Key takeaway
Document CRM data, roles that can access it, and what integrations can read or change; review permissions and logs regularly.
Restrict CRM roles and export rights
CRM (Customer Relationship Management) software brings together customer contacts, sales opportunities and service history. Customer contacts, communications, purchases and support history in a CRM may be sensitive. Match roles to sales, marketing and support duties; do not give every employee access to all records, bulk exports and administrator settings. Update permissions when staff change roles and disable unused or shared accounts. Review active users, privileged roles and export logs on a schedule. Enable MFA for users and assign responsibility for updating and protecting the devices used to access the CRM. Define session revocation and security-team notification for suspected account misuse.
Manage integrations and service identities separately
A CRM may share data with email, support, marketing and accounting services. Record the owner and purpose of each connector and service identity, including which objects it can read or change. Do not use a person’s account for automation; grant an app only the fields and operations its workflow needs. Revoke its token and account when an integration ends, and update ownership when responsibility changes.
Protect database secrets and encrypt the connection
A Data Source Name (DSN) is a named database-connection configuration, such as the server, database and driver details. A DSN does not itself encrypt the connection or authorize access. Do not store database passwords as plain text in DSNs or CRM connection settings. Use a managed secrets store or integrated authentication where available. If a File DSN must be shared, keep it in a restricted directory; the connection account should not have administrator rights or access to unrelated data. Enable a TLS database connection and certificate validation when the platform supports them.
Review partner data scope and audit trails
Electronic Data Interchange (EDI) exchanges orders, invoices and shipping notices between partner systems in an agreed structured format. The document format does not automatically secure its transport. Before connecting EDI or another partner integration, define which documents and customer fields will be shared. Document the provider’s security responsibilities, authentication method and incident contact; protect data in transit and at rest. Require MFA for partner user accounts, retain send and receipt logs, and validate routing to catch a wrong recipient. Make configuration changes and unusual exports visible in audit records.