Restrict access to account settings

[DLorenzen]

Hi,

After getting around in the system and trying to restrict access of data for none Admin users we have notised a big issue regarding what data is available to everyone using the system.

Under the settings everyone is able to see how our backend is put together and what settings and teams are made including who is members of the teams with full data.

Following screenshots is made from an account with lease access allowed for the team and the permission set.

Still this user is able to acces account associated data that they have no need of or interest about.

HS User data:
It's already possible to hide the Users in "Users  Teams" but that makes no real sense when the user can click on "Teams" in the same framework and find it's way into any team in the system to see and get user infomations from any team.
EX:
"Black OPS" team is assigned to look for suspicious behaivours and check of unautherized use of data, without users knows who is in the team.

And last but not least they can see the Object configurations and what properties is on the Object even if it's a team restricted object.
Data management on objects

We really would like to get a way to hide this for everyone who shouldn't be able to access it or have no use of this information.
Something like adding the option of showing or hiding "Account Setup", Data Management" and "Tools" in the permission set or only showing this if SuperAdmin.

[adis]

I wonder why no one has reported this security issue before or is urgently addressing it.

HubSpot's permission management is terrible—it's not granular enough, unnecessarily complex, and leaves gaps like this one open.

Honestly, this is a significant problem for HubSpot, especially considering that:

• It's mandatory to use an Enterprise package to have the minimum level of security that any other software includes in the basic package (Permission Sets/Groups).
• By definition, a CRM often handles personal and sensitive data, which should be properly managed to comply with increasingly strict privacy regulations.

Given the considerable cost of the Enterprise packages, I expect much more focus on security rather than such glaring oversights.