Logo - Full (Color)

Security, privacy, and control for teams that need enterprise confidence

HubSpot helps teams protect data, manage access, support privacy requirements, and validate compliance — with self-serve technical and legal resources your IT, security, and legal teams can review directly.

Built on a Verified Security Program

Independent audits and documented controls your security team can validate.

HubSpot's security program is backed by annual third-party audits, penetration testing, and a formal vulnerability management process. Compliance materials are available in the Trust Center with no NDA required for the SOC 3 report.
Data security settings

HubSpot maintains a formal security program with documented policies, continuous monitoring, and a defined incident response process. Security findings can be submitted through HubSpot's Bugcrowd program. The Security Program page covers HubSpot's overall approach to security, privacy, and control at an executive level.
Data security settings
Steven Weingarth

Data Studio opens the door to behavior-based marketing — triggered by how customers actually use our products.

Steven Weingarth

Senior Global Director of Digital Marketing

Motorola Solutions

Data Privacy, Residency, and Sensitive Data

Clear documentation on where your data lives, how it's protected, and what controls exist for regulated industries.

HubSpot accounts are hosted in regional data centers across the US, EU, Canada, and Australia. Paid accounts can migrate to a preferred region. The Data Processing Agreement covers GDPR terms, subprocessor commitments, breach notification timelines, and international transfer mechanisms including SCCs and the Data Privacy Framework.
Data Privacy Settings

HubSpot supports Sensitive Data and Highly Sensitive Data properties with application-layer encryption, field-level access controls, and audit logging. Super Admins control which users and teams can view or edit sensitive fields. Additional guidance covers HIPAA-relevant scenarios and how sensitive data behaves across forms, workflows, and AI tools.
Data Privacy Settings
Data Privacy Settings

Enterprise Identity and Access Controls

Centrally manage authentication, provisioning, and permissions across every user, team, and object in HubSpot.

HubSpot supports SAML-based SSO with major identity providers including Okta, Azure AD, and OneLogin. Admins can require SSO for all users with configurable exemptions for continuity planning. SCIM-based provisioning through Okta automates onboarding, role changes, and deprovisioning without manual admin overhead.

Sensitive Data Login Rules

HubSpot's permissions model covers users, teams, CRM objects, properties, audit logs, and security settings at a granular level. Super Admins can review and enforce security posture through the Security Center, including 2FA enforcement, inactive user audits, and partner access controls.
Sensitive Data Login Rules
Petter Aspås

With Customer Agent and Service Hub, Sticos finally has the capacity to do real customer success work, and our accountants and auditors get the instant, reliable answers their clients depend on.

Petter Aspås

Customer Success Manager

Sticos

AI Built on the Same Secure Foundation

HubSpot's AI features run on the same infrastructure and controls as the rest of the platform.

HubSpot's AI runs on the same secure infrastructure as the rest of the platform, with encryption in transit and at rest, ongoing monitoring, and independent audits. Model cards document how each AI feature works, what data it uses, and what safeguards are in place.

Breeze - Automation controls

Admins manage which data AI features can access and can disable access at the account level. Third-party AI providers are contractually required to meet HubSpot's security and privacy standards. They process data only to deliver the requested feature and cannot train their models on HubSpot customer data. Opting out of HubSpot's own model improvement is always available.

Breeze - Automation controls
Breeze - Automation controls

Go deeper on HubSpot’s security and compliance.

HS_Pictograms_Web Search

HubSpot's Trust Center

Compliance certifications, SOC 2 Type II report, security documentation, and gated materials for IT and legal review.
HS_Pictograms_Chat Bot-1

AI Trust & Safety

How HubSpot's AI features handle your data, what controls admins have, and what third-party providers can and cannot do.
HS_Pictograms_Security

Sensitive Data Management

Field-level encryption, access controls, audit logging, and HIPAA guidance for teams handling regulated data in HubSpot.
HS_Pictograms_Data Sync

Data Hub

HubSpot's data management product for teams that need clean, governed, and connected data across their stack.
HS_Pictograms_Solutions

Set Up Single Sign-on

Configure SAML-based SSO, require it for all users, and set exemptions for continuity planning.
HS_Pictograms_Payments1

Store Sensitive Data in HubSpot

How sensitive data properties work in practice, including categories, Super Admin controls, HIPAA handling, and application-layer encryption.

Frequently Asked Questions

Get answers to common questions about HubSpot's security and compliance.

Yes. HubSpot's Trust Center provides access to SOC 2 Type II, SOC 3, and other compliance materials. No NDA is required for the SOC 3 report.

HubSpot hosts product infrastructure in regional data centers in the US, EU, Canada, and Australia. Paid accounts can migrate to a preferred region. Documentation covers how regional hosting works and the limited cases where processing can occur outside the hosting location.

Yes. HubSpot supports SAML-based SSO with major providers including Okta, Azure AD, and OneLogin. Required SSO, user exemptions, and SCIM-based provisioning through Okta are all supported.

HubSpot's Data Processing Agreement covers GDPR terms, subprocessor commitments, breach notification timelines, and international transfer mechanisms including SCCs and the Data Privacy Framework.

Yes. HubSpot supports Sensitive Data and Highly Sensitive Data properties with application-layer encryption, field-level access controls, and audit logging. Additional guidance covers HIPAA-relevant scenarios.

Third-party AI providers cannot train their models on HubSpot customer data. Admins can also control whether HubSpot uses account data to improve its own models, and opting out is always available.

See HubSpot's enterprise security in action.

HubSpot gives your IT, security, and legal teams the documentation, controls, and compliance resources they need to evaluate and approve with confidence.