HubSpot sensitive data settings and exports: what to scrub

Where does sensitive data sit in HubSpot?#

Sensitive data in HubSpot sits in three layers: standard contact properties such as names, emails and phone numbers; activity records such as notes, logged emails, calls and meetings; and the custom properties and attachments each team added for its own needs. The first layer is obvious; the other two are where scrubs fail.

Activity records hold whatever people typed or forwarded. A rep's note can mention a buyer's family situation; a logged email can carry a signature block, a forwarded invoice with bank details or a quoted thread from a personal address. Call records can include recordings and transcripts of everything said.

HubSpot offers settings for handling sensitive data on some subscriptions. Which plans include them, and how they affect exports, change over time, so check HubSpot's current documentation rather than assuming any field is left out. If your portal uses them, list every property marked sensitive, treat each as drop by default, and record which export route you used and whether those properties came through.

Which HubSpot objects export with personal data?#

Every HubSpot object a licensing project might touch carries some personal data, but the amount, and the value of what surrounds it, differ sharply. The table sets out the usual picture for a B2B company's portal.

Treat the default column as a starting position. A company whose deal notes are thin, or whose tickets live in a separate help desk, will weight the objects differently.

What CRM data can and cannot be licensed#

CRM data that can be licensed is the record of how work moved: how tickets were triaged and resolved, how deals advanced or stalled, which objections came up and how reps answered them. The identity layer usually cannot, or should not, be licensed: who the contacts are, how to reach them and what they clicked.

The split follows both value and risk. AI developers looking for operational data want decisions and outcomes, not address books. Contact and tracking data is mostly personal information, often collected under marketing notices that never contemplated licensing, and California generally covers business contact data even where some other states exempt it.

Ownership is a separate check. If your portal holds records you manage on behalf of clients, or data customers entered through a shared portal, confirm your rights before including any of it.

The HubSpot export scrub checklist#

The HubSpot export scrub checklist runs from scope to verification, and each step should be logged so the privacy record can be built from the log.

Plan for more than one export route. HubSpot's export help article says a standard record export carries the records' current property values and associations, while activities such as calls and notes need a separate export method. Confirm the activity route your portal supports in HubSpot's current documentation before you commit to a schedule.

If an engineer would rather pull activities through HubSpot's APIs, read the current Developer Terms first. HubSpot's developer changelog says they restrict using data accessed through its APIs to train, fine-tune or improve AI or machine learning models, with a carve-out for legitimate single-customer use cases. Ask counsel how that applies before API-extracted records go into a licensed dataset.

• 1Take the full export before the subscription ends. HubSpot's Product Specific Terms say that for subscriptions such as Sales, Service, CMS and Operations Hub, it provides no access to customer data after termination or expiration.
• 2Decide scope by object: usually tickets, deals with stage history and selected activity records, with contacts, marketing and tracking data left out.
• 3Inventory every custom property and custom object, with its purpose and sample values, and mark each one keep, tokenize or drop.
• 4Export with record IDs and associations so tickets, deals and activities still link after names are removed.
• 5Replace people with consistent tokens across objects, so one customer or rep keeps the same token throughout.
• 6Strip email signatures, quoted reply chains, legal footers and forwarded headers from logged emails before redaction.
• 7Run a redaction pass over all free text for names, emails, phones, addresses, card and bank numbers.
• 8Exclude call recordings and attachments unless a separate review method is agreed.
• 9Sample by hand across years, teams and record types, then fix rules and rerun.

Custom properties: the field-by-field review#

Custom properties need a field-by-field review because they hold whatever a team once decided to track. Over years of use, portals collect fields such as a personal mobile number, a birthday, the last digits of a payment card or a churn reason typed as free text.

Where a field's purpose is unclear, ask the team that created it. Unknown fields are dropped by default and added back only once someone explains them.

Illustrative: a software company scrubs HubSpot before migrating#

Illustrative: a fictional company that sells inventory software to building supply dealers is moving from HubSpot to another CRM. Well before its HubSpot subscription ends, the CTO exports tickets, deals with stage history and logged activities, and considers licensing the support and sales records.

The custom property review finds fields for personal mobile numbers and payment card digits, and both are dropped. Logged emails carry signatures and forwarded invoices with bank details, so signatures, quoted chains and attachments are removed before the redaction pass. Contacts and marketing data are left out of scope entirely.

What remains is a linked history of support tickets and resolutions, plus deals with stage changes and loss reasons, with people and customer companies tokenized. The company keeps the raw export in restricted storage under its retention schedule and prepares only the scrubbed copy for review.

How SourceX scopes CRM records#

SourceX scopes CRM records around process content rather than contact data. In the SourceX five-step transaction, Supply identifies which objects hold decisions and outcomes, Rights confirms the company controls them, and Preparation removes personal details before the supplier approves anything.

Scope decisions, the action taken on each custom field and what the sample review found all go into the SourceX Evidence Packet's privacy record. During the initial assessment, SourceX asks which CRM and help desk the company uses and how many years they cover, not for exports.