Form file uploads - do they get checked for viruses/malware?

Marketing & Content Hub Lead Capture Tools
1

I would like to know if there are any protections on HubSpot forms for file uploads that would help prevent malware or viruses being uploaded to our HubSpot portal, and which could result in that malware/virus being opened by a member of staff.
Are there any resources/documentation on this I can share with our infosec team?

2

Hi @OJ_ONT,

In a recent conversation with a HubSpot employee, they did confirm that an anti-malware tool is in place. I’m not sure whether I’m allowed to share the details here publicly so I’d recommend reaching out to HubSpot support or your account manager for details.

Best regards

3

Thanks - I have reached out to HubSpot support for more info on this.

4

Did you find out any mroe info on this ?

5

Hi there @APorter96,
Thank you for posting to the Community.
Here is @OJ_ONT’s response copied from above:
"HubSpot confirmed they use ClamAV to scan uploaded files submitted via forms. These essentially go into a hidden folder in the HubSpot Files tool and the link to the file is added to the contact property - all files in the files tool get scanned and are removed/withheld if they trip the virus scan.
Extracts from conversation with support:

Sorry for the delay on this, it took me a while to find the right person who could answer this! They confirmed that files uploaded via the forms API are scanned too.

All the best,

Ciarán
Principal Customer Support Specialist
Monday-Friday 9-5 UTC

Sorry for the delay. That’s a great question. My guess would be yes it would, as the forms API sends the submission to a HubSpot form and the detection happens on the form side
However I’ll try and get a definite answer on that.

I also found we do specifically mention virus scanning in this guide

The HubSpot forms tool is equipped with virus detection that prevents suspicious files from being uploaded in form submissions.
If a visitor submits a form with a file and a virus is detected, the message [File name] removed from submission will appear in the submission details."

I hope this helps!
Cassie, Community Manager

6

Thanks so much!

7

HubSpot confirmed they use ClamAV to scan uploaded files submitted via forms. These essentially go into a hidden folder in the HubSpot Files tool and the link to the file is added to the contact property - all files in the files tool get scanned and are removed/withheld if they trip the virus scan.
Extracts from conversation with support:

Sorry for the delay on this, it took me a while to find the right person who could answer this! They confirmed that files uploaded via the forms API are scanned too.

All the best,

Ciarán
Principal Customer Support Specialist
Monday-Friday 9-5 UTC

Sorry for the delay. That’s a great question. My guess would be yes it would, as the forms API sends the submission to a HubSpot form and the detection happens on the form side
However I’ll try and get a definite answer on that.

I also found we do specifically mention virus scanning in this guide

The HubSpot forms tool is equipped with virus detection that prevents suspicious files from being uploaded in form submissions.
If a visitor submits a form with a file and a virus is detected, the message [File name] removed from submission will appear in the submission details.

All the best,

Ciarán

Principal Customer Support Specialist
Monday-Friday 9-5 UTC