My question involves business law in the state of: IL

We are based out of the Chicagoland area. We have a salesmen in Arizona. He is having his wife reply to customer inquiries for him, access our CRM system (customer database) and manage his travel details.

I am not comfortable with her working basically as an agent of the company even though the owner said she could. Is there some sort of legal advice we should purse to make sure we are covered? Having access to our customer database (no banking information, only public contact information and correspondence between the two companies) and employee's email account makes me uncomfortable but should some sort of NDA or contract be signed by both parties saying she has permission to act as an agent of the company, can not disclose customer details etc. be signed?

Suggestions?