Who should see a customer’s phone number? Designing permissions for a calling team

Every calling business has the same quiet fear and almost nobody says it out loud: an agent leaves, and the list leaves with them. Not stolen in any dramatic sense — photographed, screenshotted, exported to a sheet “to work from home”, or simply saved to a personal phone over eight unremarkable months.

The list is usually the most valuable thing the company owns and the easiest thing to copy. And the awkward part is that the people best placed to copy it are the people who must be able to see it, because you are paying them to call it.

There is no setting that resolves that tension. What there is, is a set of deliberate trade-offs. Each one costs the team something real, and each buys something real. The mistake is not choosing wrongly — it is choosing by default and finding out later what you chose.

The number itself: full, masked, or hidden

The central control is what an agent sees where the phone number should be. LumaKol offers three settings, and the crucial point — the one that makes the decision much easier than people expect — is that calling works in all three.

Managers always see the full number regardless, because someone has to be able to answer “what number did we actually call?” when a customer complains.

What masking does not do, and you should know this before you turn it on

Masking hides numbers in LumaKol. It cannot hide them from the phone.

When an agent taps Call, the app hands the real number to the phone’s own dialler — that is what placing a call means. So during the call the full number is on the in-call screen, and afterwards it is in the phone’s Recents, in both cases put there by the operating system and entirely outside any app’s control. On a SIM-based CRM this is not an oversight that could be fixed: reading the device call log is precisely how calls get captured without anyone logging them by hand. The number has to be there.

So an agent on a masked workspace can obtain any single number by calling it and then looking at their own screen. Anyone who tells you otherwise is selling something.

What masking actually buys is therefore narrower than it first appears — and still worth having. It changes harvesting from a scroll into a phone call. Copying four hundred numbers stops being ten minutes with a second phone and becomes four hundred calls: slow, audible, recorded as attempts against each lead, and visible in the by-agent report as a person whose call volume suddenly makes no sense. You have not made the list impossible to take. You have made taking it expensive and conspicuous, which for most businesses is the realistic goal.

One asymmetry worth knowing: on the web portal the masking is enforced by the server, so an agent’s browser never receives the full number at all. On the phone it cannot be, because the device needs the number in order to dial it. If your worry is a laptop and a copy-paste, masking is a hard control. If it is a phone, it is a speed bump.

The other costs are ordinary but real. An agent cannot tell a colleague “call this one, she is asking for you”. They cannot check a number against a message on their own WhatsApp. And there is a cultural cost that appears in no log: masking says, visibly and every day, that the company expects the list to walk. In a team of six who have worked together for years, that can cost more than the risk it prevents. In a team of forty with monthly churn, it does not.

Recordings: coaching material or surveillance archive

Call recordings are the single best coaching asset a calling team has, and the single most sensitive thing it stores. Both are true at once.

There are two settings: recordings available to owners, admins and team leads only, or to everyone including agents listening to their own calls.

The managers-only option is the conservative default and it is defensible. But before choosing it, consider what the second option actually is. An agent listening to their own calls is the fastest self-improvement loop in sales — people hear things about their own delivery in thirty seconds that a manager could spend a month failing to explain. Restricting recordings entirely to managers turns a learning tool into an evidence file, and teams notice the difference in tone immediately.

Note that the permissive setting is still narrow: agents get their own calls, not each other’s. Nobody can browse a colleague’s conversations.

Whichever you pick, this is the control with the heaviest legal weight attached — consent and notification obligations differ by country and are not solved by a permission setting. That is a separate subject with its own rules, and worth getting right before you worry about who can press play.

Export is the control that actually protects the list

If you change one thing after reading this, change this one.

Masking makes copying numbers slow. It does nothing whatsoever about the person who exports fourteen thousand leads to a spreadsheet in one click. Export is the bulk channel, and bulk is the entire risk — one careless export is worth a year of calling numbers to read them off a screen.

So decide explicitly which roles can export leads, and make the list short. Owners and admins is a reasonable answer for most companies. Team leads, maybe. Agents, rarely — an agent needs to call their leads, not to hold a copy of them.

Exports are written to the audit trail, which is the other half of the control and the half people underrate. Deterrence works when it is known: a team that knows exports are logged behaves differently from one that assumes nobody is watching, and the log is what turns “we think something happened in March” into a date and a name.

Screenshot blocking, and being honest about it

You can block screenshots on lead screens in the mobile app. On Android the capture is genuinely blocked by the operating system; on iOS, which provides no equivalent, the app shows a warning instead.

It is worth being clear-eyed about what this achieves. It stops casual copying — the agent who screenshots a lead to send to a friend, the habit of keeping a photo album of good leads. It does not stop a determined person, who owns a second phone and a camera, and no software anywhere will.

That is not an argument against it. Most data loss is casual rather than determined, and removing the one-tap path removes most of the volume. Just do not count it as protection against someone who has decided to take your list; count it as a reduction in the number of copies that exist by accident.

Permissions start with roles, not settings

Before any of the above, there is the question of what each person is. LumaKol has six roles, and the two structural facts worth knowing are that agents and team leads occupy paid seats while owners, admins, billing admins and viewers are free up to a limit — and that a team lead sees the leads of everyone in the teams they lead.

That second fact is where most over-permissioning happens. Teams are a visibility structure as much as a reporting one. Putting every agent under one team lead “for simplicity” gives that person the whole database; splitting the same people into three teams gives each lead a third of it. Nothing in the settings screens will warn you about this, and it is a bigger decision than any toggle on the privacy page.

The other quiet one is the viewer role. It costs no seat, which makes it easy to hand out to a consultant, an investor, an agency, a relative who is helping with reports. Free is not the same as harmless. Count your viewers once a quarter.

The day someone leaves

Every control above is about steady state. The risk is concentrated in a single day, and it is usually the day handled worst — because the person has already gone, and the admin task feels like paperwork.

Deactivating a member signs them out everywhere and frees their seat. Do it the same day, before their leads are reassigned, not after — reassignment can wait an hour; an active session cannot.

Then do the part almost nobody does: look at the security log for their last fortnight, and at the export history. Not because you suspect them, but because the only way to know whether your controls work is to check them when it matters. A team that has never once read its own audit trail does not have an audit trail; it has a table.

Sensible defaults, by size

1. Under ten people, low churn: full numbers, recordings open to agents for their own calls, export limited to owners and admins. Trust is cheaper than friction at this size and the friction is more expensive than you think.
2. Ten to forty, some churn: masked numbers for the first three months of a new agent’s tenure, recordings open to agents for their own calls, export limited to owners and admins, screenshot blocking on. Review teams so no single lead sees the whole book.
3. Large or high churn, or regulated data: masked or hidden, recordings to managers only, export to owners only, screenshot blocking on, and a standing quarterly review of who holds which role — including viewers.