A Glossary of Key Terms in Keap Security & Permissions

In today’s fast-paced HR and recruiting landscape, managing sensitive candidate and employee data requires robust security and precise control over who can access what. Keap, a powerful CRM and marketing automation platform, offers various features to safeguard your information, but understanding the nuances of its security and permissions settings is crucial for compliance, data integrity, and operational efficiency. This glossary defines key terms related to Keap’s security architecture, helping HR professionals, recruiters, and operations leaders ensure their critical data is protected and correctly managed.

User Permissions

User Permissions in Keap define the specific actions and data access levels granted to each individual user within your account. This granular control is essential for maintaining data security and operational integrity, especially when multiple team members are accessing sensitive HR and recruiting information. For HR professionals, understanding and correctly assigning these permissions prevents unauthorized access to candidate records, compensation data, or confidential employee information, ensuring compliance with privacy regulations. By meticulously configuring who can view, edit, or delete contacts, opportunities, and custom fields, you mitigate risks associated with data breaches and uphold data privacy standards.

Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a security model where access rights are assigned to roles rather than individual users. In Keap, this means you can create predefined roles (e.g., “Recruiter,” “HR Manager,” “Hiring Coordinator”) and then assign users to those roles. Each role is configured with specific permissions, simplifying user management and enhancing security. For instance, a “Recruiter” role might have access to candidate profiles and hiring pipelines but not sensitive employee compensation data, which would be reserved for the “HR Manager” role. RBAC streamlines the onboarding and offboarding processes, ensuring new hires automatically receive appropriate access and departing employees have their access revoked consistently.

Admin Privileges

Admin Privileges refer to the highest level of access within a Keap account, typically granted to an account owner or designated system administrator. Users with admin privileges have full control over all settings, data, and users, including the ability to add/remove users, change permissions, manage integrations, and access all financial or operational data. In an HR context, the individual with admin privileges holds significant responsibility for data security and compliance. It is crucial to limit the number of users with admin privileges to minimize potential security risks and ensure that only trusted individuals can make sweeping changes to the Keap environment, protecting critical recruiting and employee data.

Data Encryption

Data Encryption is the process of converting data into a coded format to prevent unauthorized access. In Keap, this applies to data both at rest (stored on servers) and in transit (moving between systems). For HR and recruiting teams, data encryption is paramount for protecting highly sensitive information such as personally identifiable information (PII), background check results, and offer letters. Keap employs industry-standard encryption protocols to secure your data, ensuring that even if unauthorized individuals gain access to storage, the data remains unreadable without the correct decryption key. This provides a fundamental layer of security against cyber threats and helps maintain compliance with data protection laws.

API Key Security

API Key Security pertains to the management and protection of API (Application Programming Interface) keys used to connect Keap with other third-party applications or automation platforms like Make.com. An API key acts as a unique identifier and secret token that authenticates requests from external systems. If an API key is compromised, it could grant unauthorized access to your Keap data, including sensitive candidate or employee records. HR teams using integrations for applicant tracking, background checks, or payroll must ensure API keys are stored securely, rotated regularly, and only granted the minimum necessary permissions. Proper API key management is critical for preventing data breaches through integrated systems.

Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA), also known as multi-factor authentication (MFA), adds an extra layer of security to user logins by requiring two distinct forms of identification. Typically, this involves something a user knows (like a password) and something they have (like a code from a mobile app or sent via SMS). For Keap users, enabling 2FA significantly enhances account security, especially for those accessing sensitive HR and recruiting data. Even if a password is stolen or guessed, unauthorized access is prevented because the second factor cannot be provided. 2FA is a fundamental practice recommended for all users to protect against phishing attacks and credential stuffing, safeguarding valuable information.

Audit Trails / Activity Logs

Audit Trails, also referred to as Activity Logs, are comprehensive records of all actions performed within a Keap account, including who did what, when, and from where. These logs track user logins, data modifications, deletions, and administrative changes. For HR and recruiting professionals, audit trails are invaluable for accountability, security monitoring, and compliance. They provide a clear historical record, allowing you to trace any unauthorized data access, identify potential security breaches, or investigate discrepancies in candidate or employee records. By having a detailed log of all system activities, organizations can demonstrate due diligence in data protection and quickly respond to security incidents.

