Pomio CRM is a shared workspace: contacts, companies and deals are edited by the whole team. That is the point of a CRM, but it also means that every record can be changed by more than one person. An audit trail makes those changes traceable, so a question like “who changed this?” has an answer instead of a discussion.
Why a shared CRM needs a trail
Most questions about CRM changes are innocent. A deal amount was lowered, a contact was merged with the wrong duplicate, an owner was changed while a colleague was on holiday. Without a trail, the team reconstructs it from memory and chat messages. With a trail, one look shows who made the change and when, and the conversation can move on to whether it was right. Notes still matter: a note on an amount change or a stage change explains why. The trail shows that it happened.
What the trail should record
Keep it to the essentials: who did it, what was done and when. The actions that matter most for SMEs are changes to deals and contacts, deletions and archiving, owner changes, and anything to do with access: invitations, role changes, suspended users and MFA resets. Records that are no longer needed are better archived than deleted, so the history and the trail both stay intact.
What it should never contain
An audit trail is for reconstructing actions, not for storing credentials. Passwords and MFA secrets do not belong in it, not even partly. An administrator who resets someone’s MFA should show up in the trail as having done the reset, without the secret itself being visible or logged. The same goes for the content of exported files: the trail notes that an export happened and by whom, not the data itself.
It only works with personal logins
A trail that says “sales@” changed a deal tells you nothing. Every user needs their own login, and rights should be scoped to what each role needs, for example own records, team or whole tenant. Keep the number of administrators small, because admin actions are exactly the ones you most want to be able to trace.
When to actually look at it
A trail nobody opens still helps when something goes wrong, but it helps more with a few fixed moments. Look at access and role changes during the quarterly access review. Check what a departing colleague did in their last weeks when you suspend their account. And when a report suddenly looks different, start with the trail before anyone starts guessing.
How Pomio CRM helps
Pomio CRM records actions in an audit trail: who did what and when. Passwords and MFA secrets are not part of it, and an administrator can reset MFA without seeing the secret. Combined with invite-only accounts, personal logins and role scopes, that makes changes in the shared workspace traceable without extra tools. More detail is on the security page.
A practical checklist
Give every user a personal login; keep administrators to a small number; make sure deal, contact, owner and access changes are traceable; archive instead of deleting where possible; never store passwords or MFA secrets in the trail; check role and access changes every quarter; review a departing user’s recent actions when suspending them; ask for a note on important changes so the trail shows what happened and the note shows why.
Further reading
Is an audit trail only for large companies?
No. Small teams share logins and change each other’s records more often, not less. A trail costs nothing to keep and saves time the first time something unexpected happens.
Does an audit trail replace notes?
No. The trail shows who changed what and when. A note explains why. Important changes deserve both.
Should salespeople be told there is a trail?
Yes. Be open about it and explain that it exists to reconstruct changes, not to watch individuals. That keeps trust intact.
How long should the trail be kept?
Long enough to answer the questions you realistically get, and in line with your own retention and privacy policy. Agree on a period once and write it down.