VendorScore · Data-access posture

Can HubSpot read my data?

Plain-language data-access score from HubSpot Security, Trust, and Sub-Processors pages. AES-256 at rest ≠ HubSpot can’t process your CRM.

Join waitlist for full PDF All vendors

Public documentation review only. Not a pen test. Not legal advice. Evidence dated 2026-10-06.

Clear answer

Yes — HubSpot is designed to process and store your CRM/content data in plaintext on HubSpot systems. Encryption protects outsiders, not HubSpot access.

46 / 100 overall

Scored config: HubSpot CRM platform (paid hubs) with published AES-256 at rest / TLS in transit; AI and feature subprocessors as publicly listed. Evidence 2026-10-06.

Key custody28 Plaintext access28 Encryption claims55 Subprocessors38 Auditability82

Dimension scores

Dimension	Score
Key custody	28
Plaintext access	28
Encryption claims	55
Subprocessors	38
Auditability	82
Overall (equal-weight average)	46

Higher = better customer control / less inherent vendor plaintext access for the scored configuration. Strong compliance ≠ no read access.

Evidence (public)

HubSpot Security Program — AES-256 at rest; TLS 1.2/1.3; HubSpot-managed keys
Sub-Processors page — AWS, Cloudflare, Google, Snowflake + feature/AI processors (OpenAI, etc.)
Trust Center — SOC 2 Type II, SOC 3, pen-test summaries

Caveats

Enabling HubSpot AI, calling/SMS, video, or WhatsApp materially expands third parties that may see content — scores assume a typical marketing/CRM deploy with some features on.
No public employee Lockbox equivalent found in quick public review — unknown fine-grained customer approval gates for support access.
Private SOC findings not reviewed.

FAQ

Can HubSpot read my data?

Yes. HubSpot’s CRM, marketing, CMS, and inbox features require HubSpot to process customer and prospect data server-side. Encryption (AES-256 at rest, TLS in transit) protects against outsiders; it does not prevent HubSpot or listed feature subprocessors from accessing customer data. VendorScore rates HubSpot 46/100 overall (evidence 2026-10-06).

Does HubSpot offer customer-managed encryption keys like Slack EKM?

No public customer-held E2EE or CMK story for CRM objects comparable to Slack EKM or Google CSE was found in HubSpot’s public security docs. Keys are HubSpot/infrastructure-managed.

What does VendorScore’s HubSpot score cover?

Five equal-weight dimensions: key custody (28), plaintext access (28), encryption claims (55), subprocessors (38), and auditability (82). Overall 46. Public documentation review only — not a pen test and not legal advice.

Get the full PDF

Full write-ups with source lists are not for sale yet. Join the waitlist — delivered by email when ready. No Stripe checkout on this page. No calls.

Join waitlist for full PDF