Decide who can see and edit what with module-level CRUD permissions. Manage data access top-down with a department hierarchy so each user sees only their own scope.
Per-module CRUD permissions and a department hierarchy that scopes who sees what.
Access control has two independent axes: what a role may do in each module, and whose records a person may see. The first is a matrix of fifteen modules × five actions (access, view, create, edit, delete), where "access" is a master switch that hides the module from the menu and blocks every URL behind it. The second is data scope — all, own, none, or the department hierarchy — driven by an org chart with nested departments and multiple managers per department, so a manager sees their whole subtree and nobody else's. Around it sit the security features every workspace gets: two-factor login by e-mail code or authenticator app, a brute-force lock after five failed attempts, and an isolated database per workspace. Basic roles and 2FA are on every plan; the full per-module matrix, departments and the activity log start at Growth.
Most small-business CRMs offer three roles — admin, manager, user — and one question: can this role see everyone's leads or only their own? That collapses two different decisions into one, and the collapse is where the trouble starts.
"Can a salesperson delete a deal?" is a question about ability. "Can the Izmir team lead see the Ankara team's leads?" is a question about scope. A junior may be allowed to edit but not delete, and see only their own; a team lead may be allowed everything, but only within their team; a finance person may see every deal's value and be unable to touch a single lead. One dropdown cannot express any of that. Two axes can, and the combinations are the point.
A role is a grid. Rows are modules, columns are actions, cells are checkboxes.
| Modules (15) | Actions (5) | Example role |
|---|---|---|
| Leads, deals, tasks, projects, inbox, phone, income, expense, commissions, campaigns, forms, automations, products, reports, tickets | Access · view · create · edit · delete | Salesperson: leads/deals/tasks/inbox/phone full except delete; products view only; no access to income, expense, commissions, automations |
| Finance: income/expense/commissions full; deals view; reports view; no access to inbox, phone, campaigns | ||
| Support agent: tickets full; leads view and edit; inbox full; nothing else |
A role saved before a module existed does not silently lose it: modules added later default to allowed for existing roles, and an administrator narrows them if needed. Alongside the matrix, the role carries two smaller switches that come up constantly in sales teams — whether deal prices are visible and whether deal products can be edited — and, on Growth and above, which lead-card layout the role sees.
The leftmost column, access, is a master switch. Without it, the module disappears from the menu and every action on it is denied, even if "view" happens to be ticked. That matters because a menu that merely hides a link is not security; someone with the URL still gets in. Here every list, detail page and AJAX endpoint checks the same central rule, and a denied request gets a plain "No access" page, not a broken screen.
Menu sections follow their children: if a role has no access to income, expense or commissions, the whole Finance heading is gone. The Settings area — users, roles, departments, integrations — is visible only to administrators regardless of role settings.
Scope is applied at the query, not in the interface: lists, kanban boards, the dashboard, exports, the inbox and reports all filter by the same owner set. Deals follow the owner of their linked lead, tasks follow the assignee, project boards follow membership.
The hierarchy is not a "manager" field on each user; it is a department tree. A root department holds the company; under it you nest sales, support, regions, teams — as deep as you like. Each department has members, and any member can be flagged as a manager. A department can also carry a default role, applied to members you add to it.
Multiple managers per department are normal — a sales manager and a deputy both cover the team. Moving a department under another moves its coverage with it; moving a person between departments changes what their manager sees the moment you save. Coverage is cached per request and cycle-safe, so a mistaken tree cannot loop.
An administrator ignores the matrix: full ability, full scope. Only administrators reach Settings: users, roles, departments, custom fields, pipelines, integrations, the activity log. Any user can be promoted to administrator or demoted with one button — except yourself, so a workspace cannot lock itself out of its last admin.
Because administrators are outside the matrix, the practical advice is to have two or three and to give everyone else a real role, even the founder who "needs to see everything" — that is what the all scope on a normal role is for.
| Feature | How it works | Default |
|---|---|---|
| Two-factor login | Per user: a code sent by e-mail, or a time-based code from an authenticator app (Google Authenticator, Authy, 1Password). Set up under Settings → 2FA with a QR code. | Off; each user enables it |
| Brute-force lock | Five failed attempts for the same e-mail from the same address lock login for three hours. Applies to the main panel, the partner panel and the master panel. | Always on |
| Password reset | E-mail link flow; new accounts receive a generated password rather than choosing a weak one at signup. | Always on |
| Sensitive fields in logs | Passwords, tokens, API secrets, SIP and 2FA secrets are masked before anything is written to the activity log. | Always on |
| Session per workspace | Each workspace is its own subdomain with its own session; a user of two workspaces logs into each separately. | Always on |
On Growth and above, the workspace keeps a log of who did what: logins, settings changes, role and user edits, inbox assignments, product changes, task actions, ticket status changes. Each entry has the person, the time, the record and — where it applies — the before/after values. It is filterable, paginated and exportable to CSV.
The purpose is less forensic than practical: "who changed the stage on this deal", "who removed the delete permission from the sales role", "who logged in at 02:00 on Sunday" are questions that come up in every team of ten or more, and the answer should take a minute.
Every workspace has its own database — not a shared table with a tenant column, but a separate schema. A query in one workspace physically cannot return another workspace's rows. Hosting is in the Netherlands (EU), the interface is available in English, Turkish, Arabic, French and Italian, and each user chooses their own display time zone while storage stays in UTC.
What we do not claim: automated daily backups of your workspace are not currently part of the service, and you should export what you need to keep. We would rather say that here than let you find out later.
| Symptom | Most likely cause | Fix |
|---|---|---|
| Module missing from someone's menu | Role has no access on it | Tick access; the other actions only count once access is on |
| "View" is ticked but the page says No access | Same — access is the master switch | Tick access |
| Manager cannot see their team's leads | Not flagged as manager in the department, or role scope is own | Flag as manager; set scope to hierarchy |
| Manager sees the team's leads but cannot edit them | Hierarchy edit toggle off on the role | Enable hierarchy edit (and delete if wanted) |
| A user sees everything | They are an administrator | Demote and assign a role with the right scope |
| Deals missing for a person who owns leads | Deals follow the lead's owner; the leads have no owner | Set owners on the leads |
| Locked out after typos | Brute-force lock: 5 failures = 3 hours | Wait, or have an administrator reset the password |
| Plan | 2FA, brute-force lock, isolated database | Basic roles | Full per-module matrix + data scope | Departments (org chart) | Activity log + export |
|---|---|---|---|---|---|
| Starter | Included | Included | — | — | — |
| Growth | Included | Included | Included | Included | Included |
| Business | Included | Included | Included | Included | Included |
| Enterprise | Included | Included | Included | Included | Included |
Security basics — two-factor login, brute-force protection, an isolated database — are on every plan, as are basic roles. The full permission matrix with data scope, the department org chart and the activity log arrive together with Growth, which is the plan most teams above five people end up on for this reason alone. See the pricing page for the full comparison.
Set up your workspace in under a minute — free for 14 days.
Create your workspace