Access Control in Group and Professional Editions

Both GE and PE do not support custom profiles or field level security. As a result, field level security is also handled by the page layout for each object. Therefore, when a customer installs your app they will not be able to define which profiles have access to what and you will need to ensure that your design works for the Standard User Profile. Permission sets can be installed in GE/PE orgs but not updated.

Because field level security is handled by the page layout, any fields you want to be visible must be added to the page layout. This means that for fields to be accessible via the API or Visualforce, they must be added to the page layout.