A HubSpot portal holds the contact, deal and conversation history of every customer and prospect, and the identities with the widest reach into it are usually not people but private app tokens and connected OAuth apps that nobody reviews. The 2025 wave of CRM data theft, where attackers used phone pretexting and stolen integration tokens to empty Salesforce tenants, applies just as directly to HubSpot: the same patterns of over-scoped apps, long-lived tokens and unreviewed super admins exist in both. This guide explains how users, super admins and permission sets work in HubSpot, how private apps and OAuth integrations act as non-human identities, how to control data exports, what the audit logs capture and how to build a hardening baseline. It is written for HubSpot administrators, revenue operations teams, and the identity and security engineers who support them. Feature names and limits come from HubSpot's knowledge base and developer documentation; check them against your subscription tier, because several controls are Professional or Enterprise only.
Key takeaways
- Super Admin is close to unlimited. Super Admins reach nearly every tool and setting, can see team-restricted assets, are the only users who can manage private apps and view audit logs, and their permission set cannot be modified.
- Private app tokens are long-lived bearer credentials. A private app access token does not expire on its own; HubSpot recommends rotating about every six months and reminds Super Admins after 180 days.
- OAuth scopes are not user permissions. HubSpot documents that a token's scopes, not the installing user's permissions, decide what it can reach, so a limited user who approves a broad scope creates a token that sees more than they can.
- Exports are the exfiltration path. Anyone with Export can pull CRM records into an emailed download link that stays valid for 30 days, unless you require approval.
- Thirty days of logs is not enough. Login History, Security Activity and private app call logs cover 30 days in the interface; export or forward them if you need investigation history.
How identity and access work in HubSpot
HubSpot access is the product of three things: the user's seat, their permission set and their record scope.
- Seats: permissions only apply within tools the seat includes. A View-only seat is not the same as View permission on an object, and Super Admins need a Core, Sales or Service seat on paid subscriptions.
- Permission sets: grouped by tab: CRM, Marketing, Sales, Revenue, Service, Data Management, Automation, Reporting, AI features, Account and Partner. Users who can edit others' permissions cannot grant permissions they do not hold themselves.
- Record scope: View, Edit and Delete on objects can be set to all records, the user's team's records, the user's own records or none, with an Unassigned option to extend them.
- Teams: group users for scoping and reporting. "Limit access by teams" lets a holder access all assets regardless of team, so treat it as a broad permission.
Sign-in: SSO and two-factor authentication
| Control | Availability | Detail from HubSpot documentation |
|---|---|---|
| SAML single sign-on | Professional and Enterprise | Super Admin required to set up; HTTP POST binding; SHA-256 signing only; x509 certificate in PEM; nameID in email format matching the HubSpot user's email |
| Require single sign-on | With SSO | Checkbox in the Login tab; Manage exempted users lets partners or contractors use HubSpot credentials; the user who enables it is excluded automatically |
| Multiple identity providers | With SSO | Additional named SSO configurations for regions or subsidiaries |
| SCIM provisioning | With SSO | Only one identity provider can provision; users from others are managed manually |
| Two-factor authentication | All accounts | Can be required for all users from security settings; changes are recorded in Security Activity |
HubSpot advises keeping at least one Super Admin exempt from the SSO requirement so the requirement can be switched off if the identity provider fails. That account is your break-glass account: give it a strong unique password and two-factor authentication, and alert on every sign-in. SSO settings also sync to sandbox and developer test accounts. See the Identity Provider and SSO Security Guide and the SCIM Provisioning Guide.
Admin roles and privileged access
HubSpot has no separate security administrator role. Privilege comes from Super Admin status and from a handful of sensitive permissions inside ordinary permission sets.
| Privilege | What it allows | Risk | Control |
|---|---|---|---|
| Super Admin | Nearly all tools and settings; private apps; audit logs; SSO configuration; granting Super Admin to others | Full tenant takeover and data theft | Two to four named holders; SSO plus 2FA; monthly review |
| Add and edit users | Add, deactivate and remove users; customise permissions | Can create a new user with broad rights | Restrict to identity or operations admins; alert on user adds |
| App Marketplace access | Install apps, including from third-party sites | Connects new OAuth apps with tenant data | Small group; others use "Request to install" |
| Export, Export without approval | Export CRM records and reports, optionally without approval | Bulk data exfiltration | Grant Export narrowly; remove "without approval"; assign Approve exports to data owners |
| Bulk delete | Bulk delete contacts, companies, deals, tickets and tasks | Destructive insider or attacker action | Restrict to data management roles |
| Edit account defaults | Account name, branding, privacy settings | Changes to consent and privacy behaviour | Restrict; review changes in audit log |
- Help desk and phone pretexting: the ShinyHunters Salesforce campaign of 2025 talked staff into approving malicious connected apps over the phone. The same request, "please install this app so I can help", works on any HubSpot user with App Marketplace access. See the Account Recovery and Help Desk Security Guide.
