Security, Privacy, and Control

Frequently Asked Questions

• Where is HubSpot’s product infrastructure hosted?

  HubSpot’s product infrastructure is hosted on Amazon Web Services (AWS) in the United States East region.
  
  As of July 19, 2021, new HubSpot customers have  the option to store their data in our  EU data center located in Frankfurt, Germany. Existing HubSpot customers can migrate their data to the EU data center using our data migration tool. Learn more about that tool here.

  HubSpot products are hosted with cloud infrastructure providers with SOC 2 Type 2 and ISO 27001 certifications, among others. The certified protections include dedicated security staff, strictly managed physical access control, and video surveillance.

  For more detail, please review our Cloud Infrastructure FAQ page.

• Does HubSpot offer regional data hosting?

  Our customers are increasingly conscious of where their data is processed and stored. Supporting regional data hosting is a priority for HubSpot and something we are working on in order to provide our customers the flexibility to choose where their customer data is stored. 

  As of July 19, 2021 new HubSpot customers have had the option to store their data in our EU data center located in Frankfurt, Germany. Existing HubSpot customers that want to migrate their data to the EU data center can use our data migration tool. Learn how to do that here.

• Does HubSpot have a SOC 2 Type 2 report? A SOC 3 report?

  HubSpot has a publicly available SOC 3 report attesting to our commitment to meeting rigorous industry standards established by the Trust Service Principles (TSPs) established by the American Institute of Certified Public Accountants (AICPA). You can download the SOC3 report in the downloadable reports section above.

  HubSpot also has a confidential SOC 2 Type 2 report attesting to the controls we have in place governing the availability, confidentiality, and security of customer data as they map to the TSPs. We are proud of the excellence of our controls and invite you to download a copy of our SOC 2 Type 2 report (in the downloadable reports section above) if you are a customer or prospect.

• Does HubSpot provide bridge letters for their SOC 2 Type 2?

  Yes, HubSpot does provide bridge letters (in the downloadable reports section above) for customers and prospects.

• What is HubSpot’s uptime commitment?

  HubSpot is committed to ensuring the availability of our systems by using commercially reasonable efforts to meet a service uptime of 99.95% for our Subscription Service in a given calendar month. Please reference Sec. 5 of the Product Specific Terms for more details.

• How does HubSpot encrypt data?

  All sensitive interactions with the HubSpot products (e.g., API calls, login, authenticated sessions to the customer's portal, etc.) are encrypted in-transit with TLS 1.2, or 1.3 and 2,048 bit keys or better. Transport layer security (TLS) is also available by default for customers who host their websites on the HubSpot platform. 

  HubSpot leverages several technologies to ensure stored data is encrypted at rest. The physical and virtualized hard drives used by HubSpot product server instances as well as long-term storage solutions like AWS S3 use AES-256 encryption. User passwords are hashed and are encrypted at rest. Certain email features work by providing an additional level of both at-rest and in-transit encryption.

• Can we modify our own TLS settings?

  As of March 8 2021, the HubSpot app itself will no longer support TLS 1.0 and TLS 1.1. All of our officially supported web browsers support at least TLS 1.2. See our announcement here.

  This change does not affect CMS Hub website pages. Websites hosted on CMS Hub can choose the TLS version to support. We currently support the latest TLS 1.2 and TLS 1.3 cipher suites and encourage customers to use them. Most browsers and SSL clients default to the most secure option automatically.

  Please review this knowledge base article for instructions on SSL and how to choose your TLS version within HubSpot.

• Can we configure our own Security Headers (HSTS, CSP, etc.)?

  For instructions on domain security and security header settings, check out this knowledge base article.

• Can we perform a penetration test against our HubSpot application?

  You are permitted to penetration test the HubSpot products, as long as you adhere to these guidelines and submit any findings to our Bugcrowd program. These guidelines are set so you can effectively test within the security controls we have in place. Submitting into our Bugcrowd program submits directly into our vulnerability management program. 

  Our Acceptable Use Policy requires that if you perform a penetration test, you must do so in an authorized manner. Testing the app within the guidelines we set forth on is what constitutes authorized testing. We recommend using a different IP address for scanning than you use to login to your portal. This mitigates any risk that you may be unable to use your HubSpot portal due to blocks incurred by your tests.

• How do I set up Single Sign On (SSO) and Two Factor Authentication (2FA)?

  The HubSpot products allow users to login to their HubSpot accounts using built-in HubSpot login, “Sign in with Google” login, or Single Sign On (SSO). The built-in login enforces a uniform password policy which requires a minimum of 8 characters and a combination of lower and upper case letters, special characters, whitespace, and numbers. People who use HubSpot’s built-in login cannot change the default password policy.

  The “Sign in with Google” feature is available to all HubSpot customers. More advanced SAML-based SSO integrated with any SAML-based IDP is available with any hub at the enterprise tier level.

  Customers who use an SSO provider can set up SSO-based login for their users. Instructions for setting up SSO are available on this knowledge base article and HubSpot Academy. Single Sign On and Google login users can configure a password policy in their SSO provider or with their Google accounts.

  Customers who use HubSpot’s built-in login are also encouraged to set up two-factor authentication for their HubSpot accounts, and portal administrators can configure their HubSpot portals to ensure that all users have two-factor authentication enabled.

• How do I control & restrict access to the HubSpot application?

  The HubSpot products enforce finely-grained authorization rules for customers. Customers are empowered to create and manage users of their portals and assign the privileges that are appropriate for those users. Please see this knowledge base article for more information about user roles within the HubSpot products.

• How can I go about performing my own backups of my data?

  While HubSpot backs up data on our servers for you, this knowledge base article will tell you how to export your content and data if you’d like to back it up on your own.

• What third-party vendors will have access to my data?

  Please see the Sub-Processors section in our HubSpot Data Processing Agreement.

• What is HubSpot’s cookie policy?

  You can read all about HubSpot’s cookie policy here.

• How do you evaluate the security of the apps in HubSpot’s App Marketplace?

  You can learn all about HubSpot’s App Marketplace certification requirements here, many of which directly relate to security.

• How are my integrations with email protected?

  As a CRM user, you have the ability to connect your Gmail, Office365, or IMAP-enabled email inbox. 

  Gmail and Office365 integrations are authorized by and protected by the native integration capabilities in those platforms.
  
  IMAP integration allows your connected inbox to synchronize mail into your CRM from other mail services. When a user sets up an IMAP integration, the HubSpot products act as an IMAP client. The services that support IMAP integrations have many built-in protections: data is encrypted in transit from end-to-end; the data is encrypted at rest at the field level as well as at the database level; and access controls ensure only authorized access to the data.