Security and compliance for CRM data

A CRM holds names, phone numbers, commercial terms, and the internal notes people write when they think only colleagues will read them. That combination makes it one of the higher-value targets in a small company’s stack, and one of the least defended.

Defence in depth, in the order it usually fails

Access control that survives an audit

Grant access by job, not by seniority. “Directors see everything” is a policy that cannot be reasoned about six months later, when a director has moved teams twice. Role-scoped permissions, reviewed quarterly, can be explained to an auditor in one sentence.

Vertex CRM supports role-based access within organizations, MFA for administrators, and API keys for programmatic access. Those are controls; the policy that decides who gets which is yours.

The three questions to answer before an incident

1. Who has administrative access right now? If the answer takes more than five minutes to produce, that is the finding.
2. What would a bulk export look like in the logs? Know this before you need it, not during.
3. How fast can we revoke someone? Including their integration tokens and API keys, not just their password.

The joiners and leavers process

Secrets hygiene

• Credentials in environment variables, never in source control or a shared document
• Rotation after any staff change that touched them—treat a departure as a rotation trigger
• Least-privilege scopes on every integration, re-checked when the provider expands its API
• Separate credentials per environment, so a test integration cannot reach production data

What software cannot do for you

No product makes an organisation compliant. Controls support a programme built from policies, contracts, training, and incident response. Any vendor claiming their software delivers compliance by itself is describing a marketing position, not a control environment.

What we can say plainly: use HTTPS in production, restrict administrative access, rotate secrets, review permissions on a schedule, and test your restore process at least once so you know it works.

Related: audit trail and compliance, DPDP Act and your CRM, and our privacy policy.