Field-Level Data Permissions: Who Can See a Customer's Phone Number
CareSuite can gate visibility of specific fields — a customer's phone number, say — by role, not just gate access to records as a whole. It's easy to underestimate as 'just permissions.'
Most permission systems in SMB software stop at the record level: you can see this customer, or you can't. That's a coarser grain than a lot of real businesses actually need. A field-sales rep might legitimately need to see a customer's order history and location without needing their phone number. A junior support agent might need to view a ticket without seeing the customer's full financial history attached to their profile.
CareSuite goes finer than the record level for exactly this reason. care_sensitive_fields marks specific fields on specific modules as sensitive, and care_sensitive_field_roles defines which roles are allowed to see them. It's a genuinely separate axis from "can this person open this record at all" — a role can have full access to a customer's profile while still being gated from one or two specific fields on it, phone number being the obvious example, but the mechanism applies to any field a workspace decides is worth restricting.
This is easy to file under "just permissions" and move on, but it's a real data-governance feature — the kind of thing usually associated with larger, more expensive enterprise CRMs, not something you'd expect to find at SMB pricing. The instinct to restrict sensitive fields by role rather than by all-or-nothing record access is the right instinct; most tools in this price range simply don't give you the mechanism to act on it.
If your business handles any data that shouldn't be visible to everyone with CRM access by default — customer phone numbers, financial details, anything with a real privacy expectation attached — this is worth setting up deliberately rather than assuming record-level access is granular enough. It usually isn't.