How to best handle "who can access which records" in the CRM

[MEbbestrand]

Hi!

Hubs: Sales Hub Enterprise, Marketing Hub Prof.

Challenge: I am tasked with setting up a single portal for a business that has several "business units" (not BU's in HS terminology!) and on top of that several geographical cohorts, beneath each BU they need to be able to filter/segment/report on and set record ownership according to.

Example: 

• BU: Software
  • Geo: UK and Ireland

There are 8ish BU's and 8ish geographical cohorts (can change in the future)

My current hypothesis is to control access with the help of a Team structure, user properties on each record (one per BU) and settings in the permissions et assigned ("only records my team owns").

However, I'm guessing this "partitioning" of CRM records isn't watertight, per se?

What happens if a Marketer that is part of BU: Software creates an active list? They will only see the records they're allowed to see. But if they go ahead and send a marketing email to that list, I'm assuming ALL qualifying contacts would recieve the email, even though the marketer is only allowed to see X contacts in their list, based on their setting?

How would we best handle if Sales Rep A in Team A tries to add a contact that already exists in the CRM, but Sales Rep A doesn't know that because it's owned by Sales Rep B in Team 2?

I guess what I'm after is:

• Does anyone have a smarter way of doing this?
• Any pros and cons to my reasoning?

I need help thinking! 🫠

[Markestac · Accepted solution]

Hey @MEbbestrand,

You are correct that when the Software will create an active list to send marketing emails, it will initially target all contacts. However, there is a solution to this: you can modify the Communicate permission to 'Records they own.' This adjustment ensures that users can only send emails and enroll contacts in sequences etc for those contacts they personally own. 

Here are the steps to update this permission:
1. Navigate to Settings > Users & Teams.
2. Select the user and click on Edit Permissions.
3. Search for Communicate and select 'Records they own.

'By implementing this change, emails will not be sent to contacts owned by Sales Rep B.

Regarding your second question, if Sales Rep A in Team A tries to add a contact that already exists in the CRM, but Sales Rep A doesn't know that because it's owned by Sales Rep B in Team 2 -> Sales Rep A will encounter an error message stating: "This email address already belongs to a contact in your database."

Let me know if this resolves your issue.

Did my post help answer your query? Help the community by marking it as a solution.
Thanks.

[MEbbestrand]

Hi - thank you so much for taking the time!

By configuring the "Communicate: Records they own" setting in the permissions set - would that apply to if the user sends Marketing Emails as well? Or would it only be "communication" in the sense of being a Sales Rep and sending one on one emails etc?

We are closing in on this user permissions/team structure/"who can do what"/"who can access which records" discussion from both a Marketing and Sales standpoint, which of course makes in a tad more complex.

Thanks for advising on and confirming my suspicions on the second scenario - don't know if that makes anything much easier when it comes to deciding which road to take on this - but it certainly help to make our options a bit more concrete 🙂

[kennedyp]

Hey @MEbbestrand -- The Communicate permission only applies to sales emails, not marketing emails. 

[kennedyp]

Hi @MEbbestrand! Thanks for your post-- happy to have you here 😊

You bring up some really great hypotheticals. You are correct that a user can access a list with contacts from other teams, but they will only see the contacts they have access to. Additionally, a marketing email would send to all contacts on the list regardless of user access. 

With Enterprise, you could assign lists to teams and enforce a filter to be added to every list that the records belong to the relevant HubSpot team. 

I want to invite some subject matter experts to see if they have any suggestions.

Hey @Bryantworks, @ChristinaKay, @Lucila-Andimol do you have any thoughts on managing assets this way in HubSpot? Thanks! 

Best, 
Kennedy