Does HubSpot have SOC 2 Type II and other compliance certifications?

Yes. HubSpot's Trust Center provides access to SOC 2 Type II, SOC 3, and other compliance materials. No NDA is required for the SOC 3 report.

Where is customer data hosted?

HubSpot hosts product infrastructure in regional data centers in the US, EU, Canada, and Australia. Paid accounts can migrate to a preferred region. Documentation covers how regional hosting works and the limited cases where processing can occur outside the hosting location.

Can we use our identity provider with HubSpot?

Yes. HubSpot supports SAML-based SSO with major providers including Okta, Azure AD, and OneLogin. Required SSO, user exemptions, and SCIM-based provisioning through Okta are all supported.

Is my data used to train AI models?

Third-party AI providers cannot train their models on HubSpot customer data. Admins can also control whether HubSpot uses account data to improve its own models, and opting out is always available.

Home

Security, privacy, and control for teams that need enterprise confidence

Q: How does HubSpot support GDPR and international data transfers?

HubSpot's Data Processing Agreement covers GDPR terms, subprocessor commitments, breach notification timelines, and international transfer mechanisms including SCCs and the Data Privacy Framework.

Q: Can regulated teams store sensitive data in HubSpot?

Yes. HubSpot supports Sensitive Data and Highly Sensitive Data properties with application-layer encryption, field-level access controls, and audit logging. Additional guidance covers HIPAA-relevant scenarios.

HubSpot helps teams protect data, manage access, support privacy requirements, and validate compliance — with self-serve technical and legal resources your IT, security, and legal teams can review directly.

Get a demo Visit trust center

Built on a Verified Security Program

Independent audits and documented controls your security team can validate.

HubSpot's security program is backed by annual third-party audits, penetration testing, and a formal vulnerability management process. Compliance materials are available in the Trust Center with no NDA required for the SOC 3 report.

HubSpot maintains a formal security program with documented policies, continuous monitoring, and a defined incident response process. Security findings can be submitted through HubSpot's Bugcrowd program. The Security Program page covers HubSpot's overall approach to security, privacy, and control at an executive level.

Data Studio opens the door to behavior-based marketing — triggered by how customers actually use our products.

Steven Weingarth

Senior Global Director of Digital Marketing

Motorola Solutions

Read the full case study

Data Privacy, Residency, and Sensitive Data

Clear documentation on where your data lives, how it's protected, and what controls exist for regulated industries.

HubSpot accounts are hosted in regional data centers across the US, EU, Canada, and Australia. Paid accounts can migrate to a preferred region. The Data Processing Agreement covers GDPR terms, subprocessor commitments, breach notification timelines, and international transfer mechanisms including SCCs and the Data Privacy Framework.

HubSpot supports Sensitive Data and Highly Sensitive Data properties with application-layer encryption, field-level access controls, and audit logging. Super Admins control which users and teams can view or edit sensitive fields. Additional guidance covers HIPAA-relevant scenarios and how sensitive data behaves across forms, workflows, and AI tools.

Enterprise Identity and Access Controls

Centrally manage authentication, provisioning, and permissions across every user, team, and object in HubSpot.

HubSpot supports SAML-based SSO with major identity providers including Okta, Azure AD, and OneLogin. Admins can require SSO for all users with configurable exemptions for continuity planning. SCIM-based provisioning through Okta automates onboarding, role changes, and deprovisioning without manual admin overhead.

HubSpot's permissions model covers users, teams, CRM objects, properties, audit logs, and security settings at a granular level. Super Admins can review and enforce security posture through the Security Center, including 2FA enforcement, inactive user audits, and partner access controls.

With Customer Agent and Service Hub, Sticos finally has the capacity to do real customer success work, and our accountants and auditors get the instant, reliable answers their clients depend on.

Petter Aspås

Customer Success Manager

Sticos

Read the full case study

AI Built on the Same Secure Foundation

HubSpot's AI features run on the same infrastructure and controls as the rest of the platform.

HubSpot's AI runs on the same secure infrastructure as the rest of the platform, with encryption in transit and at rest, ongoing monitoring, and independent audits. Model cards document how each AI feature works, what data it uses, and what safeguards are in place.

Admins manage which data AI features can access and can disable access at the account level. Third-party AI providers are contractually required to meet HubSpot's security and privacy standards. They process data only to deliver the requested feature and cannot train their models on HubSpot customer data. Opting out of HubSpot's own model improvement is always available.

Go deeper on HubSpot’s security and compliance.

HubSpot's Trust Center

Compliance certifications, SOC 2 Type II report, security documentation, and gated materials for IT and legal review.

Visit the trust center

AI Trust & Safety

How HubSpot's AI features handle your data, what controls admins have, and what third-party providers can and cannot do.

Review HubSpot's AI safety

Sensitive Data Management

Field-level encryption, access controls, audit logging, and HIPAA guidance for teams handling regulated data in HubSpot.

Explore our sensitive data feature

Data Hub

HubSpot's data management product for teams that need clean, governed, and connected data across their stack.

Learn more about Data Hub

Set Up Single Sign-on

Configure SAML-based SSO, require it for all users, and set exemptions for continuity planning.

Read our SSO guide

Store Sensitive Data in HubSpot

How sensitive data properties work in practice, including categories, Super Admin controls, HIPAA handling, and application-layer encryption.

Read the guide

Frequently Asked Questions

Get answers to common questions about HubSpot's security and compliance.

See HubSpot's enterprise security in action.

HubSpot gives your IT, security, and legal teams the documentation, controls, and compliance resources they need to evaluate and approve with confidence.

Get a demo Visit the trust center

Generate leads

Automate marketing

Build pipeline

Close deals

Scale support

Drive retention

Create content

Manage content

Find and reach customers

Grow sales and get paid

Organize customer data

Resolve customer queries 24/7

Automate sales prospecting

Research customers faster

Security, privacy, and control for teams that need enterprise confidence

Built on a Verified Security Program

Data Privacy, Residency, and Sensitive Data

Enterprise Identity and Access Controls

AI Built on the Same Secure Foundation