Skip to main content
All articles

CRM governance: who is allowed to change what?

Most teams have never answered this, and assume the CRM is keeping a record anyway. On HubSpot Starter and Professional, it is keeping a record of logins and almost nothing else.

Toni MedicToni MedicSalestructSeptember 9, 202610 min readCRM & Pipeline
The short version
Illustration of four hands reaching from different directions toward a large wall of identical unlabelled switches and dials, with one switch highlighted.
Four people, one wall of controls, and no agreement about who is allowed to touch which switch. This is the normal state of a CRM nobody has been put in charge of.

Ask around your company who is allowed to create a new deal stage, rename a field, or delete a contact. Unless someone has set permissions on purpose, the honest answer is often "anyone who has been shown where the settings are", and the person who last used them doesn't remember doing it.

That's usually fine right up until a number moves and nobody can explain why.

The short version

  1. CRM governance is three questions, not one: who can see a record, who can change it, and what gets written down when they do.
  2. HubSpot's account activity log filters by Login and Security Activity only on Starter and Professional. The categories that cover what people actually changed are Enterprise.
  3. Its "All Logs" view covers the last 30 days, and a deleted record can only be restored within 90 days of deletion.
  4. So on Starter or Professional, the CRM is not the audit trail. Something else has to be.
  5. Four controls do most of the work, and all four are configuration rather than process: required fields on stage change, a locked stage set, restricted delete, and a named owner for schema changes.

What is CRM governance?

CRM governance is the set of rules deciding who may see a record, who may change it, and what the system records when they do. It is configuration, not policy: a rule that lives in a document and not in the software is a preference.

Most teams hear "governance" and think of a data-quality initiative with a spreadsheet attached. It's narrower and more boring than that, which is why it works. Three questions, and you can answer all three this week.

The three questions, in the order they bite

Who can see it. The least urgent of the three on a small team, and the one people ask about first because it feels like the serious one. When everyone works the same deals, wide visibility is usually correct and restricting it costs you more in friction than it saves.

Who can change it. This is where the damage happens. Not deletion, which is rare and loud, but quiet edits: a close date pushed, a stage moved backward, an amount rounded, a required field left empty because the CRM allowed it. Every one of those changes a number somebody reports upward.

What gets recorded. The assumption almost everyone makes is that the CRM has this covered, and the assumption is where the surprise lives.

Your change history is shorter than you think

I went to check what a mid-tier CRM subscription actually records, using the one vendor whose documentation I could read end to end. HubSpot publishes this clearly, dated, and it's more restrictive than the reputation of the category suggests.

On Starter and Professional, the activity log filters by two things. In HubSpot's own words, "users in a Starter or Professional account will be able to filter by Login or Security Activity." The categories covering what people did to your data, "Approval, Content, Workflows, and more", are listed as Enterprise.

The default log view is 30 days. The article describes "All Logs: all log categories within the last 30 days."

Deletion is recoverable for 90 days. "A record can only be restored within 90 days of deletion."

Only Super Admins see any of it. Audit logs are a Super Admin capability, so the person who needs the answer usually has to ask someone else for it.

Put those together for a 20-person company on Professional. Somebody changed a closed-won amount in March. It's now September. There is no filter for that category on your tier, and even if there were, the window closed five months ago.

Illustration of a long corridor of doorways receding into the distance, the nearest three solid and lit, the furthest ones faded into empty pale space, with one small figure standing at the near end.
The near doors are lit and the far ones have gone. That is what a 30 day window looks like when the question you are asking is six months old.

This is one vendor. I could not read Salesforce's or Zoho's equivalent documentation directly, so I am not going to characterise them, and you should check your own before assuming either better or worse. The point that transfers is the shape of the question: find your tier's retention window and its available log categories before you rely on the log for anything.

The four controls that do most of the work

Governance on a small team is not a committee. It's four settings, and each one either exists in your CRM or it doesn't.

  1. Required fields on stage change, not on the field

    The single highest-value control, and the one most teams have never found. Most CRMs let you require a property before a deal may move to a given stage, configured in the pipeline or stage settings rather than on the field itself. Without it, every definition you agreed in a workshop is advisory. This is the enforcement half of giving each stage an exit criterion.

