Some records need a smaller audience: a person receiving support, a major donor’s private details, or a safeguarding case. Relationships lets you limit who can see an individual contact, or every record filed under a subtype. This page explains what a restricted record looks like and how to set restrictions.

What you see when a record is restricted

  • The whole record is withheld. The profile shows only the name and ID, a grey panel explaining that the record is restricted, badges naming the teams and people who do have access, and the line “Ask one of the people or teams above if you need access to this record.”
  • Part of the record is withheld. The rest of the profile loads, but a section such as Details, Connections or Communications consent shows the same grey panel in place of its contents.
  • In lists and search results, records you can’t see are left out altogether.
  • Related records follow the contact: if you can’t see a contact, you can’t see things about them either, such as their recurring payments.

Every attempt to open a contact, including refused ones, is recorded in its Audit log (“Attempted to open this record (access refused)”) for people with the audit:read:entity permission.

How a contact’s audience is decided

Three layers apply, in this order:

  1. Allowed teams and individuals. When you add a contact in the app, it’s automatically limited to you and the teams you belong to, plus anyone you add under Access control in the Add a contact form. This is why new contacts show a red Restricted badge. If you’re named here you can see the record even when the layers below would hide it, unless a strict subtype applies.
  2. Access scope. Fundraising limits the record to members of fundraising teams, Programme to programme teams, and Shared to both. If you don’t choose one, it’s worked out from the contact’s classification: donors are Fundraising, beneficiaries Programme, and contacts who are both, or neither, are Shared.
  3. Subtype restrictions. An administrator can restrict a subtype so only named teams and people see records carrying it.

Change who can see a contact

Before you start, you need relationships:manage_contact_access and relationships:write:contacts.

  1. Open the contact and choose Edit.
  2. Go to Access control.
  3. Choose an Access scope, or clear it for No restriction from this layer.
  4. Add or remove teams under Allowed teams and people under Allowed individuals.
  5. Choose Save changes.

Take care when narrowing access: once saved, anyone you remove loses sight of the record straight away, including in search. A team counts as a fundraising or programme team according to its team type, which can’t be set from the Settings pages, so check with your administrator before choosing Fundraising or Programme.

Restrict a whole subtype

Use this for a classification where every record needs the same small audience. You need relationships:admin:settings.

  1. Open Relationships → Configuration → Subtypes and choose the Contacts, Organisations or Resources tab.
  2. Select the lock icon (Restrict access) beside the subtype.
  3. Choose Allowed teams and Allowed individuals. Leave both empty for no restriction.
  4. Turn on Prevent per-record overrides when a per-record grant must never widen access, for example for safeguarding.
  5. Choose Save. The subtype now shows a Restricted badge.

A record is visible to anyone who can see any one of its subtypes. If it also carries an unrestricted subtype, including the system Uncategorised subtype, the restriction won’t apply to it, so remove the other subtypes from records that must stay restricted.

Use an alias for a restricted contact

On a contact with a Restricted badge, choose Create alias to replace their name throughout the app with a generated codename (an adjective and an animal). Their real name is still shown on their profile in a box marked “Actual name — verification only, not searchable”, and the profile shows an ALIAS badge. Regenerate gives a new codename and Remove alias shows the real name again; neither can be undone.