Configure HubSpot security in the admin UI V2.6

01Use this scope

Treat this as a UI hardening guide, not a live portal audit.

Scope guard

Use this as a generic HubSpot hardening resource. Validate settings in the target portal before making changes.

This resource covers controls visible in HubSpot account settings, security settings, connected apps, files, audit logs, data management, AI settings, approvals, and sandboxes.

It does not replace a penetration test, an ISO 27001 control mapping, an external log ingestion design, or a portal-specific access review. It gives the baseline an administrator should use before those activities.

Where the wording says to use, review, require, or restrict a setting, that is Kongo hardening guidance based on HubSpot controls. It is not quoted HubSpot product documentation.

Identity Data access Apps Audit evidence

02Start here

Set the first-pass controls before migration or go-live.

Baseline

Priority	Control	Harden in HubSpot	Why it matters
Critical	Require SSO and strong second factor	Settings > Security > Login. Require SSO where available, reduce allowed login methods, prefer passkeys or authenticator apps, and keep one break-glass Super Admin exempt from SSO.	Reduces account takeover risk and gives the identity provider a central enforcement point.
Critical	Restrict administrative access	Settings > Security > Permissions and Settings > Users & Teams. Reduce Super Admins, partner Super Admins, unused users, critical permissions, and export permissions.	Most HubSpot security incidents start with excessive access rather than a missing feature.
High	Limit logins by network and location	Settings > Security > Login. Configure allowed login IPs and allowed login locations where the operating model supports it.	These controls reduce login risk for users. Integration access requires controls in the connected app or middleware.
High	Protect sensitive fields	Settings > Security > Sensitive Data and Settings > Data Management > Properties. Mark sensitive properties at creation, restrict view and edit access, and use click-to-decrypt for highly sensitive values.	Structured sensitive data needs both encryption and least-privilege visibility.
High	Control exports	Settings > Approvals > CRM data exports, Settings > Users & Teams, and Settings > Data Management > Import & Export. Require export approvals, restrict export permissions, and set large export notifications for every Super Admin.	Reduces unapproved CRM data movement through exports.
High	Review connected apps	Connected Apps > Connections home, Connections insights, Notifications, and Private Apps. Review owners, installers, scopes, app status, last activity, API usage, and app notifications.	Connectors are a high-value path for data movement and privilege drift.
Standard	Set AI governance	Settings > Account Management > AI > Access and user permissions. Decide which AI features and data access controls are allowed. Disable AI Model Training unless approved.	AI settings are account-wide and should match organisational policy.
Operational	Create audit evidence	Settings > Account Management > Audit Log, Import & Export, Connected Apps, and Backup & Restore. Export evidence before audit windows and after major configuration changes.	Audit readiness depends on an evidence routine, not only on enabled settings.

03Harden access

Make the identity perimeter explicit.

Login and users

Area	Where to configure	Hardening action	Evidence to capture
SSO	Settings > Security > Login	Enable SSO and require users to log in through the identity provider. Keep at least one Super Admin exempt for emergency access.	Screenshot of SSO status, SSO enforcement, and exempt break-glass users.
Login methods	Settings > Security > Login > Portal Login Settings	Disable login methods that are not approved by the organisation, such as password or social login where SSO is mandatory. Set an enforcement date before go-live.	Allowed method list and enforcement date.
2FA	Settings > Security > Login	Allow passkeys or authenticator apps as preferred methods. Avoid SMS as the default where policy permits.	Approved 2FA method screenshot.
Network access	Settings > Security > Login	Use allowed login IP addresses for admin and internal user populations with predictable networks. Use allowed login locations where it fits the workforce model.	IP and location policy record.
Session control	Settings > Security > Login and General > Security	Set session timeout to match policy. Ask privileged users to review active sessions after role changes, device changes, and incident response.	Session timeout and privileged-user session review record.
HubSpot employee access	Settings > Security > Login	Review whether HubSpot employee access is allowed or blocked. Export employee access history when required for audit evidence.	Employee access setting and access history export.
Security Health	Settings > Security > Permissions	Resolve flagged inactive users, missing 2FA, excessive critical permissions, excessive Super Admin access, and partner Super Admin access.	Before and after Security Health screenshots.
Inactive users	Settings > Security > Permissions > Inactive users	Use automatic deactivation for users inactive for more than 90 days, unless an exception is documented.	Inactive user policy and deactivation report.
SCIM	Settings > Users & Teams and identity provider	Provision users through SCIM where available. Build permission sets first, then map identity provider roles exactly to those sets.	SCIM mapping and permission-set mapping.

