--- title: HubSpot Security and Compliance — Draidel description: HubSpot security and compliance for regulated buyers. SOC 2 and ISO 27001 questions answered, SSO and two-factor enforced, consent and retention designed in. --- Draidel. **000***%* We build companies — Edition 2026 [Skip to content](https://www.draidel.com/hubspot-security-compliance#main-content) [Draidel.](https://www.draidel.com/) 01[Menu](https://www.draidel.com/hubspot-security-compliance#k-menu) Miami · Six markets · Since 2015 [*01*Services](https://www.draidel.com/services)[*02*Industries](https://www.draidel.com/industries)[*03*HubSpot](https://www.draidel.com/hubspot)[*04*Platforms](https://www.draidel.com/platforms)[*05*About](https://www.draidel.com/about)[*06*Events](https://www.draidel.com/events)[*07*Contact](https://www.draidel.com/contact) [Services](https://www.draidel.com/services) - [Go To Market](https://www.draidel.com/go-to-market) - [RevOps](https://www.draidel.com/revops) - [AI & Data](https://www.draidel.com/ai-data) - [Engineering](https://www.draidel.com/engineering) [Industries](https://www.draidel.com/industries) - [SaaS](https://www.draidel.com/industries/saas) - [Law Firms](https://www.draidel.com/industries/law-firms) - [Mass Torts](https://www.draidel.com/industries/mass-torts) - [AI](https://www.draidel.com/industries/ai) - [Home Care Agencies](https://www.draidel.com/industries/home-care-agencies) - [Health Care](https://www.draidel.com/industries/health-care) - [BPO](https://www.draidel.com/industries/bpo) - [Venture Capital](https://www.draidel.com/industries/venture-capital) - [View all→](https://www.draidel.com/industries) [HubSpot](https://www.draidel.com/hubspot) - [Audit](https://www.draidel.com/hubspot-audit) - [Onboarding](https://www.draidel.com/hubspot-onboarding) - [Consulting](https://www.draidel.com/hubspot/consulting) - [Implementation](https://www.draidel.com/hubspot-implementation) - [Migration](https://www.draidel.com/hubspot/migration) - [Integration](https://www.draidel.com/hubspot/integration) - [Development](https://www.draidel.com/hubspot/development) - [Training](https://www.draidel.com/hubspot/training) - [Pricing](https://www.draidel.com/hubspot-pricing) [Platforms](https://www.draidel.com/platforms) - [Salesforce](https://www.draidel.com/salesforce) - [NetSuite](https://www.draidel.com/netsuite) - [Microsoft Dynamics](https://www.draidel.com/microsoft-dynamics) - [ClickUp](https://www.draidel.com/clickup) - [Intercom](https://www.draidel.com/intercom) - [Notion](https://www.draidel.com/notion) - [Snowflake](https://www.draidel.com/snowflake) - [Databricks](https://www.draidel.com/databricks) - [View all→](https://www.draidel.com/platforms) Company - [About](https://www.draidel.com/about) - [Ventures](https://www.draidel.com/ventures) - [Case studies](https://www.draidel.com/case-studies) - [Events](https://www.draidel.com/events) - [Partners](https://www.draidel.com/partners) - [Compliance](https://www.draidel.com/compliance) - [Contact](https://www.draidel.com/contact) 66 West Flagler St, Miami [Start a project →](https://www.draidel.com/contact) [Close](https://www.draidel.com/hubspot-security-compliance#site-header) HubSpot # HubSpot *security* and compliance. The answer your security review is waiting for. For regulated industries the first question about any system is not what it does. It is who can see the data, where it lives, how long it is kept and what happens when somebody asks for it to be deleted. SOC 2ISO 27001SSORetention The problem ## The deal stalled in *procurement.