How can we help?

CRM integrations can involve commercially sensitive information and personal data. For this reason, administrators should carefully review how external CRM access is authorized and how CRM-related operations are configured. The information accessible through a CRM integration depends on the external provider, the connected account's permissions, and the supported operations. How is CRM access authorized? External CRM providers generally require an authorization mechanism before allowing another application to interact with their systems. Depending on the provider, this may involve OAuth authorization, API credentials, or another supported method. The exact process depends on the integration. Does connecting a CRM give access to all customer information? Not necessarily. Access may be limited by the connected account, record permissions, field visibility, API restrictions, and the integration's supported capabilities. Can different users have different permissions? Polyosync workspace permissions and external CRM permissions are separate considerations. The effective access available to a user or AI-powered operation depends on the relevant configuration and authorization controls. Can an AI Employee access every CRM record? Do not assume so. AI-powered operations should be configured according to the intended business responsibility and available authorization boundaries. How should I protect customer information? 1. Connect only authorized CRM accounts. 2. Grant the minimum permissions required. 3. Restrict administrative access to integration settings. 4. Avoid exposing sensitive credentials. 5. Use controlled records during initial testing. 6. Review CRM provider permissions regularly. 7. Revoke connections that are no longer required. 8. Follow applicable privacy and data protection requirements. What about GDPR and other data protection obligations? Organizations remain responsible for assessing the lawful use of personal data within their business processes. Before using CRM information in an AI-powered workflow, determine whether the intended processing is appropriate under applicable data protection requirements. Consider data minimization, access controls, retention obligations, and relevant contractual requirements. Does a CRM integration automatically authorize all forms of data processing? No. Technical authorization to access a service is not the same as legal authorization to process personal data for any purpose. Business users must ensure that their use of CRM information is appropriate. What if an employee leaves the organization? Review the employee's Polyosync access and any external accounts or credentials associated with integrations. Where necessary, update or revoke relevant permissions. What if CRM credentials are compromised? Revoke or rotate the affected credentials through the CRM provider. Review relevant account activity where available. Update the integration configuration and notify the appropriate security personnel. Recommended approach Treat CRM integrations as access to sensitive business infrastructure. Define who can manage the connection, what information is required, which operations are permitted, and when access should be reviewed.