04Limit data access

Use teams, permission sets, and field controls together.

Least privilege

HubSpot hardening works best when access is designed as a model. Use teams for ownership, permission sets for roles, record access for objects, pipeline restrictions for sales and service process boundaries, and property restrictions for sensitive fields.

Surface	Where to configure	Hardening action	Note
Permission sets	Settings > Users & Teams > Permission sets	Create role-based permission sets for administrators, sales leaders, sellers, marketing users, service users, integration users, and read-only auditors.	Use permission sets to standardise access. Assigning a permission set overrides individual user permissions.
Teams	Settings > Users & Teams > Teams	Model business units, regions, or restricted work groups. Use parent and child teams only when access inheritance is intended.	This is the foundation for team-owned CRM record access.
CRM records	Settings > Users & Teams > Permissions	Set view, edit, and delete permissions by owned records, team-owned records, or all records. Restrict sensitive objects and custom objects first.	Use record access for data segregation where the portal must separate regions, practices, or protected accounts.
Pipelines	Settings > Objects > Deals, Tickets, or Custom Objects > Pipelines	Limit access to pipelines and stages that map to restricted processes, delivery work, or confidential opportunities.	Pipeline access is useful when sensitive work is process-bound rather than object-bound.
Properties	Settings > Data Management > Properties	Restrict view and edit access for sensitive properties. Review the Property Access and Sensitive Data columns regularly.	Do not use property restrictions as a security boundary. HubSpot states that all users can set or edit restricted properties through the API or when manually creating a record.
Assets	Asset settings > Manage access	Limit access to CRM views, inboxes, templates, sequences, documents, pipelines, files, campaigns, dashboards, reports, domains, forms, workflows, and other supported assets.	Super Admins can still access restricted assets, so keep Super Admin count low.

Design rule

Do not use property restrictions as the only control for regulated data. Pair them with sensitive data settings, app-scope review, export approvals, workflow controls, and user permission reviews.

05Protect sensitive data

Classify the data before it lands in HubSpot.

Sensitive data

Control	Where to configure	Hardening action	Operational note
Sensitive Data Protection	Settings > Security > Sensitive Data	Enable only after confirming categories, business need, downstream tools, and contractual obligations.	Turning this on changes the account's data model and tool behaviour. Treat it as a governance decision.
Sensitive properties	Settings > Data Management > Properties > Create property	Mark sensitivity at property creation. Use Highly Sensitive Data for values that need click-to-decrypt behaviour.	Existing sensitivity cannot always be changed later. Decide during data modelling.
Field visibility	Property access and permission sets	Limit view and edit access to roles with a documented need. Review Super Admin exceptions separately.	Click-to-decrypt events should appear in audit evidence for sensitive-value access.
Unstructured data scan	Settings > Security > Sensitive Data > Sensitive Data Scan	Run the scan after migration, then every 30 days. Move the next scan after a material import when needed.	Each scan covers CRM activities from the previous 60 days. Each account can run one scan every 30 days. Redaction is permanent.
Attachments and files	Content > Files and CRM records	Do not store sensitive information in the Files tool. Use private CRM attachments or an approved external repository for sensitive files.	HubSpot states files uploaded to the files tool are public CDN assets by default and not designed for sensitive information.
Notifications and previews	Notifications and Sensitive Data settings	Confirm whether notifications expose previews of sensitive values. Disable previews where policy requires it.	Sensitive Data accounts hide some previews by default, but the evidence should be verified in the portal.