Custom Field Security

Custom Field Security in Keap refers to the ability to control access to specific custom fields, which often hold unique and highly sensitive data for HR and recruiting processes. While standard contact fields might be visible to all, a custom field containing an employee’s performance review notes or salary history requires restricted access. Keap allows administrators to set permissions at the custom field level, ensuring that only authorized roles or users can view or edit this sensitive information. This granular control is essential for maintaining data privacy, preventing inappropriate data exposure, and adhering to internal confidentiality policies, especially when managing diverse data types across different teams.

Data Retention Policies

Data Retention Policies define how long specific types of data, such as candidate applications, employee records, or communication logs, are stored within Keap before being archived or permanently deleted. These policies are critical for HR and recruiting compliance, as various legal and regulatory requirements (e.g., GDPR, CCPA, EEOC guidelines) dictate minimum and maximum retention periods for different data categories. Implementing clear data retention policies within Keap ensures that you are not holding onto sensitive information longer than necessary, reducing privacy risks and storage costs while maintaining auditability for required periods. Automation can be used to manage these processes effectively.

Backup & Recovery

Backup & Recovery strategies involve regularly creating copies of your Keap data and having a plan to restore that data in the event of loss due due to accidental deletion, system errors, or cyberattacks. While Keap has its own robust infrastructure, external backup solutions or strategic automation with platforms like Make.com can provide an additional layer of security, particularly for critical HR and recruiting data. For example, backing up key candidate records or employee onboarding documents to an external cloud storage can be a lifesaver. A well-defined backup and recovery plan minimizes downtime and data loss, ensuring business continuity for essential HR operations and safeguarding irreplaceable information.

Consent Management

Consent Management refers to the process of obtaining, recording, and managing individuals’ explicit permissions for collecting, processing, and storing their personal data within Keap. This is particularly vital for HR and recruiting teams due to stringent privacy regulations like GDPR and CCPA. When collecting candidate applications or employee information, it’s essential to clearly communicate how their data will be used and obtain their verifiable consent. Keap’s features can be configured to track consent status, allowing you to demonstrate compliance and manage communication preferences effectively, ensuring ethical data handling practices and avoiding legal repercussions.

Granular Permissions

Granular Permissions describe the ability to specify very precise and detailed access rights to individual components or functions within Keap, rather than just broad categories. For example, beyond simply giving “edit contact” access, granular permissions might allow a user to edit only specific sections of a contact record, or only contacts within a certain tag or pipeline stage. In HR and recruiting, this level of detail is invaluable for complex team structures. A hiring manager might have full access to their specific requisitions but only read-only access to broader candidate pools, preventing accidental changes and ensuring data integrity while supporting collaborative workflows.

User Session Management

User Session Management involves controlling and monitoring user activity from the moment they log in to Keap until they log out. This includes features like session timeouts, which automatically log users out after a period of inactivity, reducing the risk of unauthorized access if a workstation is left unattended. For HR and recruiting professionals handling confidential data, robust session management is critical. Short session timeouts, combined with secure password policies and 2FA, create a more secure environment, especially in shared office spaces or when accessing Keap from various devices. This prevents lingering open sessions from becoming a vulnerability.

Password Policies

Password Policies are a set of rules and requirements for creating and maintaining user passwords within Keap. These policies typically enforce complexity standards (e.g., minimum length, use of special characters, numbers, uppercase/lowercase letters), prohibit reuse of old passwords, and require periodic password changes. Strong password policies are a foundational element of cybersecurity for HR and recruiting teams, directly impacting the security of sensitive candidate and employee data stored in Keap. By enforcing robust password practices, organizations significantly reduce the risk of unauthorized access due to weak, easily guessed, or compromised credentials, bolstering overall data protection.

Integration Security

Integration Security refers to the measures taken to secure the connections and data exchange between Keap and other external applications (e.g., applicant tracking systems, payroll software, communication tools). When data flows between systems, each integration point represents a potential vulnerability if not properly secured. For HR and recruiting, ensuring integration security means verifying that linked platforms adhere to strong security standards, utilizing secure authentication methods (like OAuth or strong API keys), and encrypting data during transfer. Regularly auditing integrations and limiting the scope of permissions granted to connected apps are vital steps to prevent data leakage and maintain the integrity of your HR tech stack.

If you would like to read more, we recommend this article: Keap Data Loss for HR & Recruiting: Identifying Signs, Preventing Incidents, and Ensuring Rapid Recovery