Security and data responsibilities

Understand the service chain before you trust the workflow.

121 CRM may involve the customer, 121, the configured platform and connected providers. A responsible setup names each party, limits access and resolves open data questions before go-live.

Subscribe to 121 CRM Seller, billing and cancellationSee onboarding responsibilities

Customer Thread

Responsibility follows the data

Illustrative example

Customer
Purpose and lawful data
121
Agreed configuration
Platform
Account capabilities
Provider
Connected channel
Review
Risk and approval
Human decision

This is a responsibility model, not a certification or hosting claim.

Responsibility chain

See where data moves — and who owns each decision.

A clear operating model distinguishes customer responsibilities, 121 configuration work and the role of connected suppliers.

121 CRM · Data responsibility chain

Customer

Lawful inputs, users, instructions and acceptance

121

Agreed configuration, access handling and documented boundaries

Connected supplier

Service operation, account terms and supplier controls

Access follows named roles

Changes retain evidence

Assurances need approval

Illustrative exampleConceptual responsibility view, not a published certification or exhaustive data-flow diagram.

Inside the working system

See what each part contributes.

The CRM is easier to plan when contacts, conversations, work, access and automation are treated as separate capabilities with clear responsibilities.

Capability 01

Users, roles and permissions

Controls whether a user acts at agency or sub-account level and which supported areas they can access.

How it works: Controls agency or sub-account configuration that determines access, packaging, governance or billing.
Why use it: Limits day-to-day access to the work a person actually needs to perform.
Plan for: Availability and control depth depend on agency plan, role and current account configuration.
Your team owns: An authorised administrator must review, approve and audit material changes.

Capability 02

Audit logs

Records supported user, account and settings activity for filtering and operational review.

How it works: Controls agency or sub-account configuration that determines access, packaging, governance or billing.
Why use it: Helps an administrator investigate changes and maintain accountability.
Plan for: Availability and control depth depend on agency plan, role and current account configuration.
Your team owns: An authorised administrator must review, approve and audit material changes.

Capability 03

Connected app management

Shows and manages authorised app connections and their account-level installation state.

How it works: Exchanges supported data or events through an authorised connection, scope or documented interface.
Why use it: Provides a review point for removing access that is no longer needed.
Plan for: External availability, rate limits, schema changes, permissions and data-controller duties still apply.
Your team owns: An owner must approve access, monitor failures and remove connections that are no longer needed.

Capability 04

Agency and sub-accounts

Separates agency-wide administration from individual customer locations and their data or settings.

How it works: Controls agency or sub-account configuration that determines access, packaging, governance or billing.
Why use it: Creates a clear tenant boundary for customer configuration and day-to-day use.
Plan for: Availability and control depth depend on agency plan, role and current account configuration.
Your team owns: An authorised administrator must review, approve and audit material changes.

Access and data

Collect what is needed and grant only useful access.

The customer remains responsible for deciding the purpose and appropriateness of its data. 121 responsibilities depend on the contracted configuration and support role.

Data minimisation

Define which fields are necessary; avoid importing data simply because it exists elsewhere.

Roles and permissions

Test access for each intended role and remove access when responsibilities change.

Human policy decision

Sensitive content

Agree what must not enter routine channels or automated workflows.

Connected providers

Every enabled channel adds its own account and responsibility boundary.

Messaging, phone, email, payment, AI and integration providers may each have separate terms, approvals, data handling and charges.

Connection owner

Record who controls the connected account and credentials.

Data direction

Document what moves, when it moves and which system remains authoritative.

Failure and removal

Plan for expired credentials, rejected messages, broken sync and safe disconnection.

Security checks

Keep each responsibility beside the information that supports it.

A practical control record names the question, the owner and what must be checked before the team relies on the answer.

121 CRM · Control responsibilities

Control questionOwnerNext check

Who can export customer data?CustomerConfirm

Who changes workflow permissions?Agreed scopeRecord

What happens at account closure?SharedDefine

Which suppliers process data?SharedCheck

Illustrative exampleIllustrative governance pattern. It does not assert that a specific technical control or certification is in place.

Questions to settle

Resolve the important data questions before go-live.

Hosting locations, suppliers, retention, recovery and account closure affect how the service should be used. Ask for clear answers where any of them matter to your decision.

Check before use

Residency and subprocessors

Confirm current hosting locations and relevant subprocessors for the intended service chain.

Check before use

Encryption, certification and availability

No service-chain certification, uptime or backup promise is published here.

Check before use

Retention, export and deletion

The configured product behaviour and each party’s operational duty require confirmation.

Questions about this page

Useful answers, without the sales fog.

1. Is customer data hosted in the UK?

The published service does not currently specify UK-only hosting. Ask for the current provider and subprocessor locations if data residency is material to your decision.

2. Who controls access to the CRM?

Account ownership and roles must be agreed. The customer should nominate owners and review access, while any 121 support access should be limited to the contracted purpose.

3. What happens when a connected provider fails?

Each important connection should have a tested failure, escalation and recovery path. No universal recovery time is promised.

Read all CRM questions

Continue the journey

See onboarding roles Read purchase questions Return to CRM overview

Delegate the work. Keep the human.

Ready to organise the customer journey?

Subscribe through the approved secure checkout, or review pricing and responsibilities before you decide.

Subscribe to 121 CRM Seller, billing and cancellationCompare pricing