06Control data movement

Control exports, file visibility, and sensitive data exposure.

Data movement

HubSpot provides separate controls for CRM exports, large export notifications, file visibility, sensitive fields, and redaction of some values in activity data. Use them together because no single UI setting covers every data-loss scenario.

Risk	Where to configure	Hardening action	Limit
Bulk CRM export	Settings > Approvals > CRM data exports	Require approval for exports above a record threshold and for exports containing sensitive data. Remove Export without approval except for documented roles.	Where available, HubSpot labels export approvals Beta. Confirm availability before making this control part of the approval process.
Silent large export	Settings > Data Management > Import & Export	Set a large export notification threshold for each Super Admin.	Each Super Admin configures their own threshold, up to 275,000 records. Export approver permission does not allow threshold configuration.
Historical exports	Settings > Data Management > Import & Export > Export Audit	Review source, records exported, user, date, and download history where available.	Completed export files can be downloaded for 30 days. Sensitive-data exports may not show download history.
Public file exposure	Content > Files > File detail > File URL visibility	Review Public, Public noindex, and Private visibility. Set expiry dates where available. Move sensitive files out of public file storage.	Review file visibility independently from CRM record access.
Over-shared folders	Content > Files > Actions > Manage access	Restrict file and folder access to teams with a business need.	Access restrictions control who can manage files in HubSpot, not whether a public URL already exists.
Unstructured sensitive values	Settings > Security > Sensitive Data > Sensitive Data Scan	Scan CRM activities and redact values after review when regulated data appears in notes, calls, emails, or other activities.	Redaction is permanent. Review matches before approving redaction.

07Review apps

Treat connected apps as part of the security boundary.

Connected apps

Admin surface	Where to configure	Hardening action	Security answer
Connections home	Connected Apps > Connections home	Review app status, installed date, installed by, last activity date, and apps installed by other users. Reconnect or remove apps with expired connections.	Gives a practical inventory for connector ownership and health.
Connections insights	Connected Apps > Connections insights	Review app installations, removals, owner changes, data-sync changes, user app adoption, and API call usage where available.	Shows app ownership, change history, and recent activity. App logs may not record every API operation.
App notifications	Connected Apps > Notifications	Create notifications for app install, app disconnect, and app uninstall events. Review Connected Apps status separately for app health issues.	Turns connector change events into an operational signal.
Private apps	Settings > Integrations > Private Apps	Use the smallest possible scopes, name owners, document business purpose, and remove unused private apps.	Private app scopes define what the token can access through APIs.
Integration access	HubSpot login settings and integration architecture	Use HubSpot login IP restrictions for user access. Apply integration network controls in the connected platform, middleware, or API gateway when supported.	Login IP restrictions do not automatically govern app-to-app traffic.
External log ingestion	Audit Log exports, APIs, or middleware	Plan how Audit Log events, exports, app changes, and middleware logs reach the organisation's logging platform.	Confirm supported ingestion methods against current HubSpot and platform documentation. Use middleware where no supported connector is available.

Connected app rule

Every connected app should have an accountable owner, a documented business purpose, reviewed scopes, recent activity evidence, and a removal path. Do not let an integration remain owned by a departing user.

08Audit changes

Build evidence packs from the logs administrators already have.

Traceability

Evidence area	Where to review	Use it for	Suggested view or filter
Account Audit Log	Settings > Account Management > Audit Log	User actions, account changes, admin changes, integrations, sandboxes, exports, security activity, and selected sensitive-data activity.	All Logs, Login History, and Security Activity. The current UI covers up to 365 days and opens filtered to Last 30 days. Confirm the available range, then widen the filter before export.
Login history	Audit Log > Login History	Login success, login failure, SSO changes, 2FA changes, and suspected account takeover review.	Filter by user, date, source, and action.
Security activity	Audit Log > Security Activity	Super Admin changes, permission changes, exports, integration changes, permanent delete, and sandbox events.	Export before and after permission changes.
Export audit	Settings > Data Management > Import & Export	Evidence of data export source, exported record count, user, and date.	Monthly export review and pre-audit evidence export.
Connected app activity	Connected Apps > Connections insights	App installs, removals, reconnects, owner changes, and data-sync setting changes.	Filter by all activities, all users, and all apps during review windows.
Restore events	Backup & Restore and Audit Log	Evidence of CRM restore actions and rollback activity.	Capture preview, approval, execution, and post-restore audit event.

