HubSpot Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for HubSpot

1. 1

   Obtain HubSpot's SOC 2 Type II report and bridge letter — contact their security team directly or check [legal.hubspot.com/security](https://legal.hubspot.com/security). Request a report dated within the last 12 months and a bridge letter covering any gap to today's date. File both documents with reviewer signature as CC9.2 evidence.

   SOC 2 Overview (AICPA)
2. 2

   Resolve the subprocessor disclosure gap within 60 days: contact HubSpot's privacy or DPA team to obtain a current subprocessor list, verify it against the public page at [trust.hubspot.com/subprocessors](https://trust.hubspot.com/subprocessors), and document the list in your vendor risk file. Run a basic sanctions check on any newly identified subprocessors handling personal data.

   DPA Template (GDPR Art. 28)NIST Supply Chain Risk (SP 800-161)
3. 3

   Request clarification on HubSpot's AI data usage policy — specifically: (1) whether customer CRM and contact data is used to train AI models, (2) what retention periods apply to data processed by AI features, and (3) which third-party AI providers (if any) access customer data. Reference the [published privacy policy](https://legal.hubspot.com/privacy-policy) as a starting point and request a written statement from the vendor's privacy team if the policy is ambiguous.

4. 4

   Request HubSpot's incident post-mortem or security bulletin for the June–July 2024 customer account compromise. Ask the vendor's security team for root cause, remediation steps taken, and whether your organization's account type was in scope. Document the response in your vendor risk file.

   NIST Supply Chain Risk (SP 800-161)
5. 5

   Confirm that HubSpot has automated TLS certificate renewal in place for hubspot.com. The current certificate expires June 17, 2026 (~71 days from assessment date). You can independently monitor expiry via the [SSL/TLS analysis service report](https://www.SSL/TLS analysis service.com/ssltest/analyze.html?d=hubspot.com). Flag for re-check 30 days before expiry if confirmation is not received.

   SSL Labs Test
6. 6

   Document complementary user entity controls (CUECs) if HubSpot is within your SOC 2 audit boundary. Typical CUECs for a SaaS CRM include: access provisioning/deprovisioning controls, MFA enforcement for all HubSpot user accounts, data export and deletion procedures, and API key rotation policies. Your SOC 2 auditor will expect these to be documented.

   SOC 2 Overview (AICPA)

• The vendor's subprocessor disclosure page (trust.hubspot.com/subprocessors) was reachable but contained no extractable subprocessor data at the time of this assessment. The subprocessor chain for HubSpot's data processing operations could not be independently enumerated.
• HubSpot's AI data usage policy, discoverable at the published privacy policy page, does not explicitly state whether customer data is used to train AI models, what AI data retention periods apply, or which third-party AI providers process customer data. Key policy fields (trainingCommitment, retentionPolicy) returned 'not_stated', limiting the ability to fully characterize AI-related data risk.
• External cyber risk scoring was not available for this assessment. A quantitative cyber risk score relative to the SaaS industry average could not be produced.
• ISO 27001 certification could not be independently confirmed via the IAF CertSearch registry. The vendor's security page characterizes ISO 27001 as inherited from cloud infrastructure providers rather than a direct HubSpot certification, which limits the scope of controls that certification implies.
• The HITRUST directory returned a possible match for HubSpot at 90% confidence, which was insufficient for independent confirmation. HITRUST certification status should be verified directly with HubSpot or the HITRUST Alliance.
• Certificate Transparency logs show 4,844 historical certificates across 21 different Certificate Authorities. While this reflects HubSpot's long operational history and use of multiple CDN and infrastructure providers, the diversity of historical issuers could not be fully audited within this assessment.
• Ai data|policy|governance coverage was limited for this assessment. This does not confirm any deficiency — direct verification with the vendor is recommended.