* The buyer sent a security questionnaire and nobody can answer the HubSpot sections. Meanwhile your own portal has dormant admins, no enforced two-factor, consent that is captured and never read, and no retention position anyone has written down. ## Nobody wrote the *position* down. Security — the questionnaire What we address ## What a review actually examines. ### Platform certifications, correctly stated What HubSpot itself certifies against, what that does and does not cover, and which obligations remain yours as the data controller. Most questionnaire failures are misstatements, not gaps. ### Access control SSO against your directory, enforced two-factor, permission sets by role, dormant account review and a documented joiner and leaver process. ### Consent and lawful basis Consent captured per region and actually read by sending logic and tracking. A banner nothing else obeys is worse than no banner, because it documents the failure. ### Retention and deletion A written retention position and a deletion process that reaches HubSpot, the warehouse and the integrations. Subject requests run on a clock. ### Where sensitive data should not be For health, defence and financial clients the important design decision is what never enters the CRM. Drawing that boundary is cheaper than defending it later. ### Audit trail Login history, change logs and integration activity retained and reviewable, so an incident question has an answer. How it runs ## Audit, architect, build, hand over. 01 ### Audit The portal read end to end — objects, properties, automation, permissions, integrations and the reports leadership actually opens. 02 ### Architect The model written down before it is built: objects, lifecycle, ownership and the definitions every report has to agree on. 03 ### Build Configuration, automation and integration built to that model, in a sequence that leaves the team working throughout. 04 ### Hand over Documentation, enablement for the people who run it daily, and a period operating alongside your team until it is genuinely theirs. Where it usually goes wrong ## Compliance as a *document.* A policy that says consent is honoured, sitting beside a workflow that emails everyone regardless, is worse than no policy. The only compliance that survives scrutiny is enforced by the configuration. We build the enforcement and then the document describes something true. Frequently asked ## What people ask before they *commit.* Is HubSpot SOC 2 compliant? HubSpot maintains the certifications you would expect of a platform at its scale, and publishes them. The part that matters for your review is which obligations remain yours as the controller, and that is a configuration question about your portal. Can HubSpot be used for regulated data? It depends entirely on the regime and the data. For health data in the US it is a question of what is in scope and what agreements are in place. Our usual advice is to design so that the most sensitive data never enters the CRM at all. Can you complete our security questionnaire? The HubSpot-specific sections, yes, and we do it regularly. We can also advise on the configuration changes that turn a weak answer into a strong one. How do we handle deletion requests? With a documented process covering HubSpot, any warehouse copy, integrated systems and backups. Deleting a contact in the CRM alone is not compliance, it is the appearance of it. What about data residency? HubSpot offers EU data hosting, with conditions. Whether that satisfies your requirement depends on the requirement, and we will read it with you rather than guess. Next ## Where people go from here. ### [The whole HubSpot practice Consulting, development, integration, migration and training, from a Platinum partner that is an engineering firm first.](https://www.draidel.com/hubspot) ### [HubSpot Okta and SSO integration The implementation side — SSO, two-factor and consent plumbing.](https://www.draidel.com/hubspot-okta-sso-integration) ### [Compliance How Draidel handles data, and what we sign.](https://www.draidel.com/compliance) ### [Defense Where the boundary decision is the entire architecture.](https://www.draidel.com/industries/defense) Operators we build with ![Thales](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/thales.svg)![Imperva](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/imperva.png)![Cameo](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/cameo.png)![Moz](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/moz.png)![APMEX](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/apmex.png)![RaySecur](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/raysecur.svg)![Bolster](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/bolster.png)![Huify](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/huify.svg)![Regency