turn up. A business partner who watches without working in it.

Without this role those people either get no access — and then they ring you — or full access, and then you run the risk of something disappearing by accident. Give read-only away generously. Information reaching more people is the whole point of a CRM.

Watch who can change roles

This is the detail that matters most in practice and is overlooked most often: whoever can change roles can make themselves the owner.

So that belongs with the owner, not with everyone who happens to be a manager. Check whether that line exists when you look at a new product. If it doesn't, the permission system is decoration.

One thing the owner in Nermio can't do, which is worth knowing before you go looking for it: delete the whole organisation. Cancelling and deleting aren't the same thing either — cancelling means you stop, and you can export your data up to that day; deleting is irreversible. That last one we do for you, on request, with the reason recorded in our log.

The NCSC's guidance for small organisations makes the same point in plainer terms: give people the access their job needs and no more, and keep administrative accounts separate from the ones used for everyday work.

When someone leaves

Two things, and the order matters.

Transfer their customers first, and only then withdraw their access. The other way round leaves you with an account that can't reach anything while twelve deals are still in its name — and then nobody knows who should pick them up. See the piece on handing over a customer.

Then actually withdraw it, don't just change the password. An account set to inactive can do nothing; an account whose password you've changed can come back through a reset email. You only notice that difference when it goes wrong.

A notice period is a gift here: you usually know the last working day weeks in advance, which is enough time to plan the handover rather than improvise it on the Friday afternoon.

And leave their notes in place. Those belong to the business, not to them. A record that loses its history the moment someone leaves is exactly what a CRM is supposed to prevent.

What you have to be able to explain

You're responsible for customer data even when someone else supplies the software. In concrete terms that means you have to be able to say who can reach which data, and you have to be able to withdraw access.

A list of who holds which role is enough for that — provided it's accurate. Go through it once a year; in almost every business you'll find people on it who don't work there any more. That list is also what makes a subject access request answerable inside the month the ICO allows, because the first question is always where is this person's data held. More on that in the piece on customer data and UK GDPR.