I see the confusion here, @RSummo . You’ve spotted something real: in Salesforce, “Modify All Data” is a system-level permission that overrides object-level sharing and makes all the careful steps in HubSpot’s selective sync guide useless if it stays on. That’s why you see all Accounts and Contacts flowing into HubSpot whenever that permission is active.
The missing detail is that for selective sync to work, the Salesforce integration user must have read access only through sharing rules, not through “Modify All Data.” So the right path is: clone the System Admin profile, remove the “Modify All Data” permission from the cloned profile, and then assign that new profile to your integration user.
After that, create sharing rules that expose only the Accounts/Contacts you want HubSpot to see. If you skip removing “Modify All Data,” the sync user sees everything, and HubSpot respects that. HubSpot’s article on selective sync explains the principle but doesn’t highlight this system-level override clearly
(Connect HubSpot and Salesforce )
If you’ve tried removing “Modify All Data” and then nothing syncs, that usually means your sharing rules aren’t actually granting access to any records for the integration user. Double-check whether those rules are assigned to the correct role or public group, and that the user really sits in the right spot in the role hierarchy
(https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&type=5 )
A quick test is to log in as that integration user and see if they can view the intended records inside Salesforce itself HubSpot will only sync what that user can see.
If consistency between Salesforce visibility rules and HubSpot is business-critical, Stacksync can help. It keeps Salesforce and HubSpot mirrored in real time, without depending on these permission edge cases, so you can enforce true selective visibility without brittle workarounds.