Health Care](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/regency.svg)![Niche Academy](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/niche-academy.svg)![Thales](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/thales.svg)![Imperva](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/imperva.png)![Cameo](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/cameo.png)![Moz](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/moz.png)![APMEX](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/apmex.png)![RaySecur](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/raysecur.svg)![Bolster](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/bolster.png)![Huify](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/huify.svg)![Regency Health Care](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/regency.svg)![Niche Academy](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/logos/niche-academy.svg) Start a project ## Answer the *questionnaire.* ## Tell us what you are running What the system does today, where it breaks, and when it has to work. An engineer reads it — you get an answer inside one business day, not a sequence. [All HubSpot services →](https://www.draidel.com/hubspot) #### [Services](https://www.draidel.com/services) - [Go To Market](https://www.draidel.com/go-to-market) - [RevOps](https://www.draidel.com/revops) - [AI & Data](https://www.draidel.com/ai-data) - [Engineering](https://www.draidel.com/engineering) #### [Industries](https://www.draidel.com/industries) - [SaaS](https://www.draidel.com/industries/saas) - [Law Firms](https://www.draidel.com/industries/law-firms) - [Mass Torts](https://www.draidel.com/industries/mass-torts) - [AI](https://www.draidel.com/industries/ai) - [Home Care Agencies](https://www.draidel.com/industries/home-care-agencies) - [Health Care](https://www.draidel.com/industries/health-care) - [BPO](https://www.draidel.com/industries/bpo) - [Venture Capital](https://www.draidel.com/industries/venture-capital) - [View all→](https://www.draidel.com/industries) #### [HubSpot](https://www.draidel.com/hubspot) - [Audit](https://www.draidel.com/hubspot-audit) - [Onboarding](https://www.draidel.com/hubspot-onboarding) - [Consulting](https://www.draidel.com/hubspot/consulting) - [Implementation](https://www.draidel.com/hubspot-implementation) - [Migration](https://www.draidel.com/hubspot/migration) - [Integration](https://www.draidel.com/hubspot/integration) - [Development](https://www.draidel.com/hubspot/development) - [Training](https://www.draidel.com/hubspot/training) - [Pricing](https://www.draidel.com/hubspot-pricing) - [For HubSpot reps](https://www.draidel.com/hubspot/reps) #### [Platforms](https://www.draidel.com/platforms) - [Salesforce](https://www.draidel.com/salesforce) - [NetSuite](https://www.draidel.com/netsuite) - [Microsoft Dynamics](https://www.draidel.com/microsoft-dynamics) - [ClickUp](https://www.draidel.com/clickup) - [Intercom](https://www.draidel.com/intercom) - [Notion](https://www.draidel.com/notion) - [Snowflake](https://www.draidel.com/snowflake) - [Databricks](https://www.draidel.com/databricks) - [View all→](https://www.draidel.com/platforms) #### Company - [About](https://www.draidel.com/about) - [Ventures](https://www.draidel.com/ventures) - [Case studies](https://www.draidel.com/case-studies) - [Events](https://www.draidel.com/events) - [Partners](https://www.draidel.com/partners) - [Compliance](https://www.draidel.com/compliance) - [Contact](https://www.draidel.com/contact) [Draidel.](https://www.draidel.com/) We build *companies*. ![HubSpot Solutions Partner Program — Platinum](https://www.draidel.com/hubfs/raw_assets/34/public/@projects/draidel-2026/draidel-2026-theme/assets/badges/hubspot-platinum-partner.svg) 66 West Flagler St, Miami, FL - - Migrate to HubSpot18 - [Salesforce to HubSpot migration](https://www.draidel.com/salesforce-to-hubspot-migration) - [Pipedrive