Google Calendar integration permissions: Why???

[Stobber]

I just tried to connect HubSpot CRM to my Google Calendar account. Google warned me of the list of permissions HubSpot was requesting.

Looks like HubSpot wants access to everything I do in my company through G Suite. Why do you need access to my Drive, all my email, my Spreadsheets, etc just to sync with my calendar?

I want to use more integrations, but I'm not ready to give you a camera and lift up my skirt, so to speak.

[jennysowyrda]

Hi @Stobber,

These permissions are required due to technical limitations. Your privacy is a top priority for HubSpot; if you would like to read more about this, I wanted to share HubSpot's privacy policy.

Additionally, I wanted to mention that though we are asking for these permissions when connecting, we do not access any data until you uses a feature that requires that data.

Thank you,
Jenny

[Stobber]

Hi Jenny - 

Thank you. I opened the Privacy Policy. It referred to definitions in the ToS document, and it was complemented by the DSA document. The DSA, in PDF form, is 24 pages long. The ToS and PP are of comparable length. I hope you'll excuse me for not wading through ~70 pages of strict legal language in order to get my questions answered.

Maybe you can point me to the pertinent sections and clauses for explaining why you need rights to do these things when I connect my Google Calendar?

• Read all my email
• See all my private cloud files
• Download my contacts
• Manage my site's Google search optimization
• Manage my domain list

[jennysowyrda · Accepted solution]

Hi @Stobber,

This document outlines some of what you are looking for. 

If you use the 'Gmail and Outlook Integration' with the Sales Hub product, we will have access to certain information associated with your email account and will use some of this information to provide the Sales Hub product services. We may store and use your email data, such as the distribution lists (for example, the "to", "from", "cc", and "bcc" fields), the subject lines, and the URLs of tracked links from your emails in order to provide the Sales Hub product. If you use the "Send Later" feature in the Sales Hub product, we will store the bodies of the emails (along with the associated attachments) that you schedule to send in order to provide this feature to you. You must connect your inbox to the Sales Hub product in order to use the "Send Later" feature. If you use the 'Gmail and Outlook Integration', the Sales Hub product will scan the content of your outgoing emails to identify which emails you've elected to track in order to provide you with the notifications feature. If you opt to use our template building tools, the Sales Hub product will scan the content of your sent emails to identify possible templates for use by Users of your HubSpot account. By using the 'Gmail and Outlook Integration' with the Sales Hub product, you grant us the right to access and use your information and data as described in this section. If you do not agree to the terms in this section, you should not use the Sales Hub product.

The intent of having all those permissions is so that if you ever want to use features across HubSpot that use that data, you wouldn’t need to reconnect your gmail account. We understand that some users want more scoping around permissions, and that’s something that the team plans to tackle this year. From myself and the team who is in charge of this product: we hear you, and we get it-- there are some limitations around what we can currently do now, but we hope to change that in the future. If you are unwilling to connect your account, we totally understand, and we can let you know when we have more defined connections in the future. 

Thank you,
Jenny

[Stobber]

Thanks for the thorough follow-up. I really appreciate your effort. I would like more granularity with access permissions; I look forward to seeing those changes in the future.

[CarolineG]

I completely agree with Stobber. Granting this much access to our Google Drive is out of the question, and we haven't found a good work-around yet. More granularity is needed ASAP!!

[richardsteven]

Great to hear that this is being addressed.  Can you confirm that hubspot customers will be able to grant access to gmail and calendar but not provide access to Drive?  That is my main concern. 

Also can you please provide an update ETA as I am paying $$$ for hubspot and only using a fraction of the integrated functionality because of this security limitation.

Thanks in advance.

[jennysowyrda]

Hi @richardsteven,

Currently there is no timeline around changes to these permissions. This feedback has been passed along to the team, and if and when updates are available, they will be communicated with customers. 

Thank you,
Jenny

[Morten_Olsson]

Hi @jennysowyrda 

We're an IT-Operations and consultancy firm and our management has prohibited connection between HubSpot and our G-Suite because of the permissions that HubSpot needs.

The specific permissions that are definately a no-go are these:

"Read, compose, send and permanently delete all your email from Gmail"

"View and modify but not delete your email"

"See and download all your Google Drive files"

"See, edit, download and permanently delete all contacts"

"See, edit, create and delete your spreadsheets in Google Drive"

"See, edit, share and permanently delete all the calendars you can access using Google calendar"

The above list is basically an IT-Security professional's worst nightmare. Now, I appreciate that you are limited by Google's API and what that offers, but that doesn't really change our stance towards this 🙂

Please proiritize this highly.

Cheers

Morten Olsson

Marketing Manager and Business Development Manager

Netic A/S

Denmark

[rw1982]

In my opinion, it´s a critical thing to solve. I would love to share the calendar but I can´t accept full access to the Google Drive.

[slieutaud]

Hi Jenny,
any news on that feature ETA a year and a half after it was first requested ?
Thanks,

[ronpe]

that's very unfortunate. The blanket permission is a little too wide for my taste. You're essentially asking us to give full permission to a 3rd party to be able to have access to a LOT of information that is sometimes very sensitive information. In case that you will suffer an 'accidental security breach' or some of your staff forgets a laptop somewhere - my sensitve files in google drive are copied to the web forever... that's a little more than what my team is comfortable at the moment. 

There must be a better way. This is just a little too much.

[cognidox_vittal]

I'd like to add my voice to the crowd saying these permissions are way too open for many people.

Manage the list of domains you control is needed for email access - really?

You really need to be able to cut down on the access rights required by the email/calendar integration.

Regards

Vittal

[zcashero]

So I have a different use case that is blocked by this same problem. I agree with more fine-grained configurations for permissions access, but I am especially frustrated because it seems that I can't integrate the Google Calendar in the way that I need it.

