Trains on customer data
no
“10.8.2 Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.”
Opt-out mechanism
none described
Not stated in the documents we could read. An absence here is an unknown, not a no.
AI features
present
“When you use our products and services we may process personal data to develop, support, and improve HubSpot AI features and to train our AI models and similar products and services that rely on machine learning.”
Model providers named
Replicate
“Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary instance. All databases are backed up and maintained using at least industry standard methods.”
Retention
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Hosting regions
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Subprocessor notice
30 days
“We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
Downstream
Who's behind HubSpot, as listed in its own subprocessor documents. 13 listed.
Model providers
- Replicateunstated
Hyperscalers
- Amazon Web Servicesunstated
- Google Cloudunstated
Other subprocessors
- Clearbitunstated
- Cloudflareunstated
- Driftunstated
- Dropboxunstated
- Gainsightunstated
- Oktaunstated
- Salesforceunstated
- Salesloftunstated
- Snowflakeunstated
- Stripeunstated
Reviewer notes
Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'.
Documents read
- privacy policy https://legal.hubspot.com/privacy-policyHTTP 200 · 2026-09-06
- dpa https://legal.hubspot.com/dpaHTTP 200 · 2026-09-06
- subprocessors https://trust.hubspot.com/legal/subprocessorsHTTP 200 · 2026-09-06
Document changes
- medium 2026-09-06 · subprocessors +2 / −2 lines
show diff
+ Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot..txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.+ Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot..− Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot.com/hubfs/Security/2025-09-09-drift-iocs.txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.− Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot.com/news-releases/news-release-details/hubspots-statement-regarding-june-22-2024-security-incident. - high 2026-09-06 · dpa +1 / −1 lines
show diff
+ “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org..pdf , as may be amended, superseded, or replaced.− “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf , as may be amended, superseded, or replaced.
Fact changes
- medium 2026-09-05 · 0 field change(s), +12/−0 subprocessors, +0 model providers
Corrections
No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.
Facts are as stated in HubSpot's public documents on the date read. This is a record, not legal advice. Work for HubSpot? Claim this profile · Something wrong? Request a correction.