Crm Builder

CRM Builder

How to design a CRM that sales actually uses and that survives an audit — the data model, pipeline definitions, lifecycle logic, scoring, automation, and the privacy/compliance layer most "CRM checklists" skip.

This skill is the design/architecture layer. For platform-specific operational setup (building it inside HubSpot/Salesforce/Pipedrive admin), see the sibling crm-operations. For scoring models in depth see lead-scoring; for nurture/drip flows see email-sequence; for funnel stage strategy see sales-funnel; for forecasting and GTM metrics see revenue-operations. For EU specifics see eu-legal-compliance.

First principle: every field you add is a field a rep must fill, a column you must keep clean, and a piece of personal data you become legally responsible for. Model the minimum that drives a decision or an automation. Adoption dies from data-entry burden, not missing features.

---

1. Pipeline Design — Stages, Entry/Exit Criteria, SLA

A stage is only legitimate if it has an objective, verifiable entry criterion (not "rep feels good"). Vague stages produce garbage forecasts. Max 6–8 stages; more causes confusion and "parking" of deals.

Reference pipelines

B2B SaaS:      Lead → MQL → SQL → Discovery → Demo → Proposal → Negotiation → Closed Won / Closed Lost
B2B Services:  Inquiry → Qualified → Scoping Call → Proposal → Contract Out → Closed Won / Closed Lost
B2C / E-comm:  Visitor → Lead → First Purchase → Repeat → VIP / Churned
PLG / Self-serve: Signup → Activated → Habit → Team Invite → Paid → Expansion

Stage definitions (B2B SaaS) — entry criterion, exit criterion, SLA

| Stage | Entry criterion (objective) | Exit criterion (to advance) | SLA / max age | Default win-prob | |-------|------------------------------|------------------------------|---------------|------------------| | MQL | Hit marketing score threshold OR requested demo | Owner assigned + first touch logged | 1 business day to first touch | 5% | | SQL | Rep confirmed ICP fit + a real problem (BANT/CHAMP qualified) | Discovery call booked | 3 days | 10% | | Discovery | Discovery call held; pain + impact documented | Demo agenda agreed | 7 days | 20% | | Demo | Tailored demo delivered to a decision influencer | Verbal interest + next step set | 7 days | 40% | | Proposal | Pricing/scope sent in writing | Proposal acknowledged + reviewed | 10 days | 60% | | Negotiation | Terms/redlines or procurement engaged | Verbal yes or signature path agreed | 14 days | 80% | | Closed Won | Signed contract / payment | — | — | 100% | | Closed Lost | Explicit no, or no response past SLA | Loss reason required | — | 0% |

Rules of thumb

• Required fields per stage gate advancement (e.g., cannot enter Proposal without deal_amount, close_date, decision_maker). Enforce with required-property-on-stage or validation rules.
• Win probability belongs to the stage, not the rep's gut. Calibrate it quarterly from your own historical conversion rate per stage; don't ship vendor defaults forever.
• One pipeline ≠ one process. Use separate pipelines for New Business, Expansion/Upsell, and Renewals — they have different stages and owners. Don't cram them into one.
• "Closed Lost" always requires a structured loss_reason (picklist, not free text) — it is your most valuable competitive-intel and product feedback dataset.
• Stalled-deal SLA: if days_in_stage > SLA, flag it. This is the single highest-ROI automation (see §5).

---

2. Data Model — Objects & Properties

Model four core objects and their relationships. Resist putting everything on the Contact.

Company (Account)  1 ────1000 emp) → senior AE queue.
3. **Reassign on rep PTO/offline** — *Trigger:* rep set out-of-office. *Actions:* reroute that rep's new inbound to backup; do not reassign open deals.
4. **Inbound-form speed-to-lead** — *Trigger:* high-intent form ("contact sales"/"demo"). *Actions:* page on-call rep immediately (mobile/Slack), 5-minute first-touch SLA. Speed-to-lead is the strongest inbound conversion lever.

