Noah
I have shared the general logic of what you ought to do to be safe.
I overlooked the point you made that this code is on a private member page. So assuming that the page can only be loaded by members then currentUser._id will get you a unique id and you don’t really need to check logged in status because the page shouldn’t load otherwise. Never hurts to check though.
One other point to note. Every user will have an entry in the crm database and that is accessed using the same user id.
The crm data collection already provides for a company name and company email address so it may pay to use this instead.
You will always get a crm record. Then all you need to do is update the company info as requested.