DeskcommCRM

Least-privilege permissions

• Create separate login accounts for each team member with only the access they need (e.g., sales staff see customer chats, but finance staff cannot). Regularly remove access when people leave.
• Restrict WhatsApp API keys to read-only or chat-only permissions where possible, rather than giving them full administrative control.
• Store database passwords separately from application settings—use a secure vault (password manager or encrypted storage) instead of hardcoding them in configuration files.
• Limit which AI agents can connect to external services like OpenAI; only enable integrations that your team actually uses.

Network isolation

• Run DeskcommCRM on a private internal network or behind a firewall that blocks direct internet access from customer devices. Control which IPs or VPNs can reach it.
• Separate customer data from public systems—keep the CRM instance distinct from your email, web chat, or other public-facing applications to prevent cross-contamination if one is compromised.
• Encrypt all data traveling to WhatsApp or external AI services (use HTTPS/TLS); never send customer conversations or credentials over unencrypted connections.
• Isolate database traffic—only the CRM application should talk to the database, not staff laptops or external tools, using separate network segments if possible.

Monitoring

• Log all login attempts and data access (who viewed which customer record, when agents processed chats). Review logs weekly for unusual activity.
• Set alerts for failed logins or access from unexpected locations or times—this often signals compromised credentials.
• Track AI agent outputs and input prompts to catch injection attempts or unexpected behavior, such as agents revealing information they shouldn't.
• Monitor external API calls to OpenAI or third-party services; flag large data transfers or requests from unusual times that could indicate data exfiltration.

Red flags to watch for

• Agents responding with information from other customers' chats—this indicates broken data isolation between tenants and requires immediate investigation.
• Unexpected software updates or version changes without your approval; early-stage open-source projects can introduce vulnerabilities, so test updates in a sandbox first.
• Customer data appearing in external logs or third-party service dashboards—verify that your data governance policies are in place and that no sensitive information flows to external AI services without encryption or anonymization.
• Logins from unknown locations or repeated failed password attempts; trigger a password reset and review recent access logs for damage.