Privacy and preparation
Free-text notes in CRM records: what sales and success notes reveal
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
CRM notes are the main privacy risk in a CRM export because reps write about people, not just accounts. Free-text notes in Salesforce, HubSpot and success platforms often mention health, family events, personal phone numbers and frank opinions about named contacts. Scan notes by pattern, review flagged notes by hand, and remove or exclude sensitive passages before licensing.
Key takeaways
- Structured CRM fields are easy to govern; the free-text notes around them carry most of the sensitive content.
- Health mentions, family events, personal contact details and opinions about named people are the patterns to scan for first.
- Notes hide in tasks, call logs, logged emails, custom long-text fields and success-platform timelines, not only the Notes object.
- Deal reasoning and objection handling are usually the useful part of a note and can often be kept once names are replaced.
- Automated scans find candidates; a reviewer still decides what to remove, generalize or exclude.
What do CRM notes reveal that structured fields do not?#
CRM notes reveal the context that reps and customer success managers had no field for: why a deal stalled, who really decides, and what happened in a buyer's life that week. Fields such as stage, amount and close date describe the account; notes describe the people.
That makes notes both the most useful and the most sensitive part of a CRM history. A licensing reviewer cares about the reasoning in a note, such as an objection and how it was answered, while a privacy reviewer cares about the incidental personal detail that came with it.
B2B companies often assume their CRM holds only business contact data. In practice, a long-tenured sales team writes years of informal commentary, and almost none of it was reviewed when it was written.
Sensitive note patterns to scan for#
Sensitive note patterns fall into a small number of families that recur across Salesforce, HubSpot and customer success platforms. Scanning for families, rather than for every possible word, gives reviewers a queue they can actually work through.
| Pattern | Typical wording in a note | Why it matters |
|---|---|---|
| Health mentions | Out for surgery, back after treatment, on medical leave | Health details about an identifiable person are treated as high-risk in most privacy frameworks. |
| Family and life events | Wife just had a baby, going through a divorce, kid starting college | Personal life details about contacts were never meant to leave the sales team. |
| Personal contact details | Call her cell, use his Gmail, text only after hours | Personal phones and emails identify individuals directly, outside their work role. |
| Opinions about named people | Difficult, not technical, about to be pushed out | Frank judgments about individuals can embarrass or harm them and expose the company. |
| Employment changes | Leaving soon, interviewing elsewhere, part of the layoffs | Career information about contacts is sensitive and was often shared in confidence. |
| Third-party confidential detail | Their budget was cut, they pay a competitor less | Customer and competitor confidences may be covered by contracts or NDAs. |
| Pasted credentials or account data | Login for their admin portal, card details read over the phone | Credentials must be removed and rotated, whatever happens to the license. |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Where notes hide inside the CRM#
Notes hide in many objects beyond the one labeled Notes, so an export that pulls only that object misses most of the free text. Map every long-text field before scanning anything.
Ask the CRM administrator for a field list with data types, then filter for long text and rich text. Old custom fields created by a past sales leader are a common surprise, especially ones with names like Personal or Background.
Check the export route as well as the field list. HubSpot's own guidance says activities such as calls and notes must be exported with a separate method rather than the standard record export, and Salesforce's Data Export Service includes attachments and files only when those options are selected. A scan run on an incomplete export will report a cleaner result than the records deserve.
- Salesforce Notes and Attachments, enhanced notes, and Task and Event description fields.
- HubSpot notes, call logs and meeting outcomes on contact, company and deal timelines.
- Email bodies logged into the CRM by inbox integrations, including forwarded threads.
- Call recording transcripts and AI-generated call summaries attached to activities.
- Custom long-text fields such as champion notes, risk reasons or renewal commentary.
- Customer success platform timelines, health score comments and escalation notes.
- Internal comment feeds, such as Chatter posts on opportunities and accounts.
How to scan CRM notes for sensitive patterns#
Scanning CRM notes works best in layers: pattern matching for contact details, entity detection for names, keyword families for health and life events, and human review of everything flagged. Each layer catches what the others miss.
Start with a sample drawn across owners, teams and years, because note-writing habits vary by person and era. A single rep who logged personal cell numbers for years can produce a large share of the findings, and spotting that early lets you treat that owner's notes as one block.
Automated tools help but do not settle the question. Presidio, an open-source PII toolkit, states in its own documentation that there is no guarantee it will find all sensitive information and that additional systems and protections should be employed. Plan reviewer time for flagged notes and for a random sample of unflagged ones.
