I’m trying to create a limited-access user setup in HubSpot for an interview test.
I want to give a candidate access to build or configure something (e.g., a workflow, email, or landing page) as part of a skills assessment but without giving them visibility into any of our existing data, assets, or collateral.
Is there a way to create such an isolated environment or user permission where the user can “do” but not “see”?
Would love to hear if anyone has done something similar or has suggestions on how to approach this securely within HubSpot.
I’ve done something like this before in interviews – and I would say that there isn’t any way to do this securely, especially if you want to provide access to potentially critical tools like workflows.
When I ran interviews like these, I have never let a candidate access HubSpot without fully supervising (in person) every single step. It changes the assignment but I think it can work quite well if you frame it as a scenario where they should talk you through their thought process – and that you don’t necessarily grade the outcome but the approach.
When I created access for such a user, I did the following:
Sandbox only (!) – never production environment
Virtually no record access (owned records only)
Removal of all unneeded critical permissions (import, export, integrations, etc)
User logged in using a company email address for testing purposes, not their own
This limits most of the potential damage and addresses privacy-related concerns as a candidate should not be able to access real contact records.
The entire assignment was designed in a way that I could take away their laptop (a company device by the way) at any given time to avoid any potential damage – you especially want to do that if you’re planning on granting workflow access. A few clicks can do a lot of damage. The risk is limited in the sandbox but it can still undo a lot of work.
This can be done through Sandbox account, Create a Standard Sandbox from your HubSpot account.
When building or syncing the sandbox, choose Select specific assets (Settings > Sandboxes) so you only copy what’s safe. Skip CRM data: leave the optional one-time Contacts sync unchecked. Do not select sensitive Workflows, Emails, Lists, or other assets you don’t want visible. Create a sandbox and deploy changes to production
Open the sandbox, go to Settings > Users & Teams, and add the candidate as a user there (do not add them to your main account). Assign only the permissions they need (e.g., Workflows, Email, Landing pages) inside the sandbox.
For marketing assets, in Settings > Users & Teams > Teams, toggle Turn on to limit access to new content so new assets are only visible to the creator/their team within the sandbox.
Make sure of key sync rules (so you can plan what to exclude) like object definitions and pipelines (structure) sync but not records, lists sync names but not list members, one-time copy of up to 5,000 recent contacts (plus limited associated records) is available, simply don’t opt into it. Create a sandbox and deploy changes to production
Because this is for interview purpose, you should be aware about:
You can send one-to-one and marketing emails only to existing sandbox users and all sandbox emails route over your production’s shared IPs.
Calling and lead scoring aren’t available in a standard sandbox (including call-based workflows).
If this helps, feel free to mark it as the solution and give it an upvote !
and give it an upvote 
!