- Partners and agencies: agency users are common in marketing portals and are typical SSO exemptions. Give them their own named accounts, scoped permission sets and an end date, never a shared login.
- Leavers: deactivate through SCIM or the user table, and check whether the leaver created private apps before removing them (see below).
See the Privileged Access Management Guide.
Integrations, API tokens and service accounts
HubSpot integrations take two forms, and both are non-human identities with access to customer data.
| Aspect | Private app (legacy) | OAuth app (public or marketplace) |
|---|---|---|
| Who creates or installs | Super Admins only; up to 20 per account | Super Admin or user with App Marketplace access installs |
| Credential | Single access token sent as Authorization: Bearer | Short-lived access token (expires_in, 1800 seconds in HubSpot's example) and a refresh token |
| Who holds it | Your own scripts, middleware, iPaaS | The vendor's infrastructure |
| Expiry | None by default; rotate manually | Access token expires; refresh token persists until revoked |
| Revocation | Rotate and expire now, or delete the app | Uninstall from Connected Apps |
| Inspection | POST /oauth/v2/private-apps/get/access-token-info shows hub, app, user and scopes | GET /oauth/v1/access-tokens/{token} shows hub, user, scopes and expiry |
| Logs | Call logs for 30 days, filterable, CSV export; no request or response bodies stored | Connected Apps listing; Security Activity for installs |
Private apps
- One app per integration: each with only the scopes it needs. Scope changes alter what the token can do but keep the same token string, so a scope added later silently widens a token already deployed.
- Store the token in a vault: not in spreadsheets, workflow tools or code. See the API Key Management Guide.
- Rotate on a schedule: use "Rotate and expire later", which keeps the old token valid for seven days while you deploy the new one, and "Rotate and expire now" for suspected exposure.
- Watch the creator dependency: HubSpot documents that removing the user who created a private app can break it with USER_DOES_NOT_HAVE_PERMISSIONS errors until the token is rotated. Record the creator as part of offboarding, and rotate when they leave.
- Delete unused apps: deletion permanently revokes the token.
OAuth apps
- Review scopes before install: the listing's Requirements and Shared data sections show what syncs and in which direction.
- Remember optional scopes: apps can request optional scopes that are granted when the account has the feature, so a tier upgrade can widen an existing app's reach.
- Uninstall, do not just ignore: Settings, Integrations, Connected Apps, Actions, Uninstall. A vendor deleting its refresh token does not invalidate access tokens already issued, according to HubSpot's token documentation, so short-term access can outlast the vendor's clean-up.
- Vendor compromise is your incident: the Salesloft Drift breach of 2025 showed how one integration vendor's stolen tokens open hundreds of customer CRM tenants. Keep an inventory that tells you within minutes which apps hold tokens for your portal.
Plan for platform change: HubSpot labels private apps as legacy apps on its new developer platform and has announced deprecation of v1 of its OAuth API on 16 February 2027. See the SaaS and OAuth App Governance Guide and the NHI Ownership Guide.
Data exports
Exports are where a stolen session or an insider turns access into a file. HubSpot sends exports by email with a download link; the dialog allows several recipient addresses; links expire after 30 days; and the export log keeps entries for three years.
- Require approval: remove "Export without approval" from everyone except a small data team, and give "Approve exports" to data owners.
- Notify on volume: Super Admins can enable email notifications when a user runs multiple exports in a day.
- Restrict recipients by policy: exports to personal or external addresses should be a policy breach, checked in the export log.
See the Data Loss Prevention (DLP) Guide.
Logging and detection
HubSpot's audit logs sit under Settings, Audit Logs, and require Super Admin to view and export. The centralised audit log records HubSpot user actions only; automated updates such as form submissions do not appear.
| Log | Retention in the interface | Use it for |
|---|---|---|
| Login History | 30 days | Unusual locations, devices or times; logins by exempted users |
| Security Activity | 30 days in view; one year by export | SSO and 2FA changes, user adds and removals, exports, integration installs, sandbox actions |
| Centralised audit log (Professional and Enterprise categories) | 30 days | Property, workflow, list, pipeline and settings changes; sensitive property value views; record views |
| HubSpot employee access history | 90 days by export | Vendor support access to your portal |
| Private app call logs | 30 days, CSV export | Unexpected methods, endpoints or error spikes per token |
| Export log | Three years | Who exported what and to whom |
Category depth depends on tier: Starter covers logins, security activity and a few object events; Enterprise adds the most categories, a user analytics tab and visibility of HubSpot employee actions. Because of the 30-day window, export Security Activity at least monthly or pull logs into a SIEM. In MITRE ATT&CK terms, watch for Valid Accounts: Cloud Accounts (T1078.004), Steal Application Access Token (T1528), use of stolen tokens (Application Access Token, T1550.001), Account Manipulation (T1098) and Data from Information Repositories (T1213). See the ITDR Guide.
