CRM field ownership
Sync only the CRM fields the receiving service needs
A contact record can contain more information than an operational workflow requires. Limit both transport and destination access to the purpose of the integration.
In this article
Define the necessary field set
For a delivery workflow, the receiving service may need a contact destination and delivery-related details. It does not automatically need sales notes or every custom property.
Review the actual API selection and outgoing payload. A generic serialisation of the whole CRM object can copy newly added fields without a deliberate decision.
Keep field inclusion explicit and review it when the workflow changes.
Separate authority from visibility
A system may be allowed to read a field without being allowed to overwrite it. Encode those permissions separately in the integration policy.
Likewise, a support user who can inspect sync status may not need to see the full contact payload. Provide a controlled path to detailed information when investigation requires it.
Test both read and mutation boundaries using representative roles.
Protect conflict and history records
A conflict record can contain two versions of sensitive information. Apply retention and access controls to that record, not only to the main contact store.
Avoid placing old and new values directly in broad alerts. Record a field category and operation identity with a link to authorised detail.
Check error output from mapping and validation code, since rejected values are often included in exception messages.
Review deletion and identity changes
Decide how removal, merges and reassignment affect copied data under the application's policy. A source deletion does not automatically remove every destination or diagnostic copy.
Keep cross-system identity scoped to the correct organisation and customer relationship. Similar names or email addresses do not establish permission to merge records.
The review should show that the integration moves the minimum useful information, preserves field authority and gives operators enough evidence without creating an uncontrolled duplicate of the entire CRM.
Primary sources
OWASP: authorisation guidanceHubSpot: contact API guideReferences checked 11 September 2026.