HubSpot

Downstream

Who's behind HubSpot, as listed in its own subprocessor documents. 13 subprocessors.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'.

Documents read

• privacy policy https://legal.hubspot.com/privacy-policyHTTP 200 · 2026-10-13
• dpa https://legal.hubspot.com/dpaHTTP 200 · 2026-10-13
• subprocessors https://trust.hubspot.com/legal/subprocessorsHTTP 200 · 2026-10-29

Document changes

• high 2026-10-29 · subprocessors +24 / −0 lines
  show diff

  + Oct 28, 2026, 15:05 UTC

  + HUBSPOT CMS SSTI VULNERABILITY RESOLVED

  + On October 13, 2026, HubSpot’s security team received a report from an external security research firm describing a Server-Side Template Injection (SSTI) vulnerability in a CMS preview endpoint on HubSpot-hosted domains. Under certain conditions, an unauthenticated party could have used this issue to cause HubSpot’s template engine to evaluate crafted input and retrieve CRM data associated with a HubSpot account.

  + We validated the report within hours, deployed protective controls, and released a permanent fix the same day. No action is required from customers.

  + About the Issue

  + Building assets in HubSpot CMS is based on HubL, the HubSpot Markup Language. HubL is our extension of Jinjava, a templating engine based on Jinja. It was reported that HubL template expressions were susceptible to SSTI, which would then be evaluated server-side by our platform’s rendering engine. HubL executes within a context that has access to HubSpot’s CRM data sources. This meant that a crafted template against our preview endpoint could be used to read records in the CRM. We classified this issue as a critical finding. An SSTI vulnerability of this nature impacts the trust boundary between the unauthenticated website visitor and our customer’s CRM.

  + Our Response

  + We initially received the report October 13 at 2:17 AM EDT. Our security teams triaged the issue and immediately began working to quickly resolve the issues with a focus on rapid validation, immediate protection, and a permanent fix.

  + By 7:44 AM EDT, a Web Application Firewall (WAF) rule was in place across HubSpot to block exploitation of the vulnerability initially reported to us, as well as variants our teams identified during our response.

  + By 10:35 AM EDT, we deployed and verified our permanent fix to production.

  + The reporting security research firm confirmed on October 14 that they were no longer able to reproduce the issue.

  + As part of our commitment to customer trust, our team's variant hunt identified opportunities to prevent and detect similar vulnerabilities through improved controls. We implemented the following structural changes as well:

  + HubL functions that read CRM data require valid signed requests when rendering outside an authenticated context

  + Signature enforcement coverage for staged, versioned, and scheduled previews

  + Allowlist for HubL rendering to ensure explicit trust for permitted contexts

  + Additional checks at build and runtime to detect signature-enforcement misconfigurations

  + Investigation Status

  + As we triaged, we also investigated any indications that this vulnerability had been exploited. We were able to identify and detect test traffic from the reporting security research firm. Using this information, we searched our logs for any indication this had been abused by actors other than the reporting party. After thorough review, we have no evidence that this issue was exploited. We will update this advisory if our findings change. At this time, we consider the reported issue resolved.

  + Customer Action

  + No action is required. A fix was applied to HubSpot’s infrastructure and does not require any actions or changes to your Hubspot account, content, or integrations.

  + Acknowledgment

  + We thank Tomais Williamson, Adam Kues, and Shubham Shah at Searchlight Cyber for reporting this issue to HubSpot’s security team.

  + In addition to our internal red teaming resources, HubSpot highly values input from third party researchers. Researchers are welcome to report issues through our bug bounty program at HackerOne.

  + Contact HubSpot Support with additional questions.
• medium 2026-10-24 · subprocessors +3 / −0 lines
  show diff

  + October 23, 2026 Update:

  + Customers using HubSpot’s all-in-one WordPress plugin should follow PHP’s guidance to take the appropriate steps to secure the instance of PHP their site is using, or check with your hosting provider to ensure they have done so already. There is no patch necessary for the HubSpot plugin for WordPress.

  + Customers using PHP elsewhere in their own environments should upgrade PHP to the most recently patched version.
• medium 2026-10-22 · subprocessors +3 / −0 lines
  show diff

  + Oct 22, 2026, 02:54 UTC

  + HUBSPOT UPDATE ON PHP VULNERABILITY

  + HubSpot is aware of the recently disclosed PHP security vulnerability. PHP is not part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes.
• medium 2026-10-13 · subprocessors +0 / −19 lines
  show diff

  − 42 Documents

  − SOC 1 Type II

  − SOC 2 Type II

  − EU Cloud Code of Conduct

  − TRUSTe Certified Privacy

  − KNOWLEDGE BASE FAQS263

  − Access Management

  − Application and Data Security

  − Cloud Security

  − Continuity and Disaster Recovery

  − Device Management

  − Incident Management

  − Network Security

  − Personnel Security

  − Physical Security
• low 2026-10-13 · dpa +0 / −1 lines
  show diff

  − Scroll Left Scroll Right
• low 2026-10-13 · privacy policy +0 / −1 lines
  show diff

  − Scroll Left Scroll Right
• low 2026-09-17 · dpa +1 / −1 lines
  show diff

  + Last Modified: September 16, 2026

  − Last Modified: April 14, 2026
• high 2026-09-17 · privacy policy +16 / −14 lines
  show diff

  + Last Modified: September 16, 2026

  + (iii) Internet or network information, such as browsing and search history. We collect this information directly from your device or from emails sent through our platform.

  + 10.1 Google reCAPTCHA. We have implemented Google reCAPTCHA Enterprise on our websites and products for security, fraud, and abuse prevention.

