Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

HubSpot account security: essential settings and best practices

Account security in HubSpot helps protect your account from unauthorised access, safeguard your data and reduce the risk of security incidents.

HubSpot provides a range of tools to help you manage how users access your account, strengthen authentication, review potential security risks and protect your CRM data.

Single Sign-On (SSO)

Single Sign-On allows users to log in to HubSpot using a central identity provider, such as Microsoft Azure AD, Google Workspace or Okta, rather than relying on separate HubSpot credentials.

Using SSO can help reduce password-related risks and centralise access control across the systems your organisation uses.

Why it matters

  • Simplifies login using your organisation's existing identity system
  • Helps centralise user access management
  • Allows organisations to apply more consistent authentication policies across applications

HubSpot guide:
Set up Single Sign-On (SSO)

Control allowed login methods

HubSpot allows you to control which login methods users can use to access your account.

Depending on your organisation's requirements, this can be used to restrict certain login methods or require users to access HubSpot using your preferred authentication method.

Login options can include:

  • HubSpot email and password
  • Google sign-in
  • Microsoft sign-in
  • Single Sign-On (SSO)

Restricting login methods can help your organisation maintain greater control over how users authenticate.

HubSpot guide:
Restrict which login methods users can use to access your account

Require two-factor authentication (2FA)

Two-factor authentication adds an additional layer of protection to a user's HubSpot login by requiring a second verification step alongside their password.

As a security best practice, 2FA should be enabled for all users.

Users should also consider setting up both primary and secondary authentication methods where available. This can provide an alternative way to authenticate if access to the primary method is lost.

HubSpot guide:
Set up two-factor authentication for your HubSpot login

Review your Security Health

HubSpot's Security Health tools help administrators review important security measures across their account and identify areas that may require attention.

Security reviews can include areas such as:

  • Inactive users who may need to be deactivated
  • 2FA enrolment
  • Super Admin access
  • Partner access
  • User permissions and potential permission risks

Security should be reviewed regularly rather than treated as a one-off configuration exercise.

CRM backups

HubSpot provides tools for backing up CRM data, including business-critical records such as contacts, companies, deals, tickets and other CRM information.

Regular backups can provide an additional safeguard for important CRM data.

The backup options and frequency available to you may depend on your HubSpot subscription.

HubSpot guide:
Back up or restore CRM data

Protecting CRM backup files

Creating a backup can result in CRM information being downloaded and stored outside HubSpot.

Once this happens, the files need to be protected appropriately by your organisation.

You should:

  • Restrict access to CRM backup files
  • Store files securely in line with your internal security standards
  • Include backups within your organisation's data handling and retention policies
  • Consider your organisation's GDPR and other data protection responsibilities

Exporting your HubSpot data

HubSpot also provides export tools for organisations that need to export CRM information or other HubSpot data.

HubSpot guide:
Export your content and data

Important: CRM backups and exported data

Once CRM data is exported from HubSpot, it is no longer protected by HubSpot's security controls.

Any CRM backup or export should therefore be governed by your organisation's security, data handling and GDPR compliance policies.

Responsibility for the storage, access, retention and protection of exported data lies with your organisation as the data controller.

Forbidden does not store, process or audit CRM data that your organisation exports from HubSpot.

Control who can export CRM data

Because exports can contain sensitive or personal information, organisations should carefully control which users are able to export CRM data.

HubSpot user permissions can be used to manage access to export functionality.

As part of your security processes, you should:

  • Grant export permissions only to users who need them
  • Restrict export access appropriately
  • Review user permissions regularly
  • Remove permissions when they are no longer required
  • Document how exported data should be handled within your organisation

Only users with the appropriate permissions should be permitted to export CRM data.

HubSpot guide:
Add and edit user permissions

Data exports, GDPR and organisational responsibility

When CRM data is exported from HubSpot, your organisation is responsible for ensuring that the exported information is handled lawfully and securely.

Your organisation should ensure that:

  • Exported data is stored securely
  • Access is appropriately restricted
  • Data retention requirements are followed
  • Export processes are documented within relevant security and data handling policies
  • GDPR and other applicable data protection requirements are considered

HubSpot does not provide its platform security controls around files once they have been exported, and Forbidden does not store, process or audit exported CRM data on your organisation's behalf.

What to remember

HubSpot provides security tools, but maintaining account security is an ongoing responsibility.

Super Admins and account owners should regularly review authentication methods, 2FA adoption, user access, permissions and CRM backup processes.

Particular care should be taken whenever CRM information is downloaded or exported, as responsibility for protecting that information moves outside HubSpot's platform controls.