  2. Lock the stage set, and name who may change it

    Stages are the schema your forecast is built on. If any admin can add one, your historical reporting quietly stops being comparable to itself. Decide who owns the stage list, write the name down, and remove the permission from everyone else.

  3. Restrict delete, and keep create open

    Deleting a record destroys history that your log may not be able to give back after 90 days. Almost nobody on a small sales team needs delete rights, and taking them away costs nothing, because merging and archiving cover the real use cases. Creating records should stay wide open: friction there produces the far worse failure, which is deals tracked in a notebook.

  4. One named owner for schema changes, with a change record

    Fields, pipelines, automations. Not an approval process, just a person and a log. Four columns is enough: date, what changed, why, and what it was before. If your CRM will not keep that record at your tier, keep it outside the CRM. A shared doc that exists beats an audit log you cannot query.

The pattern in all four: governance you have to remember is governance you will stop doing. Each of these is a setting or a written name, so the system carries it instead of a person.

What to check in your own CRM this week

Three checks, each with a failing condition, so you finish with an answer rather than a task list.

Find your log and read the date on the oldest entry. Not the marketing page, the actual log in your actual account. It fails if the oldest entry is inside the last 90 days, or if the only categories you can filter by are about logging in. If it fails, the CRM is not your audit trail and you need step 4 above.

Count who can delete a deal. Look at the permission, not at who you think would. It fails if more than two people can, or if you cannot find the setting. On a small team, two is generous.

Try to change a stage with a required field empty. Same test as the pipeline post, because it is the same control. It fails if the CRM lets you. Everything you believe about your data definitions is then a convention, and conventions erode quietly, usually within one quarter.

If all three pass, your governance is ahead of most companies your size, and the next thing worth measuring is whether the records themselves are still true, which is a different problem with a different test, and whether anyone is using the thing at all, which needs a better signal than logins.

Common questions

CRM governance is the set of rules deciding who may see a record, who may change it, and what the system records when they do. The useful version is configuration rather than policy: required fields enforced on stage change, a locked stage set with a named owner, restricted delete rights, and a written record of schema changes. A rule that lives only in a document is a preference, because nothing stops anyone breaking it.
Less than most people assume, and it depends on your subscription tier. HubSpot documents that Starter and Professional accounts can filter account activity by Login or Security Activity only, with the categories covering data and workflow changes available on Enterprise, and its All Logs view covering the last 30 days. Check your own tier and retention window before relying on the log to answer a question about something that happened months ago.
In HubSpot, 90 days: its documentation states that "a record can only be restored within 90 days of deletion". That window is the reason to restrict delete permissions rather than to rely on recovery. On a small sales team almost nobody needs delete rights, because merging and archiving cover the genuine use cases without destroying history.
One named person, not a committee and not a rota. Without a dedicated ops role, that is usually whoever is closest to operations rather than the highest-ranking sales leader, because the job is configuration and record keeping rather than decision making. What matters is that the name is written down and that the permission to change fields, pipelines and automations belongs only to them.
Usually not, on a small team where everyone works the same deals. Visibility restrictions are the control people reach for first because they feel serious, and in a team that small they cost more in friction than they return in safety. The control that pays for itself is on changing records rather than seeing them, because quiet edits to close dates, amounts and stages are what move the numbers people report upward.

Sources

  1. HubSpot, View and export account activity history. Tier filtering ("users in a Starter or Professional account will be able to filter by Login or Security Activity"), Enterprise categories, the 30 day All Logs window, the 90 day record restore limit, and Super Admin access. Page states last updated 22 June 2026. Fetched and read 9 September 2026 (2026)

How these were checked

Every quoted phrase above comes from that single HubSpot page, opened directly rather than through a search summary. No other vendor's audit or permission limits are characterised in this post, because no other vendor's documentation was read for it. Salesforce and Zoho documentation did not render for automated reading on 8 and 9 September 2026.

Read next.

All articles