  + 10.3 Google Maps Integration. We use the Google Maps API to provide address autocompletion and validation to provide our products and services to you. When you use features powered by Google Maps, information you enter such as address inputs may be transmitted to Google to provide these features. Google processes this data as an independent data controller under its own privacy policy and the Google Maps/Google Earth Additional Terms of Service.

  + 10.4 Gmail Integration. If you use the Gmail integration or choose to integrate any other Google Workspace application with HubSpot, you will be asked to give us access to information from your Gmail or Google account.

  + 10.5 Google Calendar Integration. The Subscription Service will have access to both your Google Calendar and any other calendar you access via Google in order to power our Meetings tool, and allow you to associate events with contacts in your HubSpot account. The Subscription Service will have the ability to: create or change your calendars, and update individual calendar events.

  + 10.6 Google Drive Integration. As part of connecting your Google Drive, the Subscription Service will be able to: see your documents, sheets, and slides, upload and download your documents, sheets, and slides, and store contents and titles of your documents, sheets, and slides.

  + 10.7 Google Search Console. As part of this integration, the Subscription Service will be able to view, manage and store properties which include the list of sites and domains you control in HubSpot and the Search Console data for your connected properties.

  + 10.8 Chrome Extensions.

  + 10.8.1 Sales Extension. You can install the HubSpot Sales Chrome Extension to track Gmail and Google Workspace emails through your Chrome browser. Once installed, the Extension can read and change all your data on the websites you visit and display notifications. It logs all emails from Gmail and can be used in conjunction with the Inbox Integration.

  + 10.8.2 Social Extension. The HubSpot Social Chrome Extension allows sharing of pages, text, and images from around the web with the HubSpot Social Composer tool. You are able to draft or schedule posts, assign campaigns, and then see posts on the Social Calendar tool or in Social Reports once published.

  + 10.9 Additional Limits on Use of Your Google User Data.

  + 10.9.1 Google API Limits. HubSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  + 10.9.2 Google Workspace API Limits. Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.

  + 10.9.3 YouTube API Limits. HubSpot complies with the YouTube API Services Developer Policies available at https://developers.google.com/youtube/terms/developer-policies. Any stored public YouTube API data is refreshed or completely deleted within 30 calendar days, or deleted immediately upon user request.

  + 10.10 YouTube Integration. If you are a HubSpot Customer and choose to use the YouTube integration with your HubSpot Subscription Services, you will be asked to give us access to information from your YouTube account and have the option to link your accounts.

  − Last Modified: April 14, 2026

  − (iii) Internet or network information, such as browsing and search history. We collect this information directly from your device.

  − 10.1 Google reCAPTCHA. We have implemented Google reCAPTCHA Enterprise on certain products and services to prevent malicious software from engaging in abusive activities on our websites.

  − 10.3 Gmail Integration. If you use the Gmail integration or choose to integrate any other Google Workspace application with HubSpot, you will be asked to give us access to information from your Gmail or Google account.

  − 10.4 Google Calendar Integration. The Subscription Service will have access to both your Google Calendar and any other calendar you access via Google in order to power our Meetings tool, and allow you to associate events with contacts in your HubSpot account. The Subscription Service will have the ability to: create or change your calendars, and update individual calendar events.

  − 10.5 Google Drive Integration. As part of connecting your Google Drive, the Subscription Service will be able to: see your documents, sheets, and slides, upload and download your documents, sheets, and slides, and store contents and titles of your documents, sheets, and slides.

  − 10.6 Google Search Console. As part of this integration, the Subscription Service will be able to view, manage and store properties which include the list of sites and domains you control in HubSpot and the Search Console data for your connected properties.

  − 10.7 Chrome Extensions.

  − 10.7.1 Sales Extension. You can install the HubSpot Sales Chrome Extension to track Gmail and Google Workspace emails through your Chrome browser. Once installed, the Extension can read and change all your data on the websites you visit and display notifications. It logs all emails from Gmail and can be used in conjunction with the Inbox Integration.

  − 10.7.2 Social Extension. The HubSpot Social Chrome Extension allows sharing of pages, text, and images from around the web with the HubSpot Social Composer tool. You are able to draft or schedule posts, assign campaigns, and then see posts on the Social Calendar tool or in Social Reports once published.

  − 10.8 Additional Limits on Use of Your Google User Data.

  − 10.8.1 HubSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  − 10.8.2 Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.

  − 10.9 YouTube Integration. If you are a HubSpot Customer and choose to use the YouTube integration with your HubSpot Subscription Services, you will be asked to give us access to information from your YouTube account and have the option to link your accounts.
• medium 2026-09-06 · subprocessors +2 / −2 lines
  show diff

  + Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot..txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.

  + Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot..

  − Our investigation revealed a number of new Indicators of Compromise which we’ve provided in the TXT file here: https://www.hubspot.com/hubfs/Security/2025-09-09-drift-iocs.txt. Our intelligence sources indicate these IPs are operated by Oculus Proxies.

  − Though the investigation is ongoing, based on our current assessment of the incident, we believe that the impact will be isolated to a small subset of the HubSpot customer base. We will post an update at the end of the investigation in the spirit of continued transparency. We have also posted this update to our Investor Relations page at https://ir.hubspot.com/news-releases/news-release-details/hubspots-statement-regarding-june-22-2024-security-incident.
• high 2026-09-06 · dpa +1 / −1 lines
  show diff

  + “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org..pdf , as may be amended, superseded, or replaced.

  − “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf , as may be amended, superseded, or replaced.

Fact changes

• medium 2026-09-05 · 0 field change(s), +12/−0 subprocessors, +0 model providers

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.