# Evidence request for the CRM admin Send this to the admin when the reading identity cannot see something. Everything here is a definition, a setting, a count or a record ID. Nothing here needs a password, token or key, and nothing here is a list of people. ## Never send - Passwords, API keys, private app or service key tokens, OAuth secrets, refresh tokens, Salesforce auth URLs. - Exports of contacts, leads or users with names, emails, phone numbers or notes. - Screenshots that show a token, a secret field or a person's details. Crop or blur first. If a file you were about to send contains any of these, delete the columns or the image region before sending. ## HubSpot - Export all properties as CSV for contacts, companies, deals and tickets (Settings, Properties). - Export property definition (ZIP) for each critical property we named: owner, lifecycle stage, lead status, consent and subscription fields, billing ID, deal stage, amount. - Export property history for each of those critical properties, with Include Source Information ticked, or permission for us to read it through the Agent CLI under your login (the remote MCP server has no history tool). For identity fields (email, phone, name), replace the value column with a one-way hash or a value token before export, or leave those fields out; we only compare values for equality. - A list of workflow and app IDs with their names (for example `585051946` to "Inbound rotation"), so history sources that show an ID can be matched to the right workflow or app. - Workflow definitions: the Agent CLI `workflows get ` output for every active workflow (not `workflows list`, which has no actions), or one screenshot per active workflow showing enrolment criteria, re-enrolment and every action. - Screenshots: company automation (create and associate companies with contacts, and its exclusions); the Lifecycle Stage tab automation toggles, including "Set lifecycle stage when a deal is won"; each public form's lifecycle and marketing contact settings; the Salesforce integration settings and Sync Health if connected; data sync settings per app (direction, default app, field mappings); the Limits tab; Connected apps; Legacy private apps with creator, last use and the date each token was last rotated; service keys; Users and Teams with the Super Admin column visible and names replaced by role labels; each permission set's View access for contacts, companies and deals (All, Their team's, Their); security settings (two-factor, SSO); account cleanup settings. - Counts we will name, each with its filter: open deals without a company, Customer contacts without a closed-won deal or billing ID, sales-eligible contacts without an owner. ## Salesforce - `sf sobject describe --json` output for Lead, Contact, Account, Opportunity and each custom object in scope. - SOQL results as CSV for: OpportunityStage (closed, won, probability, forecast category), LeadStatus, FlowDefinitionView (with the TriggerOrder and Description columns), DuplicateRule, PermissionSetAssignment for Modify All Data and View All Data (assignee IDs only), OauthToken (app, last used, use count), and field history for the critical fields over 30 days with the `DataType` column (identity fields hashed or left out, as for HubSpot). - Tooling API results as CSV, one file per object: the fields with history tracking on (`FieldDefinition` with `IsFieldHistoryTracked = true`) for each object with critical fields, plus a capture of Field History Tracking in Setup for one of them, and `QualifiedApiName` with `Description` from `FieldDefinition` for each object in scope. - Flow metadata or an Org Check run from a sandbox for every active flow: which fields each flow writes, what it deletes or changes in consent, what it filters on, and its trigger order. - Screenshots: Sharing Settings (organization-wide defaults) and the sharing rules for Account, Opportunity and any object holding restricted records; User Access Summary for each integration user; Field Access Summary for each restricted field; Flow Trigger Explorer for Lead, Contact, Account and Opportunity; System Overview API usage; Connected Apps OAuth Usage; External Client App usage from the Connect REST API; installed packages; lead conversion mapping; the report type and filters behind each headline report. - A user ID to role label map (for example `005XX0000000INT` to `integration:billing-middleware`), so history can be read without names. ## Attio - The list attributes response for each object in scope, and the select options and statuses per attribute. - `list-workspace-members` with access levels, names replaced by role labels. - Historic values with `show_historic` for the critical attributes on a sample of records, with actor types. - Screenshots: plan and billing page, email and calendar sync record creation settings, object and list access levels, installed apps, API token names (never the tokens), webhooks. ## Pipedrive, Zoho CRM, Dynamics 365 - A field list in the generic CSV columns: object, name, label, type, description, options, fill_rate, usages, custom, unique, created_at, writers. - Pipelines or stage definitions with probabilities; automation or workflow lists with each one's on or off state and what it writes, deletes, changes in consent and filters on; roles, permission sets or security roles with member counts; installed apps, connections and tokens by name only. ## Reporting, for every CRM - For each headline number (pipeline value, new customers, the top-of-funnel metric): the dashboard value with its filters, and an export of the record IDs and amounts behind it with the same filters. - The metric definitions from `metrics.md`, or a sentence per metric: counting unit, timestamp, timezone, currency, exclusions. ## Who decides what - Privacy owner: consent writers, legal basis, restricted fields. - Finance: billing truth, currency policy. - Security owner: two-factor, SSO, privileged access. - Metric owner: definitions and exclusions. - CRM admin: everything in the change list, after approval.