A Glossary of Key Terms in Keap User Roles, Permissions, and Data Access Control
Understanding how to manage user roles, permissions, and data access control within Keap is crucial for HR and recruiting professionals. It ensures data security, maintains compliance, and optimizes workflow efficiency. This glossary defines key terms, offering insights into how proper configuration empowers your team while safeguarding sensitive candidate and employee information. Mastering these concepts allows you to leverage Keap as a powerful, secure tool for your talent acquisition and management strategies.
User Role
A user role in Keap defines a set of permissions and access levels granted to a user within the system. Instead of assigning individual permissions to each user, roles allow administrators to group common access requirements for different positions or functions, such as “Recruiter,” “HR Manager,” or “Hiring Coordinator.” This streamlines user management, ensuring that employees only access the data and functionalities relevant to their responsibilities. For HR and recruiting, defining clear roles is paramount for data privacy (e.g., restricting access to sensitive candidate medical information), operational efficiency (e.g., allowing recruiters to manage their pipelines without altering core system settings), and maintaining compliance with data protection regulations.
Permissions Set
A permissions set is a granular collection of specific access rights that can be assigned to a user role or directly to individual users. These rights dictate what a user can view, create, edit, delete, or export across various modules and records within Keap. Examples include permission to “View Contacts,” “Edit Campaigns,” “Delete Tasks,” or “Export Lists.” For HR professionals, managing permissions sets is vital for implementing a robust data access control strategy. It allows for fine-tuning access, ensuring that only authorized personnel can perform sensitive operations like modifying employee records, accessing compensation data, or initiating bulk communications, thereby preventing unauthorized data breaches or accidental system changes.
Data Access Control (DAC)
Data Access Control (DAC) refers to the overarching mechanisms and policies implemented within Keap to restrict who can access what data. It’s a foundational element of information security, ensuring that sensitive information, such as candidate resumes, interview notes, or employee personal details, is only visible to authorized users. DAC in Keap often combines user roles, permissions sets, and record ownership rules to create a secure environment. For HR and recruiting, effective DAC is not just about security; it’s about compliance with regulations like GDPR, CCPA, and HIPAA, which mandate strict controls over personal data. Properly implemented DAC prevents unauthorized disclosure, maintains data integrity, and builds trust with candidates and employees.
Admin User
An Admin User in Keap possesses the highest level of system privileges, granting them full access to all features, settings, and data. This role typically includes the ability to create and manage other users, define roles and permissions, configure system-wide settings, access all contact records, and run any report. While powerful, this role should be assigned sparingly to ensure the principle of least privilege. For HR and recruiting, an Admin User is usually a high-level manager or an IT administrator responsible for system configuration and data governance. They are critical for setting up the initial Keap environment, onboarding new team members, and ensuring the CRM aligns with the organization’s HR policies and data security standards.
Standard User
A Standard User in Keap typically has limited access, restricted to functionalities and data necessary for their day-to-day operations, but without the ability to modify core system settings or access all records. This role is ideal for most recruiters, hiring managers, or HR generalists who need to manage their contacts, tasks, appointments, and specific campaigns. They can usually create new records, update existing ones they own or are shared with them, and utilize designated reporting tools. For HR teams, assigning the Standard User role ensures that employees can perform their jobs efficiently without the risk of accidentally altering critical system configurations or accessing sensitive data outside their scope of work, thereby enhancing security and operational focus.
Custom Role
A Custom Role in Keap is a user-defined role created by an administrator to meet specific organizational needs that aren’t covered by default roles (like Admin or Standard). This allows for highly tailored permission configurations. Administrators can select a precise combination of permissions from various modules to build a role perfectly suited for a specific job function, such as “Recruiting Coordinator (View Only)” or “HR Payroll Specialist (Restricted Access to Financial Data).” Custom roles are invaluable for HR and recruiting as they enable precise control over who can see and do what, facilitating compliance, reducing security risks, and optimizing workflows by ensuring each team member has exactly the access they need, no more, no less.
Record Ownership
Record ownership in Keap assigns primary responsibility and often default access to a specific user for a particular contact, company, opportunity, or task record. The owner of a record typically has full rights to view, edit, and delete that record, regardless of other user permissions, unless explicitly restricted by more stringent organization-wide sharing rules. For HR and recruiting, record ownership is crucial for managing candidate pipelines, client accounts, or employee profiles. It clarifies accountability, prevents data duplication, and ensures that recruiters or HR managers have direct control over their assigned candidates or cases, promoting efficient follow-up and personalized communication throughout the hiring and onboarding process.
