How can we help? How can we help?
  1. Box+Dice Help Centre
  2. Settings
  3. Staff

Data Theft - Data and Access Restrictions

Developers Universal Developers Universal

Summary

Learn how to detect and prevent potential data theft in your CRM using Auto Alerts and Access Restriction. These tools help administrators or directors monitor suspicious user activity and automatically block access when necessary.

This article covers:

Overview

Automated Access Restriction is part of the Data Theft Prevention suite, designed to protect sensitive CRM data from misuse. This feature helps administrators detect suspicious behavior—such as rapid pagination through contact or listing records and automatically restrict access to prevent data theft.

This feature suite helps protect sensitive information, such as contact, appraisal, or listing data, from being transferred to another agency or shared with competitors.

You can select between two restriction types:

1. Data Restriction

🔹 Limits access to records on the Contact Search, Appraisal and Listing Search screens.
Once applied, the user will only be able to see a limited number of records and results on those screens.

2. Access Restriction

🔹 Immediately logs the user out of the system. Access must then be reinstated by an administrator.
Once triggered, the user is automatically signed out of both the web app and Agent App, and their access is temporarily disabled until restored by an administrator.

Set up an auto alert

Before applying restrictions, use Auto Alerts to monitor behavior and determine appropriate thresholds.

To set up auto alerts:

  • Go to: Settings > CRM > Data Theft Restrictions
  • Set the Number of Pages (e.g., 5)
  • Enter Time Frame (seconds) (e.g., 20)
  • Click Save, then
  • Go to: Settings > Automations > Auto Alerts
  • Click +Add
  • Enter the auto alert name to Data Theft Auto Alert 
  • Select Staff as the Category
  • Set the Trigger to Data Theft Auto Alert Configured
  • Select the Action (e.g., Task)
  • Assign it to an admin or manager

With this, If an agent views five contact pages in 20 seconds at 11 PM, the Auto Alert triggers, notifying the administrator to review the activity.

Tip: Use Auto Alerts to observe behavior and avoid false positives before enforcing restrictions.

Apply automated access restriction

Once you’ve identified a reliable threshold, apply the Access Restriction to automatically log out users who trigger it.

To set up access restriction:

  • Go to: Settings > CRM > Data Theft Restrictions
  • Scroll to Apply Automated Data or Access Restrictions
  • Tick Access Restrictions
  • Enter the same parameters used in the Auto Alert (e.g., 5 pages in 20 seconds)
  • Add a custom message that displays to the user when they’re locked out (e.g., “Access restricted. Please contact Mr. Smith, your administrator.”)
  • Click Save
Note: When triggered, the user is logged out of both the web app and Agent App. Access must be reinstated manually by an administrator.

Manually apply or remove restrictions

Admins can also manually restrict users for example, when someone is leaving the business or has shown risky behaviour.

To manually restrict a user:

  • Go to: Settings > CRM > Data Theft Restrictions
  • Scroll to Access Restriction Configurations
  • Search the user to the restricted list
  • Click Save

This prevents them from viewing or exporting sensitive data (contacts, appraisals, listings, etc.).

To restore access:

  • Go to: Settings > CRM > Data Theft Restrictions
  • Scroll to Access Restriction Configurations
  • Tick the X beside the user's name
  • Click Save

Automated Access Restriction adds an extra layer of protection for your agency’s data by detecting suspicious behaviour in real time and taking immediate action.

By combining Auto Alerts for monitoring with Access Restrictions for enforcement, you can reduce the risk of data theft, maintain compliance, and safeguard your clients’ information — without interrupting normal day-to-day operations.

Articles in this section