Openwake · evidence pack

HubSpot

https://www.hubspot.com · record 707 · read 2026-10-22 · rules/v1 · generated 2026-10-23 04:22 UTC

Facts

Trains on customer data
no
“Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.”
privacy policy · https://legal.hubspot.com/privacy-policy · confidence 0.60
Opt-out mechanism
none described
No supporting text found in the documents read.
privacy policy · https://legal.hubspot.com/privacy-policy · confidence 0.20
AI features
present
“When you use our products and services we may process personal data to develop, support, and improve HubSpot AI features and to train our AI models and similar products and services that rely on machine learning.”
privacy policy · https://legal.hubspot.com/privacy-policy · confidence 0.55
Model providers named
Replicate
“Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary instance. All databases are backed up and maintained using at least industry standard methods.”
dpa · https://legal.hubspot.com/dpa · confidence 0.60
Retention
not stated
No supporting text found in the documents read.
privacy policy · https://legal.hubspot.com/privacy-policy · confidence 0.20
Hosting regions
not stated
No supporting text found in the documents read.
privacy policy · https://legal.hubspot.com/privacy-policy · confidence 0.20
Subprocessor notice
30 days
“We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
dpa · https://legal.hubspot.com/dpa · confidence 0.55

Subprocessors (13)

NameCategoryLocationQuoted from
Replicatemodel providerunstated
“Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary instance. All databases are backed up and maintained usi”
Oktaotherunstated
“SECURITY ADVISORY: VISHING-BASED ATTACKS TARGETING OKTA SSO ACCOUNTS”
Gainsightotherunstated
“HUBSPOT UPDATE ON GAINSIGHT INTEGRATION SECURITY INCIDENT Based on our investigation into Gainsight integration activity along with published indicators of compromise (IOCs), we have found no evidence”
Salesforceotherunstated
“HubSpot will continue to follow Gainsight’s investigation updates, and customers should continue to visit Gainsight's status page and Salesforce's status page for updated information.”
Driftotherunstated
“HUBSPOT UPDATE ON SALESLOFT DRIFT SECURITY INCIDENT SEPTEMBER 12, 2025”
Salesloftotherunstated
“HUBSPOT UPDATE ON SALESLOFT DRIFT SECURITY INCIDENT SEPTEMBER 12, 2025”
Clearbitotherunstated
“* Clearbit SOC 2 Report - Legacy * Clearbit TRUSTe Certification - Legacy”
Dropboxotherunstated
“HUBSPOT UPDATE ON DROPBOX SIGN SECURITY INCIDENT On May 2, 2024, HubSpot was notified by our service provider, Dropbox, about a security incident involving their e-signatures service. This service is ”
Stripeotherunstated
“* As of 01/15/2022, HubSpot launched a new HubSpot Payments Tool powered by Stripe. SOC 2 controls were designed/implemented/validated for Stripe prior to the public launch and are included in our new”
Amazon Web Serviceshyperscalerunstated
“* We have requested details of any potential vulnerabilities from all sub-processors of the HubSpot product, and are monitoring their responses. HubSpot’s most important sub-processors, including Amaz”
Google Cloudhyperscalerunstated
“* We have requested details of any potential vulnerabilities from all sub-processors of the HubSpot product, and are monitoring their responses. HubSpot’s most important sub-processors, including Amaz”
Snowflakeotherunstated
“* We have requested details of any potential vulnerabilities from all sub-processors of the HubSpot product, and are monitoring their responses. HubSpot’s most important sub-processors, including Amaz”
Cloudflareotherunstated
“* We have requested details of any potential vulnerabilities from all sub-processors of the HubSpot product, and are monitoring their responses. HubSpot’s most important sub-processors, including Amaz”

Sources read

DocumentURLReadContent hashLedger
privacy_policyhttps://legal.hubspot.com/privacy-policy2026-10-1373b116da19772837…seq 53151
dpahttps://legal.hubspot.com/dpa2026-10-1358ac4c73aae4e9de…seq 53152
subprocessorshttps://trust.hubspot.com/legal/subprocessors2026-10-224781efe8b218bf43…seq 64166
Ledger proof for this record.
seq 64182 · key 2f898a895f05b7a0 · 2026-10-22T05:19:27.938Z
hash f0bde867294d7e705583967428354c114808031c0edb0f149219fbfbcb915d30
prev 3131dff73890854cc61ac4e3bce427754527ecdf79a1616fe51eaa253e650bef
payload 570cda91f805e8b7e3aba8a6572e89245b13f5a64c1f164d81dc40d4a64c87c2
signature ncTvfTxMWrwfyIC6fTFgBhIkdKaCqqDjszsi9gXiO9OKYFxMUb9GIdLJOjEKE49e59XIEI+eZWYPAzp+8WQDCg==
anchored 2026-10-22 at head seq 64204 68332ccffa8b4c79780bf1a01284351ca72309d4c1746ababe798f1ed346c99d
Fetch /v1/keys; for each ledger entry recompute sha256(prev_hash|kind|ref_id|payload_hash|created_at ISO) and verify the Ed25519 signature over that hash. Anchors are committed to git; compare the anchored head with the chain.