HubSpot security review

Close the gaps between your stated posture, your live configuration, and the evidence you can show.

Three things a HubSpot security review surfaces

Stated security posture and live configuration drift apart over time, because every new admin, app and default quietly moves the line.

No one inside the team reviews the whole account, so risks sit unowned until an incident or an audit forces the question.

Assurance asks for evidence, not a self-report, and most teams cannot produce it on request.

Why does the configuration drift from the policy?

Customer_Platform_Illustrations_Color_LightBG

Every permission set, connected app and team is checked against the access policy as written, not as remembered, so the review starts from the live account.
The output is a gap list ranked by exposure, so the team fixes what matters first rather than everything at once.
You end with a configuration that matches the policy, and a record of the difference you closed.

Why is there no single owner for the review?

A review assigns clear ownership for each control area, so access, integrations and data handling each have a named person.
Findings are written so a non-specialist can act on them, not buried in HubSpot screens only an admin can read.
Ownership turns a one-off cleanup into something that holds, because someone is accountable for keeping it true.

Why can the team not show evidence on request?

Airport1_Security_LightSkin_Illustrations_Color_LightBG

The review produces an evidence pack: who has access to what, which apps hold credentials, and how sensitive data is handled.
It maps directly to the controls an ISO 27001 auditor or a cautious buyer asks about, so the answer is ready before the question.
When procurement or an auditor asks, you send the pack instead of starting a scramble.

Name Digital Learning Institute

If I could give them 100 stars I would

Incredibly grateful to Martin, Elisa and Darian for their help with two projects this year:

1. HubSpot reconfiguration- Elisa guided us through how to back out of some previous CRM mistakes and how to adopt some of the native HubSpot functionality to maximise our CRM usage. I would go to Elisa with what I thought were complex scenarios and she would have visualised it and built it while I was still trying to explain what I meant. It was an absolute pleasure working with Elisa and absorbing some of her know how. Our CRM just sings now, exactly how we wanted it. I look forward to continuing our reconfiguration into the new year as we tackle Phase 2.

2. A development project- We were re-platforming our website with another vendor and wanted to introduce some automation into our enrolment process. For this project I worked with Martin and Darian. I will admit to very much doubting Martin when he kept saying 'yep that's possible' as I outlined what we wanted to do. He had no doubt Darian could do everything we wanted and it seemed to good to be true. I wanted an individual to be able to purchase directly on our website, process their transaction on Stripe, pass their information into HubSpot creating/updating the contact, creating a deal, associating it with the correct line item, pass their transaction to our finance system and finally enrol them in the relevant course in our Learning Platform (with various rules for what they could/couldn't access immediately). I am delighted to say, that is exactly what we achieved. In fact we even did more than that and enabled automated enrolment for invoiced customers also. And, better yet all of the above is completed within 3 minutes of purchase. It's incredible. I look forward to working with PYB into the future. I couldn't recommend them more. Lovely team, so nice to deal with, reliable and their enthusiasm for 'what is possible' is infectious. The sky is the limit.

Amy McPartlan

Chief Operating Officer

Ready to discuss your HubSpot project?

Let's take our relationship up a level.

Simply fill in the form below...

(I'll get back to you ASAP)

Prefer another way?

FAQs

How long does a HubSpot security review take?

Most reviews run 2 to 4 weeks. Week 1 covers access and permission mapping. Week 2 covers connected apps, integrations and audit logging. The final stage assembles the findings and the evidence pack, with a prioritised remediation list.

Can HubSpot enforce the access model our policy describes?

Yes. HubSpot supports permission sets, property-level and asset-level restrictions, and team structures. A review checks whether those controls are switched on and consistent, then closes the gaps so the live model matches the written one.

Does a review cover integrations and the audit trail?

Yes. It inventories every connected app and private app, checks credential scope and webhook authentication, and confirms what is logged where across HubSpot and any middleware, so an incident can actually be reconstructed.

What HubSpot products does a security review apply to?

Any tier. The review works across Marketing, Sales, Service and Operations Hub, and pays particular attention to Enterprise features such as custom objects, advanced permissions and audit logs where they are in use.

Does HubSpot meet our security and accreditation requirements?

HubSpot holds SOC 2 Type II and ISO 27001. PYB adds its own ISO 27001, ISO 9001 and ISO 42001 certifications, plus the HubSpot Data Migration Accreditation, so the people configuring your access controls are themselves audited against the standards your buyers and regulators care about.

Talk to PYB about a HubSpot security and configuration review.

A 15-minute call to walk through where your live configuration has drifted from your policy and what an auditor would find, and what closing the gaps looks like. No prep, no pitch deck.

Book a 15-minute call