How to protect your CRM from a customer database leak

When CRM security comes up, the conversation turns to firewalls and encryption. The real statistics are more mundane: the database usually walks out with a manager who is leaving for a competitor, and it takes two minutes with the standard "Export to Excel" button, right before they hand in their notice. Technically it is not even a breach — the employee used a feature they had legitimate access to.

Why a perimeter does not save you

The classic security model defends against outside intrusion. But a CRM is open from the inside by its very nature: dozens of people work with the full customer database every day, because otherwise they could not do their jobs. So the task is not to forbid access, but to limit its volume, make actions visible and raise the cost of abuse.

Measure 1. Roles instead of blanket access

• A manager sees only their own clients and their own deals, not the company-wide list.
• A department head sees their group's contacts but without the right to bulk export.
• A marketer works with aggregated analytics and no access to personal fields.
• Full export rights belong to one or two people, and every use is logged.
• Contact details (phone, email) are masked in list views and revealed one at a time, with a log entry.

Measure 2. Limits and anomalies

On an ordinary day a manager opens 30–60 records. If 800 are opened within an hour, that is not work — that is a manual or scripted export. Set a limit on the number of records viewed per day and on export volume, and send an alert to the supervisor when it is exceeded. This kind of control catches exactly the scenario no antivirus will. In our ERP solutions counters like these are built in at the data model level.

Measure 3. Logs that cannot be erased

The activity log must record who opened, changed or exported which record and when — and be stored separately from the main database, in append-only mode. Logs that the system administrator can edit have no legal value. Retention should be at least a year: disputes with former employees surface months later, when a competitor starts calling through your database. We discuss this architecture at the start of every CRM implementation project.

Measure 4. Watermarks in exports

A simple and underrated technique: every export gets a unique set of decoy records — a few non-existent contacts with phone numbers and addresses you control. If the database surfaces at a competitor, a call to one of those numbers identifies exactly which export it came from. On top of that, invisible markers with the employee ID and date are embedded in the file. Simply knowing such a system exists reduces the number of incidents on its own.

Measure 5. The organisational layer

• A trade secret regime introduced by formal order: without it the database has almost no legal protection.
• A non-disclosure agreement with a specific list of protected information rather than generic wording.
• Revoking all access on the day of departure, not "when someone gets round to it" — from a checklist, together with HR.
• A policy ban on forwarding exports to personal messengers and personal email.
• A regular review, at least quarterly, of the list of active accounts and their rights.

The legal framework

A customer database is simultaneously your commercial asset and the personal data of third parties. The first is protected by a trade secret regime under 98-FZ; the second is governed by 152-FZ and requires a separate set of measures. An important nuance: a leak makes you the offender in the eyes of your customers regardless of the fact that you were the victim of a dishonest employee. Fines for a leak start at 3 million roubles. It is best to check the exact wording of documents against primary sources such as ConsultantPlus.

Implementing the full set — roles, limits, logs, watermarks — takes two to three weeks on average on an existing system. That is two orders of magnitude cheaper than a single incident. Tell us about your configuration and we will see what can be closed off fastest.