Skip to content

Protect sensitive fields

Hide sensitive CRM field values behind a mask so that only people who deliberately reveal them can read them, set per workspace.

Field security is defined per workspace. A policy tells the Backoffice to mask a chosen field on a chosen record type: wherever that field would normally show, it renders as ****, and a person with the right access can reveal the value on demand. Policies flow down to child workspaces, and a child can override an inherited policy with its own.

Prerequisites

  • You are signed in with a role that lets you manage field security for your active workspace.

Read the policy table

In the left sidebar, open Field security. The page lists the policies that apply in your active workspace, one row each:

  • Field — the field the policy protects.
  • Entity — the record type the field belongs to.
  • Mode — how the field is protected. A masked field renders as ****.
  • Source — where the policy comes from: Current means it is defined in this workspace, and Inherited means it comes from a parent workspace.

When no policies apply, the page shows an empty state.

Add a policy

  1. Click New policy.
  2. Under Entity, choose the record type that holds the field.
  3. Under Field, choose the field to protect. Only fields that can be secured for that record type are listed.
  4. Under Mode, choose Masked so the field renders as ****.
  5. (Optional) Add a display name or description to explain the policy to other administrators.
  6. Click Save.

The field is masked immediately for everyone in this workspace and the workspaces that inherit from it.

Override an inherited policy

An inherited policy (Source Inherited) can be replaced for your workspace without changing the parent:

  1. On the inherited policy's row, click Override here.
  2. Adjust the mode as needed and click Save.

The row now shows Source Current. Its own children continue to inherit the new policy.

Edit or delete a policy

  • To change a policy defined in this workspace, open its row and use Edit.
  • To remove one, use Delete and confirm. If a parent workspace still defines a policy for the same field, that inherited policy takes effect again once yours is gone.

Note

Masking controls how a value is displayed; it does not change the value itself. Someone with access to reveal a masked field still sees the true value when they choose to unmask it.