Metrics
- Super Admin count: target four or fewer, all named and SSO-bound except one break-glass.
- Token age: percentage of private app tokens rotated in the last 180 days.
- Connected app hygiene: apps with a named owner and a review date, and apps with no use in 90 days removed.
- Export approvals: share of exports that went through approval, and exports to non-corporate addresses (target zero).
- SSO coverage: percentage of users required to use SSO; count of exempted users.
Hardening baseline
- Inventory first: export the user table, list Super Admins, private apps (with creator and scopes) and Connected Apps. Record an owner for each.
- Turn on SSO in a pilot: configure SAML, test with a pilot group, then select "Require single sign-on" with one exempt break-glass Super Admin. Roll back by clearing the checkbox from that account.
- Require two-factor authentication: for all users who still sign in with HubSpot credentials, including exempted partners.
- Cut privilege: reduce Super Admins, remove App Marketplace access, Export without approval and Bulk delete from general permission sets, and use team scoping for record access.
- Fix tokens: rotate every private app token older than 180 days with "Rotate and expire later", move tokens into a vault and delete unused apps.
- Review Connected Apps: uninstall apps with no owner or no recent use; check scopes of the rest against need.
- Set up logging: enable export and admin-removal notifications, schedule monthly exports of Security Activity, and retain private app call logs outside HubSpot.
- Review quarterly: Super Admins, exempted users, private apps, Connected Apps and permission sets.
Small versus large portals: a small Starter portal without SSO should lean on required 2FA, very few Super Admins and monthly manual review of Connected Apps. A large Enterprise portal should use SSO with SCIM, the wider audit log categories and a SIEM feed, and treat integration tokens through the same NHI governance process as cloud service accounts.
Common misconfigurations
- Every marketing manager is a Super Admin: common in portals that grew from a small team, and the fastest route to full takeover.
- Private app tokens never rotated: tokens from a past project still live in an iPaaS or a contractor's script, with scopes widened since.
- Broad App Marketplace access: any user can connect a new app to customer data, which is exactly what phone pretexting targets.
- Export without approval for everyone: one compromised session produces a full contact export in an inbox.
- SSO exemptions that grow: agencies and contractors added to the exempt list and never removed, signing in with passwords.
- Logs never leave HubSpot: by the time an incident is noticed, the 30-day window has closed.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Users, Super Admins, least privilege | AC-2, AC-6 | PR.AA-01, PR.AA-05 | 5, 6 | 5.15, 8.2 |
| SSO, 2FA, token management | IA-2, IA-5 | PR.AA-01 | 6 | 5.17, 8.5 |
| Third-party apps and integrations | CM-7 | GV.SC-07 | 15 | 5.19, 5.21 |
| Audit logging and review | AU-2, AU-6 | PR.PS-04, DE.CM-03 | 8 | 8.15, 8.16 |
Practitioner checklist
- List every Super Admin and reduce to a small named group plus one break-glass account.
- Configure SAML SSO, select "Require single sign-on" and review the exempted users list monthly.
- Require two-factor authentication for every user who signs in with HubSpot credentials.
- Inventory private apps with creator, scopes, owner and last rotation; rotate any token older than 180 days.
- Restrict App Marketplace access and uninstall Connected Apps with no owner.
- Remove "Export without approval" from general permission sets and enable multiple-export notifications.
- Export Security Activity and private app call logs at least monthly, or feed them to a SIEM.
- Add private app creators and app installers to offboarding checks.
Standards and references
- HubSpot Developers: Legacy private apps
- HubSpot Developers: Manage OAuth tokens
- HubSpot Developers: Working with OAuth
- HubSpot Knowledge Base: User permissions guide
- HubSpot Knowledge Base: Set up single sign-on
- HubSpot Knowledge Base: View and export account activity history
- HubSpot Knowledge Base: Export records
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Salesforce Security Guide · SaaS Security Guide · Secrets Management Guide · Top 10 SaaS Security Risks