09Control AI

Decide which data AI can use before users discover the toggles.

AI governance

Control	Where to configure	Hardening action	Evidence
AI feature access	Settings > Account Management > AI > Access	Decide whether generative AI tools are allowed across the account. Document the reason and approval owner.	AI Access screenshot and approval record. Context Home manages contextual information, not these access controls.
CRM data	Settings > Account Management > AI > Access	CRM data access defaults on. Turn it off unless the organisation accepts CRM data use in HubSpot AI features.	AI data-source settings.
Conversation data	Settings > Account Management > AI > Access	Customer conversation data access defaults on. Turn it off unless approved for support, sales, and personal context.	Conversation-data setting and policy note.
Files data	Settings > Account Management > AI > Access	Files data access defaults off. Keep it off unless file storage has been reviewed for sensitive and public assets.	Files-data setting and Files review outcome.
Breeze Assistant	Settings > Account Management > AI > Access and Users & Teams permissions	Breeze Assistant access defaults on. Turn it off unless approved, then restrict access to authorised roles.	Permission set and AI access mapping.
AI Model Training	Settings > Account Management > AI > Access	AI Model Training defaults on. Turn it off unless legal and security approve it. Sensitive Data accounts are opted out and cannot opt in.	AI Model Training setting and change log.
External AI connectors	Connected Apps and user permissions	Review external AI connectors as connected apps. Confirm each connector's documented permission model and whether user-level access can be revoked centrally.	Connector inventory, scopes, and owner review.

10Back up data

Separate CRM data recovery from full portal configuration recovery.

Recovery

Need	Where to configure	Hardening action	Limit to explain
Scheduled CRM backup	Settings > Data Management > Backup & Restore	Schedule recurring backups where available. Download and store backups outside HubSpot in approved storage.	Backups include supported records and property values. They exclude associations and activity data. They are not a portal configuration backup.
Secure backup handling	Backup download process	Treat backup files as sensitive, because sensitive property values may be included. Restrict who can create, download, and store backups.	Download each completed backup within 14 days.
Rollback recent CRM changes	Backup & Restore > Restore	Use Restore CRM changes to preview and roll back supported CRM changes from the previous 14 days.	Use this for supported CRM data changes, not as a universal undo button.
Deleted records	Recycle bin or record restore flow	Restore deleted HubSpot-defined and custom object records within 90 days of deletion.	Permanent deletes and GDPR deletes are not restorable.
Restore rehearsal	Sandbox and Backup & Restore	Test the restore workflow and document who can approve, execute, and verify restore actions.	Audit readiness improves when restore has been rehearsed before an incident.

11Control change

Use sandboxes and approvals to reduce configuration risk.

Change control

Control	Where to configure	Hardening action	Security note
Standard sandbox	Settings > Account Management > Sandboxes	Create a standard sandbox in HubSpot settings or with `hs sandbox create` for configuration, integration, workflow, and user acceptance testing.	Sensitive Data properties are unavailable in sandboxes. Treat copied records as unmasked data and restrict access.
Sandbox data	Create sandbox flow	Limit who can access sandboxes. Confirm whether copied records are acceptable for testing.	Sandbox data may be real and unmasked. Do not treat sandbox as low-risk just because outbound email and calling are limited.
Sandbox deployment	Sandboxes > Set up a deploy	Deploy supported assets from sandbox to production after review. Capture the deployment record and audit log.	Deploy tools move supported assets, not CRM contact or company data.
Sandbox lifecycle	Sandboxes > Activity Log	Delete and recreate sandboxes when a fresh copy of production is needed. Review activity logs for creation, deletion, and deployment.	The HubSpot CLI can create standard and development sandboxes. It prompts for the sandbox type.
Approvals	Settings > Account Management > Approvals	Configure approvals for web content, marketing assets, quotes, deal pipeline progression, and data exports where available.	Use approvals for changes that affect customers, regulated communications, or material data movement.

