Does your organization use HubSpot? One sensor, and Openwake watches it on its own: the documents re-read daily, every moved clause told.Start free
Trains on customer data
Training posture: does not train
for the product and account type the quoted document covers
“Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.”
Opt-out mechanism
none described
Not stated in the documents we could read. An absence here is an unknown, not a no.
AI features
present
“When you use our products and services we may process personal data to develop, support, and improve HubSpot AI features and to train our AI models and similar products and services that rely on machine learning.”
Model providers named
Replicate
“Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary instance. All databases are backed up and maintained using at least industry standard methods.”
Retention
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Hosting regions
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Subprocessor notice
30 days
“We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
Downstream
Who's behind HubSpot, as listed in its own subprocessor documents. 13 subprocessors.
Model providers
- Replicateunstated
Hyperscalers
- Amazon Web Servicesunstated
- Google Cloudunstated
Other subprocessors
- Clearbitunstated
- Cloudflareunstated
- Driftunstated
- Dropboxunstated
- Gainsightunstated
- Oktaunstated
- Salesforceunstated
- Salesloftunstated
- Snowflakeunstated
- Stripeunstated
Reviewer notes
Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'.
Documents read
- privacy policy https://legal.hubspot.com/privacy-policyHTTP 200 · 2026-10-13
- dpa https://legal.hubspot.com/dpaHTTP 200 · 2026-10-13
- subprocessors https://trust.hubspot.com/legal/subprocessorsHTTP 200 · 2026-10-22
Document changes
- medium 2026-10-22 · subprocessors +3 / −0 lines
show diff
+ Oct 22, 2026, 02:54 UTC+ HUBSPOT UPDATE ON PHP VULNERABILITY+ HubSpot is aware of the recently disclosed PHP security vulnerability. PHP is not part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes. - medium 2026-10-13 · subprocessors +0 / −19 lines
show diff
− 42 Documents− SOC 1 Type II− SOC 2 Type II− EU Cloud Code of Conduct− TRUSTe Certified Privacy− KNOWLEDGE BASE FAQS263− Access Management− Application and Data Security− Cloud Security− Continuity and Disaster Recovery− Device Management− Incident Management− Network Security− Personnel Security− Physical Security - low 2026-10-13 · dpa +0 / −1 lines
show diff
− Scroll Left Scroll Right - low 2026-10-13 · privacy policy +0 / −1 lines
show diff
− Scroll Left Scroll Right - low 2026-09-17 · dpa +1 / −1 lines
show diff
+ Last Modified: September 16, 2026− Last Modified: April 14, 2026 - high 2026-09-17 · privacy policy +16 / −14 lines
show diff
+ Last Modified: September 16, 2026+ (iii) Internet or network information, such as browsing and search history. We collect this information directly from your device or from emails sent through our platform.+ 10.1 Google reCAPTCHA. We have implemented Google reCAPTCHA Enterprise on our websites and products for security, fraud, and abuse prevention.+ 10.3 Google Maps Integration. We use the Google Maps API to provide address autocompletion and validation to provide our products and services to you. When you use features powered by Google Maps, information you enter such as address inputs may be transmitted to Google to provide these features. Google processes this data as an independent data controller under its own privacy policy and the Google Maps/Google Earth Additional Terms of Service.+ 10.4 Gmail Integration. If you use the Gmail integration or choose to integrate any other Google Workspace application with HubSpot, you will be asked to give us access to information from your Gmail or Google account.+ 10.5 Google Calendar Integration. The Subscription Service will have access to both your Google Calendar and any other calendar you access via Google in order to power our Meetings tool, and allow you to associate events with contacts in your HubSpot account. The Subscription Service will have the ability to: create or change your calendars, and update individual calendar events.+ 10.6 Google Drive Integration. As part of connecting your Google Drive, the Subscription Service will be able to: see your documents, sheets, and slides, upload and download your documents, sheets, and slides, and store contents and titles of your documents, sheets, and slides.+ 10.7 Google Search Console. As part of this integration, the Subscription Service will be able to view, manage and store properties which include the list of sites and domains you control in HubSpot and the Search Console data for your connected properties.+ 10.8 Chrome Extensions.+ 10.8.1 Sales Extension. You can install the HubSpot Sales Chrome Extension to track Gmail and Google Workspace emails through your Chrome browser. Once installed, the Extension can read and change all your data on the websites you visit and display notifications. It logs all emails from Gmail and can be used in conjunction with the Inbox Integration.