Remove, generalize or exclude: deciding note by note#
Each flagged passage gets one of three treatments: remove the sentence, generalize the detail, or exclude the whole note or field. Writing the rules down before review keeps reviewers consistent with each other.
Consistent replacement matters. If the same champion appears as a different placeholder in every note, the account story falls apart; a stable label per person keeps the sequence of events readable.
| Content found | Default treatment | What stays useful |
|---|---|---|
| Personal phone or email | Remove | The fact that the contact preferred a direct channel |
| Contact and colleague names | Replace with consistent role labels | Who held which role and how the deal moved between them |
| Health or family mention | Remove the sentence | The timing effect, such as a decision that was delayed |
| Opinion about a named person | Remove, or exclude the note if the opinion is the point | The objection or risk, stated without the personal judgment |
| Customer confidential terms | Generalize or exclude, per the contract | The negotiation pattern without the figures |
| Free-form personal custom field | Exclude the field entirely | Nothing; these fields rarely carry business reasoning |
Illustrative: a SaaS company reviews years of sales notes#
Illustrative: a fictional B2B software company that sells project management tools to construction firms uses Salesforce for sales and a customer success platform for renewals. A sample scan found personal mobile numbers concentrated in a few long-tenured reps' records, scattered mentions of medical leave, and a custom field called Relationship Notes filled with personal commentary about buyers.
General counsel set three rules. The Relationship Notes field was excluded entirely. Personal contact details and health or family sentences were removed. Names of contacts and employees were replaced with role labels that stayed consistent across each account.
The remaining notes still showed how objections were raised and answered, how at-risk renewals were saved and why some deals were lost. Counsel had a written method and a reviewed sample to rely on before the rights review began.
What privacy counsel will ask about CRM notes#
Privacy counsel will ask which people appear in the notes, where they live, what they were told when their details were collected, and which contracts cover the accounts. The answers decide which laws may apply and how much preparation is enough.
These questions are assessed deal by deal with counsel. Bring the field list, the sample findings and the proposed treatment table, so the review starts from evidence rather than assumptions.
- Do the notes include contacts in the EU or UK, where GDPR may apply even to business contacts?
- Could US state privacy laws such as CCPA apply to the business contact information involved?
- What did the privacy notice say when contacts were added, and has it changed since?
- Do customer agreements or NDAs treat deal discussions as confidential information?
- Have any contacts asked for deletion, and were their notes removed everywhere?
How SourceX handles CRM notes#
SourceX treats CRM notes as part of the Preparation step in the SourceX five-step transaction, after Supply and Rights have confirmed which accounts and fields are in scope. The supplier approves the treatment rules and the sample results before anything is released.
The method, the findings and the approvals are recorded in the privacy record of the SourceX Evidence Packet, so supplier and buyer share the same account of what was removed and why.
Frequently asked questions
Should we just drop all free-text notes from a CRM export?
Dropping all notes is the most cautious option and sometimes the right one, but it removes most of the reasoning that makes a CRM history useful. Many companies keep notes from defined objects, apply removal and replacement rules, and exclude only fields that are mostly personal commentary. Counsel and the business decide together.
Do business contact details count as personal data?
Often, yes. A work email and a name identify a person, and frameworks such as GDPR generally treat them as personal data. In the US, state privacy laws may apply to business contacts in some situations. Whether they apply to your records is a question for counsel, assessed deal by deal.
What about notes that reps wrote about their own colleagues?
Notes sometimes include comments on teammates, such as who mishandled an account or who is underperforming. These raise employee privacy questions and can expose the company if shared. Treat named colleagues like contacts, replacing them with role labels, and remove judgments about individual performance.
Does deleting notes in the live CRM help?
Deleting notes in the live system is a separate decision with its own retention and legal-hold implications, so talk to counsel first. For licensing, preparation happens on an exported copy and the live CRM stays as it is. Editing production records to clean up an export usually creates more problems than it solves.
Can AI-generated call summaries be treated like notes?
Yes, and they deserve the same scan. Call summaries and transcripts attached to activities often repeat personal details from the conversation word for word, including health mentions and personal phone numbers. Their use may also depend on the recording consent given at the time, which counsel will want to check.
Sources
- Presidio's own documentation warns that "because it is using automated detection mechanisms, there is no guarantee that Presidio will find all sensitive information. Consequently, additional systems and protections should be employed." Source
- HubSpot's export-records article says activities such as calls and notes must be exported with a separate method, not the standard record export. Source
- Salesforce's Data Export Service has options to include images, documents and attachments and to include Salesforce Files and CRM Content document versions. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.