Hi @AdrP ! Great questions.
- How does HubSpot ensure the protection of sensitive customer data?
All sensitive data is protected by an additional layer of platform encryption. Sensitive property values and CRM attachments are encrypted when they reach HubSpot’s backend systems, typically within the first or second hop into our systems. The properties and CRM attachments are encrypted using AES-256 with unique encryption keys for each customer. The root keys are managed via AWS KMS, and no one has access to these keys. HubSpot engineers cannot view sensitive properties. However, a small and tightly constrained group of engineers are able to decrypt the data in order to support these services. There are also HubSpot services that need to decrypt the data. To do this, a given service must invoke a specific scope to be able to decrypt a sensitive prop - What encryption methods does HubSpot use for data at rest and in transit?
By default, data stored in HubSpot is encrypted in transit with TLS 1.2 or 1.3 and at rest using AES-256. - Is HubSpot compliant with regulations like GDPR, CCPA, and HIPAA?
- While use of the HubSpot product can enable your GDPR and HIPAA compliance efforts, use of the HubSpot product alone does not make you GDPR compliant. Like any legal issue, it’s up to you to review your specific situation with your legal counsel to understand how you can meet your obligations.
- HubSpot’s Data Processing Agreement addresses global and U.S. privacy regulations, including CCPA.
- For more info on compliance, please check our Trust Center
- What types of sensitive data can be safely stored in HubSpot?
You can find a list of all permitted sensitive data on our sensitive data terms page. (It differs per category of sensitive data) - Are there any restrictions on storing certain types of sensitive information?
There are certain types of sensitive data that we do not permit, but we do not have any hardcoded restrictions that prevent users from storing that type of data. It’s up to you, the user, to ensure you are abiding by our sensitive data terms. - How does HubSpot handle data retention and deletion policies?
This trust center article should answer your question in detail. - What measures are in place to prevent unauthorized access to sensitive data?
Firstly, with the aforementioned added platform encryption. Secondly, super admins can set up field-level permissions to restrict view and edit access. They can also set inactive session timeouts, and more to prevent unauthorized access. - How does HubSpot manage user permissions and role-based access?
You should be able to find all of that info in this KB article - Can activity logs be generated to track who has accessed sensitive information?
Audit logs allow Super Admins to see user actions (like creation, deletion, and updating) pertaining to sensitive properties. - What is HubSpot’s protocol in case of a data breach?
You can more details about that in this trust center article. - How quickly are customers notified if their sensitive data is compromised?
Without undue delay. - What support does HubSpot provide in the event of a security incident?
At customer’s request, HubSpot will promptly provide such reasonable assistance as necessary to enable customers to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if customers are required to do so under Data Protection Laws.
I don’t have the immediate answer to your remaining question. I will try to get them answered promptly! Let me know if you have any follow-up questions in the meantime 