Security & Access
Prerak gives admins fine-grained control over who can see and change what, plus enterprise identity and auditing controls.
Access control
Where to find it: Settings → Access control.
Govern access through preset roles, team-based visibility, permission sets, and field-level policies. This is where you decide, at a granular level, who can view and edit which records and fields.
A permission set is a list of grants, each one an object + an action + a scope ("whose records"). A grant that isn't in the set is denied — there is no explicit "deny", so removing a capability means deleting its rule.
Note: The Contacts module is stored internally under the permission key
people, which is what the API expects in objectType=people. The editor
displays it as Contacts everywhere.
Import and export permissions
Import and Export are their own actions, independent of Create, View and Edit. Someone who can view every contact cannot export them unless you also grant Contacts · Export, and someone who can create contacts one at a time cannot bulk-load a CSV without Contacts · Import.
| Object | Import | Export |
|---|---|---|
| Contacts | CSV/Excel upload, preview, mapping, rollback, replay, import history and error reports | Full CSV export, column selection, GDPR subject export |
| Companies | CSV/Excel upload, preview, mapping, rollback, replay, import history and error reports, sample template | Direct CSV export and the queued Export… jobs, including re-downloading a past run |
| Deals | CSV upload via Settings → Deal import, plus its job history and error reports | — |
| Forms | — | Submission export |
| Tickets | — | Service-analytics export |
Two things worth knowing:
- Import history counts as Import, not View. A job's error report replays the rejected rows of the uploaded file, so reading it hands back the source data.
- Re-downloading a finished export needs Export. The queued company export keeps each run for re-download, and every step of that job — queueing it, listing runs, fetching one, downloading the file — asks for Export.
In the UI, an import or export entry point is hidden when the permission is missing rather than failing after you have picked a file. The backend enforces the same permission regardless, so a direct API call is refused with a 403.
Exports that are not object permissions
Three exports are workspace owner/admin operations and sit outside object permissions, because they span the whole workspace rather than one object:
- Audit log export (Settings → Audit log)
- Analytics/metrics export
- Privacy request export packages (Settings → Privacy & compliance)
Granting Contacts · Export does not grant these, and revoking it does not remove them.
Identity and single sign-on
Where to find it: Settings → Identity & access.
Configure SSO/SAML, SCIM provisioning, MFA, and session controls for the whole workspace — so team access is managed centrally through your identity provider.
Personal two-factor authentication
Where to find it: Settings → Security.
Individual users manage their own two-factor authentication and account security here.
Audit log
Where to find it: Settings → Audit log.
An immutable, exportable record of critical workspace changes — for security reviews and compliance reporting.
Territories
Where to find it: Settings → Territories.
Define territory hierarchies, assign team members, set routing rules, and roll up forecasts along your territory structure.
Tip: Combine access-control roles with territories so reps see the accounts and deals in their patch — and nothing they shouldn't.