**SLA & hygiene**

5. **Stalled-deal alert** — *Trigger:* daily. *Conditions:* deal open AND `days_in_stage > stage_SLA`. *Actions:* task to owner, escalate to manager if 2× SLA. (Highest-ROI automation.)
6. **Empty `next_step` nag** — *Trigger:* daily. *Conditions:* open deal AND `next_step` empty. *Actions:* task owner "set next step."
7. **No-activity re-engagement** — *Trigger:* `last_activity_at > 14d` on an open deal. *Actions:* re-engagement task + suggested email template.
8. **Close-date hygiene** — *Trigger:* daily. *Conditions:* open deal AND `close_date  60d` for a Customer. *Actions:* task CSM, raise `churn_risk = high`.
19. **Win/loss survey** — *Trigger:* deal closed (won OR lost). *Actions:* send short structured survey; pipe results to `loss_reason`/`win_reason` analytics. Lost-deal insight is competitive intel.
20. **Data-decay refresh** — *Trigger:* enrichment field empty or `>180d` old on an active account. *Actions:* re-enrich (only fields you have a lawful basis to hold) and flag bounced emails as invalid.

---

## 6. Data Quality — Dedupe & Migration

### Deduplication strategy

- **Primary keys:** Contact = normalized lowercase `email`; Company = root `domain` (strip `www.`, subdomains, and free-mail domains). Never dedupe companies by name (too fuzzy).
- **Fuzzy matching** for human error: same `email` ≠ exact match when typos exist — also compare `(first_name + last_name + company_domain)` and normalized phone (E.164).
- **Merge precedence:** keep the record with the most engagement history; prefer non-empty, most-recent values field-by-field; never lose a `consent_marketing = opted_in/out` flag in a merge.
- **Prevention beats cleanup:** enforce uniqueness on create (recipe 9), normalize on input, validate email syntax + MX, reject obvious role addresses where inappropriate.

### Migration checklist (switching/consolidating CRMs)

[ ] Inventory source objects, field counts, and record volumes per object. [ ] Map fields source → target (build a mapping spreadsheet; flag type changes). [ ] Normalize before import: emails lowercase, phones E.164, dates ISO-8601, enums to target picklist values. [ ] Dedupe IN the export (don't import dupes). Decide survivorship rules up front. [ ] Preserve associations: contact↔company↔deal↔activity links and owners (map user IDs). [ ] Carry over consent state + timestamps + source — legally required, not optional (§8). [ ] Import order: Companies → Contacts → Deals → Activities → Notes (parents before children). [ ] Dry-run on a 100-record sample; verify associations, owners, picklist mapping, dates. [ ] Full import in batches; reconcile counts (source vs target) per object. [ ] Spot-check 20 records end-to-end. Validate reports/forecasts reproduce. [ ] Freeze the old system read-only; keep an exported archive (per retention policy, §8). [ ] Re-point integrations (forms, billing, marketing, BI) and re-enable automations LAST.

---

## 7. Email & Activity Tracking (privacy-aware)

Sync email/calls/meetings to the timeline — but be honest about what the signals mean in 2026.

- **Email opens are NOT a reliable buying signal.** Apple Mail Privacy Protection (default for Apple Mail users) pre-fetches images, firing a "open" with no human involved; corporate security scanners and Gmail image proxying do the same. Treat opens as **directional aggregate noise**, never as per-contact intent, and never as a scoring trigger or an alert ("they opened it — call now!" is often a false positive).
- **Score on real engagement:** *replies*, link clicks to high-intent pages, demo/meeting bookings, form fills, portal logins. These require intent.
- **Link click tracking** is more reliable than opens but still inflated by URL-defense scanners (Proofpoint, Microsoft Safe Links) that pre-click links — filter known scanner user-agents/IP ranges before trusting clicks.
- **Consent & lawful basis:** logging a contact's emails and recording calls is processing personal data. Within email **automation/outreach**, honor unsubscribe and consent state (§8); don't enroll `opted_out` contacts. For nurture-flow design see `email-sequence`.
- **Call recording requires consent.** Two-party-consent jurisdictions (e.g., many US states like California, and most of the EU) require explicit notice/consent before recording. Play a disclosure, capture consent, and store the consent record. Don't blanket-record across regions without per-jurisdiction rules.
- **BCC/auto-logging caveat:** auto-logging a rep's whole mailbox can ingest personal/third-party emails. Scope logging to known contacts/domains; give reps a way to mark a thread private.