I am using Google Calendar with a Google Account that I have set up under a different domain (@mydomain.com), but I don't want to enable a gmail account under this same Google Account, so I am strictly using it for Google Calendar so that the primary email address is @mydomain.com and is not @gmail.com so that my invitations come from my business email and not a @gmail.com email address. I am not interested in using G Suite because we have no need for using any of the other applications besides Google Calendar.

Therefore, I am trying to connect a Google Account to the Meetings integration to use in Hubspot, but there is no Gmail account associated with this Google Account. After a bit of deduction and looking at the error log, it seems that is not allowed because it is trying to integrate everything all at once (gmail, calendar, Drive, contacts, etc.). Therefore, it gives me an error that there is a connection problem.

First I try to integrate the Google Calendar through the Meetings tool. I try to connect it, and it asks me to sign into my Google Account (@mydomain.com), so I sign in, accept the permissions, and it tells me there is a connection error, but it is not very explicit.

After that, I noticed that there was a new inbox under Email Integrations that tried to connect a Gmail account to @mydomain.com (where one doesn't exist), and of course it couldn't complete the connection, so it shows it as disabled. 

Out of curiosity, I tried to "Reconnect" the Gmail email integration. It led me through the same steps, to log into the account and accept the permissions, but this time it gave me an error log, and I received the following error.

GmailSubscriptionError{type=STOP, error=googleApiErrorForApiRequest(GoogleApiError{error=ErrorBody{errors=[Error{domain=global, reason=failedPrecondition, message=Bad Request}], code=400, message=Bad Request}})}

So, basically, this is blocking me from being able to use my Google Calendar with my work email address and integrate it with the Meetings tool in Hubspot. 

Note: I have already tried creating a Gmail account associated with this Google account in order to successfully integrate to Hubspot, but this does not work for us, because after that, the primary email address of the Google account is @gmail.com instead of @mydomain.com which would look unprofessional and confusing to send out meeting invitations from a @gmail.com email address.

@jennysowyrda any solutions or workaround would be much appreciated to be able to use the Meetings tool, as we're moving up to the Sales Professional and Marketing Professional in the next couple weeks and want to integrate everything we can. 

[jennysowyrda]

Hi @zcashero,

Can you confirm that the email address you are looking to connect is hosted by Google or Office 365? Your inbox will need to be hosted by one of these providers in order for it to be compatible with the meetings tool.

For more information, I wanted to share this resource.

Thank you,
Jenny

[zcashero]

Hi @jennysowyrda , no it is not hosted by Google or Office 365. That is exactly my use case that I am trying to make known here. I just want to use my Google Calendar, and not the email integration. The problem as I see it, is that there is no reason for the Google Calendar integration to rely on an email integration. A user should be able to integrate only  their Google Calendar and not their inbox.

From the documentation:

When you connect a calendar to the meetings tool, the associated inbox will connect in your email integration settings. However, once your calendar is integrated, you can disable the inbox connection without disabling the calendar connection.

So for some reason, it requires the inbox connection just to create the integration, and then it can be disabled after that. What I am requesting to be considered by the technical implementation team is that it doesn't require an inbox connection because I have no desire to host my emails on Google or Office 365.

Best,

Zach

[jennysowyrda]

Hi @zcashero,

Thank you for clarifying and sharing your feedback. 🙂 

Best,

Jenny

[LarryH]

Hi,

Same issue for me.  Can't provide that much Google access to HubSpot, which is a shame, because I want to link calendars.

Separate question:  Does linking with Google Calendar include linking to Google Tasks?

Cheers

[jacobjoseph]

Any update on this?

I can not use this feature because we have sensitive client data in Google Drive.. We do not use ANY Hubspot features with Google Drive. 

These permissions are way too permissive.

I understand you would need to ask for consent more than once for different features, but requesting such invasive permissions is very concerning about Hubspot's ability to understand information security.

It's also frustrating because the meeting feature is one that I was most interested in using immediately.

[jacobjoseph]

In what scenarios do you need access to see and download ALL of my Google Drive files?

[jacobjoseph]

This should really be a high priority issue. It's a major security vulnerability and I am not sure we can use Hubspot going forward if Hubspot does not prioritize information security.

[jacobjoseph]

That's not reasonable or acceptable... "Hey can I have the keys to your house and safety deposit box... just in case I need them later... I promise not to use them but I will also make them available to some of my employees."

[francescov]

I'd like to add my voice raising these privacy concerns.

Hubspot is a great business tool but is not worth giving away all our data and know-how. Please let us know when the permission range will be cut off. We'd like to move on a paid subscription but will surely not until that important issue is tackled.

Thank you,

Francesco

[Paradigm]

This is a huge issue for us also, the data permission is very wide and feels to much.

Hubspot, please could you update on whether there has now been any change to this?

Many thanks

Kitty

[TSteiger-CA]

Any ETA on these premissions being restricted? Or can you allow calendar events to be added by an external API call so someone can build a tool that allows for pushing calendar information to your booking solution as opposed to needing full access to all of G-Suite?

[RJVH]

I was excited to using the Google Calendar "Book a meeting" integration as well, but stopped short of connecting it with my Google Account since it's asking to have access to all of my Google Drive and more. There's no way I am legally granting a third-party company halfway across the world access to all of my Google Drive just so that people can book in a meeting in my Google Calendar... Imagine if there's a security breach?

Any idea when this will be resolved? For now, I will need to look elsewhere.

[tombradley]

Is there any news on this feature? It's shame because the meeting scheduler looks like an excellent feature that I would really like to take advantage of but granting access to our entire G-Suite to a third party just isn't acceptable.