Share Settings
Share settings in Keap allow administrators or record owners to extend access to specific records or groups of records beyond the default ownership and role-based permissions. These settings can be configured to share data with individual users, specific user roles, or even the entire organization. This is particularly useful when collaboration is required on a sensitive candidate profile or an urgent hiring project that involves multiple stakeholders. For HR and recruiting, flexible share settings facilitate teamwork (e.g., sharing a candidate profile with a hiring manager for review) while maintaining control over sensitive data, ensuring that information is only shared on a need-to-know basis and can be revoked when collaboration is no longer required.
Field-Level Security
Field-Level Security (FLS) in Keap allows administrators to restrict access to specific fields within a record, even if a user has general access to the record itself. This means certain sensitive data fields, such as salary expectations, social security numbers, or performance review scores, can be hidden, read-only, or editable only for specific user roles. FLS is a critical component of data privacy and compliance for HR and recruiting. It ensures that while a recruiter might see a candidate’s contact information, they cannot view or edit their compensation history, which might be restricted to HR managers or payroll specialists. Implementing FLS minimizes the risk of unauthorized viewing or modification of sensitive data, reinforcing privacy and data integrity.
API Key Access
API Key Access refers to the granting of permissions to external applications or integration platforms (like Make.com) to interact with Keap’s data and functionalities programmatically. An API (Application Programming Interface) key acts as a secure credential, allowing authorized external systems to retrieve, update, create, or delete data within Keap without direct user login. For HR and recruiting using automation, managing API key access is paramount. It enables powerful integrations, such as automatically syncing candidate data from an ATS to Keap, or updating employee records based on HR system changes. However, it also demands stringent security protocols, as API keys often grant extensive access, and their compromise could lead to significant data breaches or unauthorized system manipulation.
GDPR Compliance
GDPR (General Data Protection Regulation) Compliance refers to adhering to the comprehensive data privacy and security law in the European Union and European Economic Area. For HR and recruiting professionals using Keap, this means meticulously managing candidate and employee personal data, ensuring transparency in data collection, obtaining explicit consent, facilitating data access and deletion requests, and reporting data breaches promptly. Keap’s user roles, permissions, and data access controls are instrumental in achieving GDPR compliance by enabling organizations to restrict access to personal data, implement data retention policies, and demonstrate accountability in processing sensitive information, thereby mitigating legal and reputational risks.
HIPAA Compliance
HIPAA (Health Insurance Portability and Accountability Act) Compliance mandates strict standards for protecting sensitive patient health information (PHI) in the United States. While primarily relevant to healthcare providers, HR and recruiting teams handling health-related employee benefits or medical leave requests must also be vigilant. For organizations subject to HIPAA, Keap’s robust data access controls, field-level security, and audit trails become critical tools. They help ensure that PHI stored within Keap (e.g., in custom fields for employee medical leave) is only accessible to authorized personnel, is encrypted in transit and at rest, and that all access and modifications are logged, thereby preventing unauthorized disclosure and maintaining strict privacy standards required by law.
Audit Trail
An audit trail in Keap is a security log that records all significant activities and changes made within the system, including who performed an action, what action was taken, and when it occurred. This can include login attempts, record creations, updates, deletions, and changes to user permissions or system settings. For HR and recruiting, a comprehensive audit trail is invaluable for accountability, security, and compliance. It provides a clear, unalterable history of data manipulation, which is crucial for investigating security incidents, proving adherence to data privacy regulations (like GDPR or HIPAA), and resolving disputes over data accuracy. It offers transparency into system usage, ensuring integrity and trust in your Keap data.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) is a security enhancement that requires users to provide two or more verification factors to gain access to their Keap account. Beyond a simple password, MFA might require a code from a mobile authenticator app, a fingerprint scan, or a security token. Implementing MFA significantly strengthens security by making it much harder for unauthorized users to access accounts, even if they manage to steal a password. For HR and recruiting, where sensitive candidate and employee data is handled daily, MFA is a non-negotiable best practice. It provides an essential layer of protection against credential theft and phishing attacks, safeguarding your valuable human resources data and ensuring compliance with modern security standards.
Role Hierarchy
While Keap’s native role structure doesn’t always feature a rigid “hierarchy” in the traditional sense, the concept of a role hierarchy can be simulated and managed through careful assignment of user roles and permission sets that reflect an organizational structure. In a true role hierarchy (often found in more complex CRMs), users higher in the hierarchy automatically inherit access to records owned by users below them, simplifying data visibility. In Keap, this is achieved by defining roles with broader permissions for senior staff and narrower ones for junior staff, augmented by sharing rules. For HR and recruiting, understanding this conceptual hierarchy helps design an access structure where HR directors have visibility into all candidate pipelines, while individual recruiters only see their assigned candidates, ensuring appropriate oversight and data segregation.
If you would like to read more, we recommend this article: Keap Notes Reconstruction for HR & Recruiting: Safeguarding Your Data with CRM-Backup