---

## 8. Privacy, Compliance & Security (do not skip)

A CRM is a regulated store of personal data (names, emails, phones, behavior, recordings, enrichment). Bake this in from day one — retrofitting consent and access control after a breach or DPA request is painful. None of this is legal advice; **confirm specifics with counsel**, and see `eu-legal-compliance` for EU detail.

### Lawful basis & consent

- **Establish a lawful basis** for each processing purpose. Under GDPR the common ones are *legitimate interest* (B2B prospecting, with a balancing test + opt-out) and *consent* (newsletters/marketing email in much of the EU under ePrivacy). Document which applies where.
- **Capture consent properly:** store `consent_marketing` *with* timestamp, source/method (form name), and the exact text shown. A boolean alone is not defensible — you must be able to prove *when and how* consent was given. Opt-in must be unticked-by-default in the EU.
- **CAN-SPAM (US) / CASL (Canada):** every marketing email needs a working unsubscribe (honored ≤10 days under CAN-SPAM; immediately is best practice), a physical postal address, and no deceptive headers/subjects. CASL is opt-in for commercial email to Canadian recipients.
- **Suppression list is sacred:** an unsubscribe/`opted_out` flag must survive merges, imports, and re-enrichment, and must suppress the contact across *all* sequences. Test this explicitly.

### Data subject rights (GDPR / CCPA/CPRA)

- Support **access, rectification, erasure ("right to be forgotten"), portability, and opt-out of sale/sharing**. You need a documented, executable process to find every record for a person across objects + integrations and export or delete it within statutory deadlines (GDPR: 1 month; CCPA: 45 days).
- Maintain a **data map / Record of Processing** (what personal data, where, why, retention, who it's shared with — sub-processors like enrichment/email vendors).

### Retention & minimization

- **Don't keep data forever.** Define retention per category (e.g., inactive lead → review/delete after 24–36 months; closed-lost prospect data per policy; recordings shorter). Automate decay/deletion (recipe 20).
- **Minimize PII:** collect only fields that drive a decision or automation. Every extra PII field is added breach surface and DPA-request scope.
- **Enrichment caveat:** third-party data enrichment must have a lawful basis and you must be able to tell a subject the source of their data. Don't silently append data you can't justify.

### Access control & security

- **Role-based access control (RBAC):** reps see their own/team's records; not the whole database. Restrict export rights (mass export = the #1 insider data-exfiltration vector).
- **Field-level permissions:** sensitive fields (revenue, personal notes, recordings, health/financial data) restricted to roles that need them.
- **Audit logs:** enable record-access and change logging; review exports and bulk edits. Required for SOC 2 and useful for incident response.
- **SSO + MFA** on the CRM; deprovision leavers immediately (offboarding checklist) — a former rep with live access is a breach.
- **Data residency:** if you have EU subjects, know where the CRM stores data and whether transfers rely on adequacy/SCCs. Some vendors offer an EU data region — choose it if required.
- **Vendor due diligence:** confirm the CRM and each integration (enrichment, dialer, email) carry SOC 2 Type II / ISO 27001 and sign a DPA before sending production PII.

---

## 9. Reporting & Forecasting

Build these core reports; tie each to a decision someone makes.

