Audit · guide

Bitrix24: a key instead of exports

Instead of exporting files, the administrator creates a read-only key once — and our program collects what it needs itself.

5 stepsdone by the portal administrator
Read-onlynothing in the portal can be changed
Oncethe key is deleted after the review

Why a key, if there are exports

Stage historyWe see when a deal moved from stage to stage and where clients wait the longest. An export does not contain it.

Time to first responseFrom the calls, emails and chats linked to the lead.

Less personal dataWe do not read your customers' phone numbers and emails at all.

Nothing to sendNo files to export, clean up and pass on.

What is needed on your side

A plan with key accessA paid plan with the Marketplace subscription, or its trial mode (the "My plan" section). On the free plan the key does not work — in that case send file exports instead.

The portal administratorA key sees exactly what the employee who created it sees. With a restricted manager account some deals will be missing from the review, and no error will be shown.

Five steps

Open the webhook"Applications" → "Developer resources" → "Common use cases" → "Other" → "Inbound webhook".
Tick the permissionsCRM is required. The others are in the table below.
SaveThe "Save" button.
Copy the addressThe "Webhook to call REST API" field, in full. It looks like this: https://your-portal.bitrix24.com/rest/1/code/
Pass the address to usThe way we agreed. This address is the key, so do not post it in shared chats.

Permission	What it gives	Needed
CRM (crm)	leads, deals, stage history, activities	required
Telephony (telephony)	call statistics	recommended
Open Channels (imopenlines)	how long a client waited for a reply in chat	recommended
Users (user) and Company structure (department)	names and job titles instead of numbers	recommended

Without the recommended permissions the report will be thinner, and we will say plainly what was missing.

After the review, delete the webhook in the same section — the key stops working. We do not store it: it is needed once, while the data is being read.

What we read and what we do not

The last six months (the period can be changed), plus everything created earlier that is still open.

We read

Leads and deals with your custom fields
Stage history
Activities: calls, emails, meetings, tasks — time, type and owner only
Call statistics: missed calls, unanswered calls, duration
Open Channel conversations — time and message count only
Employees: name, job title, department

We do not read

Customers' phone numbers and email addresses
Email bodies and chat messages
Comments, call recordings and transcripts
Files, addresses, documents

The program reads customer names for one purpose: to remove them from lead and deal titles. Before a language model sees the data, names are replaced with "Client 0001", and a caller's number is replaced with a placeholder at the moment of reading. What is not caught: a name typed into one of your own text fields on a deal.

Where the data is processed and when it is deleted is agreed in writing before you hand over the key.

What happens next

QuestionsThe agent reviews the data and asks your people up to twelve questions — about what the data does not show.
The reportAfter the answers the agent writes the report, and one of us checks it.
The decisionWhat to do with the report is up to you.

The menu path is taken from the Bitrix24 documentation as of October 2026. If an item is named differently in your portal, write to us and we will sort it out together.

This is a review of how the company works, not an audit of financial statements.

Ready to try? Request a free audit: we will reply and agree on how to hand over the data.

Request an audit Sample reports