VendorScore · CRM · Data-access posture
A plain-language answer from HubSpot's public Security, Trust and Sub-Processors pages. Encryption at rest doesn't stop HubSpot from reading the data.
Get the full 5-dimension PDF — join the waitlistEvidence dated 2026-10-06, public docs only, not legal advice.
Short answer
Yes. HubSpot is designed to process and store your CRM and content data in plaintext on HubSpot systems. Encryption protects against outsiders; it doesn't stop HubSpot, or the subprocessors behind features you enable, from accessing customer data.
Scored configuration: HubSpot CRM platform (paid hubs) with published AES-256 at rest and TLS in transit, and AI/feature subprocessors as publicly listed.
Higher = more customer control / less inherent vendor read access for the scored configuration. A strong SOC 2 doesn't mean the vendor can't read your data.
Stored data is encrypted at rest with AES-256 and in transit with TLS 1.2/1.3, using HubSpot/infrastructure-managed keys. There's no public customer-held key option for CRM objects comparable to Slack EKM or Google CSE.
Evidence: HubSpot Security ProgramHubSpot's Sub-Processors page lists infrastructure providers plus many feature-specific processors (e.g. OpenAI, Google AI, Twilio) that can access Customer Data when those features are used.
Evidence: HubSpot Sub-ProcessorsOur report flags these gaps in HubSpot's public documentation:
Get the full 5-dimension PDF — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Yes. HubSpot is designed to process and store your CRM and content data in plaintext on HubSpot systems. Encryption protects against outsiders; it doesn't stop HubSpot, or the subprocessors behind features you enable, from accessing customer data. VendorScore rates HubSpot 46/100 overall from public documentation (evidence dated 2026-10-06). Scored configuration: HubSpot CRM platform (paid hubs) with published AES-256 at rest and TLS in transit, and AI/feature subprocessors as publicly listed.
Yes, but HubSpot holds the keys. Data is encrypted at rest with AES-256 and in transit with TLS 1.2/1.3, which protects against outsiders. HubSpot itself still processes CRM data in plaintext. HubSpot's public security docs don't describe a customer-held key (BYOK) option for CRM records.
Yes, a subset can. HubSpot's DPA says: "A subset of our employees have access to the products and to customer data via controlled interfaces." Reasons it lists include customer support, product development and research, troubleshooting and security response, with logged just-in-time access requests. VendorScore found no public customer approval gate (a Lockbox equivalent) for support access.
Yes, unless you opt out. HubSpot's knowledge base says: "HubSpot may use customer data, as defined in the HubSpot Customer Terms of Service, to train and improve HubSpot’s own AI models." Super Admins can switch off AI Model Training in AI settings; accounts with Sensitive Data turned on are opted out by default. HubSpot says third-party AI providers may not train on customer data, and previously used data can't be deleted from trained models.
VendorScore doesn't certify compliance; HubSpot publishes a DPA at https://legal.hubspot.com/dpa. The DPA references the EU Standard Contractual Clauses, and HubSpot says it uses the EU-U.S. Data Privacy Framework and SCCs to transfer data from the EU to the US.
HubSpot's public Sub-Processors page lists infrastructure providers (AWS, Cloudflare, Google, Snowflake) plus feature processors like OpenAI, Google AI and Twilio that can access Customer Data when those features are used. Turning on AI, calling/SMS, video or WhatsApp expands the list. The list is published at https://legal.hubspot.com/sub-processors-page.
Yes, HubSpot can host your account in the EU. It says its infrastructure runs on AWS in the US, Canada, Australia and the European Union (Germany), and customer data is processed and stored in the account's data center location. Starter, Professional and Enterprise accounts can change data center. HubSpot staff may still access data from other regions for support and development.
Every URL cited on this page. Score and key findings: VendorScore report (hubspot.md), evidence dated 2026-10-06. FAQ policy links: vendor pages re-checked 2026-10-07.