- **Pipeline value by stage** (and stage-weighted) — coverage vs quota.
- **Weighted revenue forecast** — Σ (`amount` × stage win-probability) by close month. Calibrate probabilities from your own history (§1), not vendor defaults.
- **Win rate** by source / owner / segment / month — find where you actually win.
- **Sales-cycle length** by stage (where do deals stall?) — feeds your stage SLAs.
- **Stage conversion funnel** (MQL→SQL→Demo→Won) — find the leak.
- **Activity metrics** per rep (calls/emails/meetings) — leading indicator; watch as input, not vanity.
- **Loss-reason analysis** — top reasons drive product/pricing/competitive plays.
- **Cohort retention / NRR** for customers — pull renewal & expansion signal (see `revenue-operations`).
- **Lead-source ROI** — pipeline & revenue by `lead_source`, closing the loop to marketing spend.

For deep forecasting models and RevOps dashboards, see `revenue-operations`.

---

## 10. Tool Selection

All prices **per user/seat per month, as of Jun 2026** — CRM pricing changes often and varies by region/billing cycle/onboarding fees. **Verify live before recommending** at each vendor's pricing page.

| Tool | Best for | Indicative price (verify) | Where it breaks down |
|------|----------|---------------------------|----------------------|
| **HubSpot Sales Hub** | SMB→mid-market wanting marketing+sales in one suite; fast setup | Free tier exists; Starter ~$15–20; Professional ~$100; Enterprise higher. Pro/Enterprise also carry a **mandatory one-time onboarding/Professional Services fee** (often four figures — confirm current amount). Distinguishes **sales seats** vs cheaper **core seats**. | Cost scales fast with seats + contact tiers; non-trivial Pro/Ent onboarding fees; advanced reporting/permissions gated to higher tiers. |
| **Salesforce Sales Cloud** | Mid-market→enterprise, complex processes, heavy customization | Starter Suite ~$25; Pro Suite ~$100; Enterprise ~$175; Unlimited ~$350; AI (Agentforce) tiers higher. List prices are raised periodically — verify current. | Needs admin/implementation budget; total cost ≫ license once add-ons/integration counted; overkill for small teams. |
| **Pipedrive** | SMB sales teams wanting a clean, deal-centric pipeline | Lite ~$14; Growth ~$24–39; Premium ~$49; Ultimate ~$79 (tiers renamed Jul 2025; annual billing). No free tier. | Lighter on marketing/service; automation/reporting limited on low tiers; less suited to complex enterprise process. |
| **Close** | Inside sales / high-volume calling & SMS; SDR teams | Base ~$19; Startup ~$49; Professional ~$99; Enterprise ~$139. Built-in dialer/SMS. | Narrower ecosystem/integrations than HubSpot/Salesforce; less of a marketing/CMS suite. |
| **Notion / Airtable** | Very early stage or custom non-sales workflows | Free–~$20+ | Not a real CRM: no native sequencing, weak dedupe, manual SLAs, no compliance/RBAC tooling — outgrown fast once you have reps + automation needs. |

**Selection criteria (more durable than price):** (1) process complexity & customization needs; (2) need for native marketing/CMS vs sales-only; (3) calling/SMS volume; (4) team size & admin capacity; (5) integration requirements (billing, BI, dialer, enrichment); (6) compliance posture (SOC 2/ISO, DPA, EU data region); (7) realistic *total* cost incl. onboarding/add-ons/implementation — not headline seat price.

> Pricing/plan names shift frequently. Pull current numbers from `hubspot.com/pricing/sales`, `salesforce.com/sales/pricing`, `pipedrive.com/en/pricing`, and `close.com/pricing` before quoting a client.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [san-npm](https://github.com/san-npm)
- **Source:** [san-npm/skills-ws](https://github.com/san-npm/skills-ws)
- **License:** MIT
- **Homepage:** https://skills-ws.vercel.app

Install and usage instructions live in the source repository linked above.