How to restrict an agent's access to contacts of a specific company

Q: How do I link contacts to a company in the CRM?

In the Contacts module, when creating or editing a contact, you can associate it with a company previously registered in the Companies module. This way, the contact becomes part of that company's database and inherits the configured access restrictions.

To restrict an agent's access to contacts of a specific company in Papo (https://papo.global/), you need to create a custom role that allows access to the Contacts and Companies modules, associate the agent with a dedicated team, and configure the company so that only that team can view its contacts in the CRM.

This configuration is ideal when you need an external agent, a partner, or an outsourced team to access only the data of a corporate client, without seeing contacts from other companies in the database.

Configuration summary

Step	What to do
Custom role	Create a profile that grants access to the Contacts and Companies modules, blocking modules such as Reports, Settings, or Kanban.
Dedicated team	Create a team that will contain only the agents who should view the company.
Company association	In the Companies module, edit the desired company and restrict access to only the created team.
Agent invitation	Invite the agent with the custom role and include them in the dedicated team.
(Optional) Inbox	Link the team to the company's inbox to also limit visible conversations.

How company restriction works in the CRM

Papo organizes access to contacts through teams, roles, and the Companies module. To limit an agent to only see contacts linked to a specific company, you combine these three features:

Custom role – defines which modules the agent can access (e.g., Contacts and Companies, without access to Reports or Settings).
Dedicated team – the agent is placed in a team that will have exclusive access to the company in the CRM.
Restriction in the Companies module – when editing the company, you indicate which teams can view it. Only members of those teams will see the company and, consequently, the contacts linked to it.

Thus, even if there are other companies and contacts in the account, the agent will only see the company for which they are authorized and the contacts associated with it.

Step by step

1. Create a custom role with access to the necessary modules

The custom role controls which platform modules the agent can see. For minimal access focused on contacts of one company:

Go to Settings in the side menu.
Scroll to Custom Roles and click Add custom role.
Give it a name (e.g., "Agent Company X").
In permissions, check only the Contacts and Companies modules. Leave modules such as Reports, Settings, Kanban, or Conversations unchecked, as needed.
Save the role.

Important: The custom role controls module visibility, but it does not restrict which companies or contacts appear within them. The company restriction is done in step 3.

2. Create a dedicated team for the company

Still in Settings, go to the Teams (or Groups) section.
Create a new team with a name that identifies the company (e.g., "Team Client ABC").
Add to the team only the agents who should access the contacts of that company. If the agent does not yet exist in the account, you can invite them later.

3. Restrict access to the company in the Companies module

In the main menu, access the Companies module.
Locate the company whose contacts should be isolated and click to edit.
On the edit screen, look for the Access or Authorized teams section. Select the team created in step 2.
Save the change.

From that moment on, only members of the selected team will be able to view that company and all contacts linked to it in the CRM. Agents from other teams will not see the company or its contacts.

4. Invite the agent with the correct role and team

If the agent is not yet in the account, go to Settings → Agents (or Users) and use the Invite agent option.
In the invitation, select the custom role created in step 1.
After the agent accepts the invitation, access team management and add them to the dedicated team from step 2.

If the agent already exists in the account, edit their profile to change the role and make sure they are only in the desired company's team.

5. (Optional) Also restrict conversations to the company's inbox

So that the agent only sees conversations from the contacts of that company, you can associate the team with a specific inbox:

Go to Settings → Inboxes.
Locate the inbox linked to the company's channel (e.g., corporate WhatsApp).
Click on the inbox Settings and access Collaborators.
Select the team created instead of individual agents.
Save.

This way, the agent will have access only to the company's contacts in the CRM and to conversations that arrive through the designated channel.

Who this configuration is useful for

White label resellers who need to give agents of each end client access only to the contacts of their own company, without exposing data from other clients.
Operations with sensitive data (financial, legal) that require total segregation between companies.
Outsourced teams that work for a specific corporate client and should not access the rest of the database.
Franchises or units that share the same Papo account but need isolation between contacts of each CNPJ.

Frequently asked questions

Can the agent still search for contacts from other companies in the CRM?

No. Since the company is configured to be accessible only by the agent's team, they do not see other companies in the Companies module. Consequently, contacts linked to other companies do not appear for them, even if they use the search in the Contacts module.

Do I need to create a custom role for each company?

No. You can reuse the same custom role for multiple agents, as long as it grants access to the Contacts and Companies modules. The company restriction is done exclusively by associating the team with the company, not by the role.

Can I restrict the agent to one company but allow them to see multiple inboxes?

Yes. The contact restriction by company is independent of inboxes. You can associate the team with multiple inboxes, if desired, without affecting the limitation of contact visibility in the CRM.

What happens if the agent belongs to more than one team?

If the agent is in more than one team, they will see all companies and contacts associated with any of those teams. To maintain isolation, keep the agent in a single team.

Is it possible to limit the agent to only read contacts, without editing?

The custom role allows controlling modules, but granular read/write permissions within a module are not covered by standard roles. For that level of detail, consult the options available directly on the platform.

How do I link contacts to a company in the CRM?

In the Contacts module, when creating or editing a contact, you can associate it with a company previously registered in the Companies module. This way, the contact becomes part of that company's database and inherits the configured access restrictions.

With the first free user, you can already test the contact restriction by company and organize your operation with complete security.