# The role decides who sees what. The server enforces it Someone not allowed to see cost won’t see it: not on screen, not via the API, not via the assistant. Every change has an author and a time, and data is stored in the EU. **In short.** Krokul is a B2B CRM where permissions are defined by the user’s role (owner, manager, sales rep, accountant, engineer, plus external client, agent and partner profiles) and checked by the server on every request — the same way for the interface, API keys and the AI assistant. The audit log records who changed what and when; every record has its own change history. Data is stored in the European Union; one account can run several companies with separate permissions; two people editing the same record at once can’t overwrite each other’s changes. **Who it’s for:** companies where cost and margin aren’t for everyone; owners with several legal entities; teams with external users: dealers, agents, partners. **Plan:** Available on the free Deals plan, 100 transactions per month ## What it looks like without Krokul 1. A sales rep saw the cost on a product record and offered a discount “down to purchase price”. The cost was visible because that was “the default setting”. 2. A deal amount dropped from 120 to 90 thousand the day before signing. Nobody knows who changed it or why — there’s no history. 3. A dealer got access “to see their own orders” — and saw stock levels and prices at every tier. ## What Krokul does ### The role decides, the server checks What a user sees and does is set by their role. The check runs on the server on every request, so the screen, an API key or the assistant can’t show more than allowed. ### Cost and margin behind a separate permission The right to see cost, hourly rate and margin is granted separately. A role without it won’t see those fields anywhere — not on the record, not in a report, not in the API. ### Audit log and change history Every change comes with an author, a timestamp and a “before → after” value. The company log answers “who did this”; a record’s history answers “what happened here”. ### External profiles kept separate Clients, dealers, agents and partners log in to their own portals with their own permissions and see only their own data. Internal screens simply don’t exist for them. ## How it works 1. **Assign roles** Ready-made roles with a list of permissions; the owner can add custom ones. Seeing cost, deleting, closing periods — each is a separate toggle. 2. **Invite your team and external users** Employees join the company with a role; clients and partners get portals. Several companies with one login, with a separate role in each. 3. **The system keeps the log** Create, update, delete, login, API call — with author and time. The history on a record shows “before → after” for every field. 4. **Check when questions come up** Filter the log by user, object, date. The answer to “who changed the amount” takes a minute, no interrogation needed. ## Result - Cost and margin are visible only to those allowed — regardless of the screen. - Every change has an author, and “who did this” doesn’t need a meeting. - Dealers and partners see only their own data, because they have separate portals. ## What’s not included Krokul doesn’t offer corporate SSO login today. The ISO 27001 and SOC 2 certifications belong to the infrastructure providers — Supabase and Google Cloud; Krokul copies the database daily to separate storage. ## Questions ### Where is the data stored? In the European Union: the database and application servers are hosted in EU data centers. ### Is the data used to train models? No: company data is not used to train models. ### Can I run several companies? Yes, with one account and a separate role in each; company data never mixes. ### What happens if two people edit the same record? Krokul detects the concurrent write and won’t let the second person overwrite the first one’s changes — it shows the conflict and exactly what changed. ### How is this different from permissions in a typical CRM? In many CRMs the interface enforces permissions, so a hidden field can still be pulled through the API. In Krokul one server-side check covers the screen, the API and the assistant, so hidden stays hidden. ### How much does it cost? Roles, the audit log and change history are included in all plans, including the free Deals plan; history is kept for 3 months on Deals, 12 on Money, and indefinitely on Margin. ### Can I split sales into teams and territories? Yes: teams and sub-teams, the members of each, and assignment rules — who gets a new deal based on source or other conditions. A team manager sees their team’s deals. ### Can I try out a process without risking live data? Yes, the Margin plan includes a test company: a separate tenant next to your live one where you can try a pipeline, automations or an import without touching real clients. ## Give your team exactly as much access as they need Assign roles, hide cost from those who don’t need it, and open the audit log — everything is already recorded there. Included in the Deals plan — free. ## Next in the chain - [The API covers everything in the interface](https://krokul.com/en/solutions/api/index.md) - [Your data is yours: API, export and rollback from day one](https://krokul.com/en/solutions/data/index.md) - [Dealers place orders themselves, at their own prices](https://krokul.com/en/solutions/portal/index.md) - [Agents and partners register deals themselves](https://krokul.com/en/solutions/agents/index.md) --- App: https://app.krokul.com/ · API: https://app.krokul.com/api/v1/docs