How Hubspot Handles Sensitive Data and How to Protect It
Understanding how Hubspot treats sensitive data is essential if you manage customer information, work with compliance requirements, or build integrations. This guide explains what counts as sensitive data, how the platform processes it, and what you should and should not store in your account.
What Sensitive Data Means in Hubspot
Before you upload or sync any information, it is important to know what is considered sensitive. Certain data types are regulated or carry a high risk if exposed. You remain responsible for deciding whether that information should ever be stored in your Hubspot account.
- Personally identifiable information combined with financial details
- Government-issued identification numbers
- Health or medical records
- Payment card or banking data
- Authentication credentials and security answers
These categories need extra protection and usually require strict legal and contractual controls that go beyond standard CRM usage.
Types of Sensitive Data You Should Not Store in Hubspot
Certain information should not be uploaded, copied, or synced into your CRM or any other tool in your account. Keeping it out of Hubspot reduces risk and helps you comply with laws and industry rules.
Financial and Payment Data in Hubspot
Avoid storing any data that could be used to process payments or commit financial fraud. This includes:
- Full credit or debit card numbers
- Card security codes (CVV, CVC)
- Bank account and routing numbers
- PINs or codes used for financial transactions
Do not place this information in contact properties, tickets, attachments, email content, or notes. Instead, use a dedicated and compliant payment processor and keep only limited, non-sensitive references in Hubspot, such as transaction IDs that do not expose payment details.
Government and Identity Numbers in Hubspot Records
Identity data can be highly sensitive and often has special protections under the law. You should not store:
- Social Security or national ID numbers
- Passport or driver’s license numbers
- Tax identification numbers intended to stay confidential
Keep identity numbers within systems designed for HR, payroll, or specialized compliance workflows instead of placing them inside CRM fields or uploaded documents connected to Hubspot objects.
Health Information and Hubspot Usage
Health data is typically regulated and should never be treated as ordinary marketing or sales information. Do not store:
- Medical diagnoses or treatment details
- Insurance claim data or policy numbers linked to health services
- Clinical records or test results
If you operate in healthcare or adjacent industries, design your processes so that Hubspot tracks only general engagement activity or non-medical preferences, while protected health information is managed in separate, compliant systems.
Authentication Data and Secrets in Hubspot Tools
Authentication-related information is extremely sensitive and should never be stored within notes, descriptions, or custom properties. This applies across all parts of your Hubspot portal.
Passwords, Tokens, and Keys in Hubspot
Never save or share the following through CRM records, emails, tasks, tickets, or custom fields:
- Account passwords for any user or customer
- API keys or API secrets
- OAuth tokens or refresh tokens
- Private encryption keys or certificates
Store such credentials in a dedicated secrets manager or password manager. Limit who can view them and rotate them regularly. Hubspot should only reference these systems, not contain the secrets itself.
Security Questions and Multi-Factor Details
Information used to verify identity or approve account access must also be kept out of your CRM. That includes:
- Security questions and answers
- One-time codes for authentication
- Backup codes or recovery tokens
Treat these as confidential security data. Never paste one-time codes or recovery details into tickets, emails, or internal comments related to your Hubspot records.
Where Sensitive Data Might Appear in Hubspot
Even if you do not plan to store it, sensitive information can still slip into your account through normal activity. Pay attention to these areas.
CRM Properties and Free-Text Fields in Hubspot
Free-text fields are a common place for accidental storage of sensitive items. Examples include:
- Contact and company properties
- Deal and ticket descriptions
- Call notes and meeting notes
- Internal comments on records
Train users not to paste financial, health, or credential data into these fields. Configure property labels and descriptions to remind your team which types of content are not allowed.
Files, Attachments, and Imports in Hubspot
Documents can also carry risky information. Review these entry points:
- Uploaded files on records or in file manager
- Imported spreadsheets loaded into your database
- Forwarded emails and logged replies with attachments
Sanitize spreadsheets and documents before upload. Remove columns or pages containing confidential personal information that does not belong in Hubspot, and use redacted versions whenever possible.
Integrations and Data Sync
Connected systems can unintentionally push regulated information into your portal. Pay special attention to:
- Integrations with billing or payment platforms
- Custom-built apps and middleware
- Data sync from support, HR, or medical systems
When you configure integrations, choose only the fields you truly need in Hubspot. Exclude payment data, identity numbers, and any health-related information from the sync. Review mapping rules periodically to ensure sensitive fields are still blocked.
How Hubspot Processes Data and Your Responsibilities
Hubspot provides infrastructure and tools, but you are responsible for what you choose to store. You must evaluate your own regulatory environment and risk tolerance when deciding which data to collect and manage in the platform.
Hubspot offers security controls such as user permissions, audit logs, encryption in transit and at rest, and access management. However, these controls do not change the fundamental rules around highly sensitive data. If you collect information regulated by financial, medical, or government privacy laws, it may need to remain in specialized systems instead of a general CRM.
Always review your organization’s policies and consult with legal or compliance teams before importing or syncing new data categories into Hubspot. If you discover that restricted data has been stored, remove it promptly from properties, notes, attachments, and any custom objects that contain it.
Best Practices for Safe Hubspot Use
Use the following steps to reduce the risk of storing restricted data and to keep your account aligned with security and privacy expectations.
1. Define What Belongs in Hubspot
- Create a simple data classification policy for your teams.
- Explicitly list which categories must never be stored in the CRM.
- Share examples, such as full card numbers or medical chart details, so users recognize them.
2. Configure Properties and Permissions
- Review all standard and custom properties in your portal.
- Rename or add help text where needed to warn against putting sensitive items in specific fields.
- Limit access to properties that contain more private (but still acceptable) information, such as basic personal details.
3. Train Users on Hubspot Data Handling
- Run short training sessions explaining what not to enter.
- Show realistic scenarios, including emails and tickets where people might paste regulated data.
- Provide a clear alternative system for storing restricted information so teams know what to use instead.
4. Audit and Clean Your Hubspot Account
- Periodically export or search fields that are likely to contain restricted content.
- Review attachments and imports created from legacy processes.
- Remove or redact any items found, and update procedures so the issue does not recur.
5. Review Integrations and Custom Apps
- Check each connected system to see which fields sync into Hubspot.
- Disable mapping for financial, health, credential, or government ID fields.
- Document the remaining mapped fields and review them with security or compliance teams when integrations change.
Where to Learn More About Sensitive Data in Hubspot
For deeper technical and policy details, review the official documentation on sensitive data and acceptable use directly from the platform provider. You can find the current guidance at this Hubspot sensitive data article, which explains how specific data types are treated and what responsibilities customers have.
If you are designing a broader data strategy, CRM architecture, or integration plan around Hubspot, you may benefit from expert implementation and security consulting. Resources such as Consultevo offer strategic support on CRM design, process optimization, and platform governance to help translate security guidance into practical workflows.
By understanding which information never belongs in your CRM, configuring your tools carefully, and educating your teams, you can use Hubspot effectively while protecting customers and meeting your compliance obligations.
Need Help With Hubspot?
If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.
“`
