crm
What To Ask Any System Before You Put Your Customers In It
Five questions that decide whether you can leave a CRM later, asked while the answers are cheap and the sales team is still returning calls.
The decision that locks a small business into the wrong system is almost never the purchase. It is the eleven months of data entry after it, and by then the question has stopped being "is this the right tool" and become "can we face moving".
The questions that prevent that are all askable in the first week, and all of them have the useful property that a vendor who cannot answer plainly has told you something.
1. Can I get everything out, and what does "everything" mean
Every vendor says yes. The follow-up is the real question: get a sample export, before you sign, and look at what is in it.
What is usually in the export: contacts, companies, deals, maybe notes.
What is usually not: file attachments, call recordings, the activity timeline, custom field definitions, and the mapping between a note and the record it belonged to. A CSV of contacts with a column of orphaned note text is not your history. It is the index of your history with the pages removed.
Ask for a full export of a demo account containing one customer with a quote, three notes, two attachments and a completed job. Open it. If the attachments are not in it, the attachments are not yours in any practical sense.
2. Who can read it, and how do I see who did
Not the marketing answer about encryption. Two specific things.
Can you set what each person on your team can see, at the granularity you actually need? A subcontractor who needs today's job address should not necessarily be able to export your whole customer list on their last day.
Is there a log of who looked at and changed what, and can you read it yourself without asking support? This matters most at exactly the moment it is hardest to arrange: after somebody leaves.
The FTC's data security guidance for business is written for exactly this size of company and is blunt about the two controls that prevent most real incidents: limit who can access what, and know when access changes.
3. What happens if I stop paying
Read the answer in the terms, not from the salesperson.
Three questions with real consequences. How long is the data retained after cancellation? Is the account readable during that window or locked immediately? Is an export possible after you stop paying, or only before?
A system that locks the account on the day the card fails, and offers export only to active subscribers, has arranged things so that an interrupted payment costs you your records. That is a business model, and it is one to know about going in.
4. Where does the customer's data actually go
For a contractor with a few hundred customers this is less dramatic than it sounds, and still worth five minutes.
Does the tool send data to anything else by default? Analytics, a marketing platform, an AI feature that processes your notes, a partner integration switched on out of the box. The question is not whether that is sinister. It is whether you know, because you are the one who told the customer what happens to their information.
The related question is what the vendor does with it. Aggregate usage statistics are normal. Training on the content of your customer notes is a different thing and should be a setting you chose rather than a default you inherited.
5. What does it do when it does not know
This one is not about data, and it predicts more about daily life with a tool than the other four combined.
Give the system something ambiguous. A duplicate-looking contact. A payment that does not match an invoice. A required field you genuinely cannot fill.
Well-built software says what is wrong and what to do. Badly built software either refuses with a generic error or, much worse, accepts the input and quietly does something unexpected with it. The second behaviour is the one that produces data you cannot trust six months later, and you can detect it in a ten-minute trial.
The small version for people who will not do all five
If you do one thing: get a real export of a realistic record, before you commit, and open it.
Everything else on this list is a judgment call about risk you may reasonably take. That one is a fact you can check, it takes fifteen minutes, and it is the one that decides whether the decision you are making today is reversible.
Keeping your own copy is worth the same fifteen minutes on a schedule. A quarterly export, stored somewhere you control, is the simplest possible insurance against every scenario above, including the ones nobody writes guidance about. CISA's Secure Our World material covers the basics of keeping that copy safe once you have it, which is the other half of the job.