12Set privacy

Align HubSpot privacy settings with the data governance model.

Privacy

Control	Where to configure	Hardening action	Evidence
Data privacy settings	Settings > Privacy & Consent > Setup	Turn on data privacy settings where the portal handles personal data subject to privacy obligations.	Setting status and policy decision.
Consent options	Settings > Privacy & Consent > Consent options	Configure lawful basis, consent text, and subscription handling before forms and marketing go live.	Consent configuration export or screenshots.
Cookies	Settings > Privacy & Consent > Cookies	Configure cookie tracking settings and banners by domain, region, and policy requirement.	Published banner settings.
Data hosting	Settings > Privacy & Consent > Data Hosting	Confirm the account's data centre region and migration requirements before customer rollout.	Data hosting region evidence.
Data Request Manager	Settings > Account Management > Privacy & Consent > Data Request Manager	Assign, review, and action privacy requests inside HubSpot.	Request owner, due date, and completion evidence.
Retention policy	Settings > Account Management > Privacy & Consent > Setup > Privacy tools	Configure Delete inactive contacts automatically only after business, legal, and reporting review.	The default inactivity period is 365 days. Deleted contacts remain restorable for 90 days.

13Run cadence

Turn hardening into a recurring admin routine.

Operations

Cadence	Review	Owner	Output
Weekly	Security Health, failed logins, new Super Admins, app status issues, expired app connections, and failed integration jobs.	HubSpot platform owner	Short weekly admin note with exceptions.
Monthly	Inactive users, partner users, permission changes, export audit, large exports, connected app activity, AI settings, and backup completion.	CRM admin and security delegate	Monthly security evidence pack.
Quarterly	Permission sets, teams, record access, property access, file visibility, private app scopes, privacy settings, sandbox access, and approval rules.	Security, RevOps, and business application owner	Access review and remediation log.
Before migration	Data classification, sensitive property model, export permissions, app inventory, AI data sources, privacy setup, and file-storage approach.	Project team and security	Go-live security sign-off.
Before audit	Audit Log exports, Security Health screenshots, permission-set export, app inventory, export audit, backup evidence, and sandbox activity.	Security delegate	Audit evidence pack.

14Name limits

Be plain about what the UI does not solve by itself.

Caveats

01

Use several controls for data movement

HubSpot separates export approvals, export logs, file visibility, sensitive fields, audit logs, and redaction scanning. No single UI setting covers every data-loss scenario.

Approvals, Import & Export, Sensitive Data, Files

02

Control integration traffic outside login settings

HubSpot login IP restrictions apply to users. Apply integration restrictions in the connected app, middleware, API gateway, or target system.

Security > Login, Connected Apps

03

Property access is not complete isolation

Property view and edit controls are useful, but HubSpot warns they should not be treated as the only security boundary. Review APIs, workflows, forms, imports, and app scopes as well.

Properties, Users & Teams, Private Apps

04

Files require a separate review

HubSpot files can be public by default. CRM attachments are different. Sensitive documents should use an approved private storage pattern.

Content > Files

05

Understand backup coverage

Backup and restore support specific CRM data and restore windows. They do not provide full configuration rollback for every HubSpot tool.

Backup & Restore

06

Restrict access to sandbox data

A sandbox is isolated, but copied data may still be real and unmasked. Limit access according to its testing purpose.

Sandboxes

07

Plan external log ingestion

Audit exports and app logs can support evidence collection. Automated ingestion into an external logging platform requires an integration design.

Audit Log, Connected Apps, middleware

15Use sources

Base the resource on HubSpot documentation and verified UI surfaces.

References

The recommendations below use HubSpot's public documentation and read-only checks of current HubSpot admin UI surfaces. Validate availability in the target portal because beta enrolment and account configuration can change what administrators see.