The role decides, the server checks
What a user sees and does is set by their role. The check runs on the server on every request, so the screen, an API key or the assistant can’t show more than allowed.
Shared
The role decides who sees what. The server enforces it
Someone not allowed to see cost won’t see it: not on screen, not via the API, not via the assistant. Every change has an author and a time, and data is stored in the EU.
Available on the free Deals plan, 100 transactions per month
Audit
| 26.09.2026, 16:19 | IAIntegration (API) | subscription_invoiced Counterparty | Open |
| 26.09.2026, 16:19 | IAIntegration (API) | subscription_invoiced Counterparty | Open |
| 26.09.2026, 16:15 | ITIhor Tkachenko | Task | |
| 26.09.2026, 16:15 | PAOleh Partner | Creation Deal | Open |
| 26.09.2026, 16:15 | PAOleh Partner | Creation Contact | Open |
| 26.09.2026, 16:15 | PAOleh Partner | Creation Deal | Open |
| 26.09.2026, 16:15 | ITIhor Tkachenko | Reference list changed |
What it looks like without Krokul
A sales rep saw the cost on a product record and offered a discount “down to purchase price”. The cost was visible because that was “the default setting”.
A deal amount dropped from 120 to 90 thousand the day before signing. Nobody knows who changed it or why — there’s no history.
A dealer got access “to see their own orders” — and saw stock levels and prices at every tier.
What Krokul does
Cost and margin behind a separate permission
The right to see cost, hourly rate and margin is granted separately. A role without it won’t see those fields anywhere — not on the record, not in a report, not in the API.
Audit log and change history
Every change comes with an author, a timestamp and a “before → after” value. The company log answers “who did this”; a record’s history answers “what happened here”.
External profiles kept separate
Clients, dealers, agents and partners log in to their own portals with their own permissions and see only their own data. Internal screens simply don’t exist for them.
How it works
Assign roles
Ready-made roles with a list of permissions; the owner can add custom ones. Seeing cost, deleting, closing periods — each is a separate toggle.
Invite your team and external users
Employees join the company with a role; clients and partners get portals. Several companies with one login, with a separate role in each.
The system keeps the log
Create, update, delete, login, API call — with author and time. The history on a record shows “before → after” for every field.
Check when questions come up
Filter the log by user, object, date. The answer to “who changed the amount” takes a minute, no interrogation needed.
Result
- Cost and margin are visible only to those allowed — regardless of the screen.
- Every change has an author, and “who did this” doesn’t need a meeting.
- Dealers and partners see only their own data, because they have separate portals.
What’s not included
Krokul doesn’t offer corporate SSO login today. The ISO 27001 and SOC 2 certifications belong to the infrastructure providers — Supabase and Google Cloud; Krokul copies the database daily to separate storage.
Questions
Where is the data stored?
In the European Union: the database and application servers are hosted in EU data centers.
Is the data used to train models?
No: company data is not used to train models.
Can I run several companies?
Yes, with one account and a separate role in each; company data never mixes.
What happens if two people edit the same record?
Krokul detects the concurrent write and won’t let the second person overwrite the first one’s changes — it shows the conflict and exactly what changed.
How is this different from permissions in a typical CRM?
In many CRMs the interface enforces permissions, so a hidden field can still be pulled through the API. In Krokul one server-side check covers the screen, the API and the assistant, so hidden stays hidden.
How much does it cost?
Roles, the audit log and change history are included in all plans, including the free Deals plan; history is kept for 3 months on Deals, 12 on Money, and indefinitely on Margin.
Can I split sales into teams and territories?
Yes: teams and sub-teams, the members of each, and assignment rules — who gets a new deal based on source or other conditions. A team manager sees their team’s deals.
Can I try out a process without risking live data?
Yes, the Margin plan includes a test company: a separate tenant next to your live one where you can try a pipeline, automations or an import without touching real clients.
Give your team exactly as much access as they need
Assign roles, hide cost from those who don’t need it, and open the audit log — everything is already recorded there.
Included in the Deals plan — free.