Mark contacts/companies/deals as private to restrict access to certain users

[TCollins]

At the moment the access controls are quite limited, and entirely on the user side, rather than the content side. The only controls are whether a user can see their contacts, their team's contacts, or all contacts.

Sometimes you want a contact/company/deal to only be visible to certain people (e.g. their owner), and currently there is no way of doing that. You can utilise teams to make it so that all contacts assigned to a person or team are only visible to that person or team, but there is no way for this to be set on a per contact basis.

This feature would make it much easier to control access and improve security and compliance. When combined with email logging, it will also help avoid people seeing emails that they shouldn't.

[TCollins]

Thanks for sharing this idea and for the thoughtful discussion here — we agree that controlling access to sensitive records is an important use case.

Today, there are a couple of ways you can manage record visibility in HubSpot:

1. Set record permissions to “Owned only”
You can configure object permissions (contacts, companies, deals, etc.) so that users are set to see only records they own. With this setting enabled, records are visible to their owners and super admins. A record can have multiple owners or be shared with additional users, meaning more than one user with “Owned only” permissions can still access the same record.

2. Use the “Shared with” users property
When permissions are set to “Owned only,” record access isn’t limited to a single person. Owners can use the Shared with users property to explicitly grant access to other specific users, allowing for collaboration while still keeping the record private from the wider team.

That said, we recognize that these options don’t cover every scenario. We do see opportunities to make it easier and more flexible to limit access to specific records for specific users or groups, without relying primarily on ownership. This is an area we’re considering as part of future planning.

We really appreciate everyone taking the time to share feedback and real-world use cases here — it helps shape where we focus next.

[TCollins]

Hi all - thank you so much for your feedback on this! I'm Amanda and I'm the new product manager on permissions at HubSpot. We are currently researching how to best handle record access (ie Contacts/Companies/Deals/Tickets/Custom Objects) and would love to chat with you and show you some ideas. If you're willing to spend 45 minutes with me helping shape the future of permissions, you can book time here: https://www.hubspot.com/meetings/ambaker1/record-permissions-feedback

[napeequa]

I was hoping to see this with the recent changes, but no luck.

[GSnow7]

Yes please!

Add the ability to mark a contact property as PRIVATE so that it can not be seen (except by super admins) even by users who have 'All contacts' in their permissions.

OR

Add to the user permissions the option of 'All contacts except private'.

This is so easy, please add ASAP!

BTW ...

The suggested workaround - team assignment idea does not work, because if a contact owner is a team, it removes single point responsibility for that contact. We use a lot of automations and the contact owner is a key field and needs to be a single person, not a team of people. For example, when you assign tasks in workflows, tasks get assigned to a team and not a person. This is bad task management and does not suit us at all. 

[scojon]

As a new user, I am surprised to see such an important and seemingly straightforward feature request has been ignored for almost four years.

I believe the most effective implementation of this feature would be to allow a company, contact, or deal to be marked as private, restricting access to the owner only. The owner should then have the ability to grant access to specific users or teams by opting them in.

The use of this feature should granted to e.g. all users, teams or admins. 

This is a very important feature for my company. 

[MarkBuist]

There has been lots of support for this feature, but after 4 years i have pretty much given up.

[CSic]

Following to see if this ever gets put on the roadmap.

Hoping now that they have identified sensitive data as an option - contacts need privacy too! 

[NKokot]

I concur!!

[AmandaBaker]

Hi all - thank you so much for your feedback on this! I'm Amanda and I'm the new product manager on permissions at HubSpot. We are currently researching how to best handle record access (ie Contacts/Companies/Deals/Tickets/Custom Objects) and would love to chat with you and show you some ideas. If you're willing to spend 45 minutes with me helping shape the future of permissions, you can book time here: https://www.hubspot.com/meetings/ambaker1/record-permissions-feedback

[GBurrow]

i need this feature too

[mgeorgieva]

Thanks for sharing this idea and for the thoughtful discussion here — we agree that controlling access to sensitive records is an important use case.

Today, there are a couple of ways you can manage record visibility in HubSpot:

1. Set record permissions to “Owned only”
You can configure object permissions (contacts, companies, deals, etc.) so that users are set to see only records they own. With this setting enabled, records are visible to their owners and super admins. A record can have multiple owners or be shared with additional users, meaning more than one user with “Owned only” permissions can still access the same record.

2. Use the “Shared with” users property
When permissions are set to “Owned only,” record access isn’t limited to a single person. Owners can use the Shared with users property to explicitly grant access to other specific users, allowing for collaboration while still keeping the record private from the wider team.

That said, we recognize that these options don’t cover every scenario. We do see opportunities to make it easier and more flexible to limit access to specific records for specific users or groups, without relying primarily on ownership. This is an area we’re considering as part of future planning.

We really appreciate everyone taking the time to share feedback and real-world use cases here — it helps shape where we focus next.

[Tiff]

This is now becoming business critical where we have to have this where we havecustomers that require only security cleared people access their record - is there any news on this?