Here's a quick test: Can your junior sales rep see the salary field on a contact record? Can they export your entire customer database? Can they delete deals?
If the answer to any of those is "yes" or "I'm not sure," you need to read this.
Roles vs. Profiles — Know the Difference
Roles determine what data you can see (data hierarchy). Profiles determine what you can do (features and permissions). Most companies set up one role and one profile for everyone. Don't do that.
A Typical Role Hierarchy
- CEO/Admin: Sees everything across all teams
- Sales Manager: Sees their team's records + shared pipeline
- Sales Rep: Sees only their own leads, contacts, and deals
- Support Agent: Sees contacts and tickets, no deal values
Field-Level Security
Some fields shouldn't be visible to everyone. Revenue projections, contract values, internal notes — use field-level security to restrict visibility by profile. This takes 10 minutes to set up and prevents a lot of awkward situations.
Sharing Rules
Sometimes you need cross-team visibility. A support agent needs to see account details owned by sales. Use sharing rules for this — give read-only access where needed without opening up everything.
The Non-Negotiables
- Enable audit trails to track who changed what and when
- Turn on multi-factor authentication for all users
- Restrict data export to admin profiles only
- Review permissions quarterly — people change roles
Security setup takes half a day. A data breach takes much longer to fix. Let us audit your CRM security.