+ 10.8.2 Social Extension. The HubSpot Social Chrome Extension allows sharing of pages, text, and images from around the web with the HubSpot Social Composer tool. You are able to draft or schedule posts, assign campaigns, and then see posts on the Social Calendar tool or in Social Reports once published.+ 10.9 Additional Limits on Use of Your Google User Data.+ 10.9.1 Google API Limits. HubSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.+ 10.9.2 Google Workspace API Limits. Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.+ 10.9.3 YouTube API Limits. HubSpot complies with the YouTube API Services Developer Policies available at https://developers.google.com/youtube/terms/developer-policies. Any stored public YouTube API data is refreshed or completely deleted within 30 calendar days, or deleted immediately upon user request.+ 10.10 YouTube Integration. If you are a HubSpot Customer and choose to use the YouTube integration with your HubSpot Subscription Services, you will be asked to give us access to information from your YouTube account and have the option to link your accounts.− Last Modified: April 14, 2026− (iii) Internet or network information, such as browsing and search history. We collect this information directly from your device.− 10.1 Google reCAPTCHA. We have implemented Google reCAPTCHA Enterprise on certain products and services to prevent malicious software from engaging in abusive activities on our websites.− 10.3 Gmail Integration. If you use the Gmail integration or choose to integrate any other Google Workspace application with HubSpot, you will be asked to give us access to information from your Gmail or Google account.− 10.4 Google Calendar Integration. The Subscription Service will have access to both your Google Calendar and any other calendar you access via Google in order to power our Meetings tool, and allow you to associate events with contacts in your HubSpot account. The Subscription Service will have the ability to: create or change your calendars, and update individual calendar events.− 10.5 Google Drive Integration. As part of connecting your Google Drive, the Subscription Service will be able to: see your documents, sheets, and slides, upload and download your documents, sheets, and slides, and store contents and titles of your documents, sheets, and slides.− 10.6 Google Search Console. As part of this integration, the Subscription Service will be able to view, manage and store properties which include the list of sites and domains you control in HubSpot and the Search Console data for your connected properties.− 10.7 Chrome Extensions.− 10.7.1 Sales Extension. You can install the HubSpot Sales Chrome Extension to track Gmail and Google Workspace emails through your Chrome browser. Once installed, the Extension can read and change all your data on the websites you visit and display notifications. It logs all emails from Gmail and can be used in conjunction with the Inbox Integration.− 10.7.2 Social Extension. The HubSpot Social Chrome Extension allows sharing of pages, text, and images from around the web with the HubSpot Social Composer tool. You are able to draft or schedule posts, assign campaigns, and then see posts on the Social Calendar tool or in Social Reports once published.− 10.8 Additional Limits on Use of Your Google User Data.− 10.8.1 HubSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.− 10.8.2 Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.− 10.9 YouTube Integration. If you are a HubSpot Customer and choose to use the YouTube integration with your HubSpot Subscription Services, you will be asked to give us access to information from your YouTube account and have the option to link your accounts. - medium 2026-09-06 · subprocessors +2 / −2 lines
show diff
+ Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot..txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.+ Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot..− Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot.com/hubfs/Security/2025-09-09-drift-iocs.txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.− Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot.com/news-releases/news-release-details/hubspots-statement-regarding-june-22-2024-security-incident. - high 2026-09-06 · dpa +1 / −1 lines
show diff
+ “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org..pdf , as may be amended, superseded, or replaced.− “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf , as may be amended, superseded, or replaced.
Fact changes
- medium 2026-09-05 · 0 field change(s), +12/−0 subprocessors, +0 model providers
Corrections
No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.
Facts are as stated in HubSpot's public documents on the date read. This is a record, not legal advice. Work for HubSpot? Claim this profile · Something wrong? Request a correction.