Control who sees what — and prove it.
Most CRMs give you three fixed roles. Xoaro lets you define your own, scope visibility per record, and keeps an audit trail nobody can edit.
- Create your own roles from 163 granular permissions
- Own / team / organization visibility on every module
- Time-boxed per-user exceptions, where deny always wins
- Each company’s data isolated at the database query layer
- An audit log the database itself refuses to alter
- WhatsApp consent enforced on every send path
Roles you define
Build a role from 163 permissions grouped by business area, with a role hierarchy and a permission matrix. You can only ever grant permissions you hold yourself.
Record-level visibility
Each module is scoped to own, team or organization, and the scope is enforced when writing, not only when reading. A record outside your scope returns “not found”, never “forbidden”.
Per-user exceptions
Grant or deny a single permission for one person, with an expiry date. A deny always beats a grant.
Company data isolation
Every organization-scoped table is filtered at the query layer. A conformance test compares the registry against the database schema on every run and fails by name if a new table is ever left unregistered.
An audit trail that cannot be edited
Actions are written to an append-only log that the database enforces with its own triggers — it cannot be updated or deleted, even by an administrator. Permission refusals are recorded too.
Access tester
Ask directly whether a given user may take a given action on a given record, and get the answer with the reason.
Xoaro holds no security certification and publishes no uptime or service-level guarantee. The controls described here are product features, verified in the codebase — not an audited compliance programme.
Bring your entire sales process into one workspace.
Capture leads, stay on top of follow-ups, manage conversations, move opportunities forward and keep payments connected to the deal.
Currently onboarding new teams — we’ll get you set up personally.