Why your own people are the bigger risk
Your customer database is probably the single most valuable thing your company owns, and the real threat to it isn’t a hacker breaking in from outside — it’s a sales rep with a login. A manager exports the client list on the way out to a competitor. Someone downloads everything right after handing in their notice. A contact forwards the whole base to a personal email “just in case.” None of that trips a firewall, because the access was real. Perimeter security was never built to catch this.
Three layers of protection
1. Least-privilege access
Everyone sees only what their job requires: a rep works their own accounts, not the whole database, and pulling a large export needs a reason attached to it. Roles and permissions live in the CRM and the systems around it, and the default of “everyone can see everything” gets turned off.
2. Anomaly detection, not blanket restrictions
The goal isn’t to lock everyone out — it’s to see who exports what, and how much. Day-to-day activity looks like a handful of records here and there. The warning signs look different: hundreds of contacts pulled at once, a bulk export at 2 a.m., someone downloading the whole archive right before they resign, a base forwarded to an outside address or copied onto a USB drive. A system that flags those patterns catches the leak before it turns into a resignation-day surprise.
3. A trade-secret legal regime
Without a documented trade-secret regime, there’s almost no way to hold anyone accountable for walking off with the database — even if you can prove they did it. With one in place, the data gets real legal protection and employees sign obligations tied to it. That cuts both ways: it discourages people who’d otherwise risk it, and it gives you grounds to act if a leak happens anyway.
What to monitor, and how
| Leak channel | Warning sign | What to do |
|---|---|---|
| CRM export | hundreds of records at once | export limits + anomaly alerts |
| Personal email | the database forwarded outside the company | logging + attachment detection |
| USB drives | a drive plugged in, bulk copying | removable-media control |
| Pre-resignation downloads | activity spike from someone about to leave | tighter monitoring on the at-risk group |
How CorpShield handles this
Building all of this by hand isn’t realistic for a mid-sized company — it’s normally the kind of thing that needs its own security team. Stitex CorpShield covers it turnkey: it logs access to the data, AI flags the anomalies (bulk exports, pre-resignation downloads, USB drives plugged in), sends alerts a manager can actually read without a glossary, and helps you put a trade-secret regime in place with the right paperwork. No dedicated security hire required to run it.
FAQ
Can’t we just block exports from the CRM?
A blanket export ban breaks the job — reps need to pull lists, build reports, make calls. The point isn’t to block everyone, it’s to see who exports what and how much, and catch the outliers (hundreds of contacts at once, a download right before someone resigns) instead of stopping legitimate work.
Is it even legal to monitor employees like this?
Monitoring work activity on company devices and in corporate systems is legal once employees are notified and a formal trade-secret regime is in place. In Russia that regime rests on Federal Law 98-FZ, and any personal data involved falls under Russia’s data-protection law (152-FZ) — broadly comparable to GDPR-style consent and notice requirements elsewhere. We help set this up correctly, and it doesn’t touch personal devices or private messages. Check the specifics for your jurisdiction with your own counsel — this is an overview, not legal advice.
We don’t have a security team. Can we actually run this?
That’s exactly who CorpShield is built for. It deploys turnkey, AI does the anomaly-spotting, and you get plain alerts instead of a stream of raw logs to interpret. No dedicated analyst required.