to HubSpot migration](https://www.draidel.com/pipedrive-to-hubspot-migration) - [WordPress to HubSpot CMS migration](https://www.draidel.com/wordpress-to-hubspot-migration) - [Marketo to HubSpot migration](https://www.draidel.com/marketo-to-hubspot-migration) - [Pardot to HubSpot migration](https://www.draidel.com/pardot-to-hubspot-migration) - [Zoho to HubSpot migration](https://www.draidel.com/zoho-to-hubspot-migration) - [Zendesk to HubSpot migration](https://www.draidel.com/zendesk-to-hubspot-migration) - [Mailchimp to HubSpot migration](https://www.draidel.com/mailchimp-to-hubspot-migration) - [HubSpot to Salesforce migration](https://www.draidel.com/hubspot-to-salesforce-migration) - [HubSpot to HubSpot migration](https://www.draidel.com/hubspot-to-hubspot-migration) - [Webflow to HubSpot CMS migration](https://www.draidel.com/webflow-to-hubspot-migration) - [Blog migration to HubSpot](https://www.draidel.com/hubspot-blog-migration) - [Dynamics 365 to HubSpot migration](https://www.draidel.com/dynamics-365-to-hubspot-migration) - [ActiveCampaign to HubSpot migration](https://www.draidel.com/activecampaign-to-hubspot-migration) - [GoHighLevel to HubSpot migration](https://www.draidel.com/gohighlevel-to-hubspot-migration) - [Monday.com to HubSpot migration](https://www.draidel.com/monday-to-hubspot-migration) - [Podio to HubSpot migration](https://www.draidel.com/podio-to-hubspot-migration) - [Airtable to HubSpot migration](https://www.draidel.com/airtable-to-hubspot-migration) [All migrations→](https://www.draidel.com/hubspot/migration) HubSpot integrations19 - [HubSpot Salesforce integration](https://www.draidel.com/hubspot-salesforce-integration) - [HubSpot NetSuite integration](https://www.draidel.com/hubspot-netsuite-integration) - [HubSpot QuickBooks and Xero integration](https://www.draidel.com/hubspot-quickbooks-xero-integration) - [HubSpot Stripe integration](https://www.draidel.com/hubspot-stripe-integration) - [HubSpot telephony and SMS integration](https://www.draidel.com/hubspot-telephony-sms-integration) - [HubSpot to Snowflake and BigQuery](https://www.draidel.com/hubspot-snowflake-bigquery-integration) - [HubSpot Power BI and Tableau integration](https://www.draidel.com/hubspot-power-bi-integration) - [HubSpot PandaDoc and DocuSign integration](https://www.draidel.com/hubspot-pandadoc-docusign-integration) - [HubSpot Shopify and WooCommerce integration](https://www.draidel.com/hubspot-shopify-woocommerce-integration) - [HubSpot Zapier, Make and n8n integration](https://www.draidel.com/hubspot-zapier-integration) - [HubSpot Jira, Asana and ClickUp integration](https://www.draidel.com/hubspot-jira-asana-clickup-integration) - [HubSpot Zendesk and Intercom integration](https://www.draidel.com/hubspot-zendesk-intercom-integration) - [HubSpot Calendly and webinar integration](https://www.draidel.com/hubspot-calendly-integration) - [HubSpot ZoomInfo and Clearbit integration](https://www.draidel.com/hubspot-zoominfo-clearbit-integration) - [HubSpot Typeform and Jotform integration](https://www.draidel.com/hubspot-typeform-integration) - [HubSpot Okta and SSO integration](https://www.draidel.com/hubspot-okta-sso-integration) - [HubSpot Slack integration](https://www.draidel.com/hubspot-slack-integration) - [HubSpot WordPress integration](https://www.draidel.com/hubspot-wordpress-integration) - [HubSpot Workday integration](https://www.draidel.com/hubspot-workday-integration) [All integrations→](https://www.draidel.com/hubspot/integration) HubSpot development6 - [Hire a HubSpot developer](https://www.draidel.com/hire-hubspot-developer) - [HubSpot website development](https://www.draidel.com/hubspot-website-development) - [HubSpot theme and module development](https://www.draidel.com/hubspot-theme-development) - [HubSpot API development](https://www.draidel.com/hubspot-api-development) - [HubSpot app development](https://www.draidel.com/hubspot-app-development) - [HubSpot email template development](https://www.draidel.com/hubspot-email-template-development) [All development→](https://www.draidel.com/hubspot/development) HubSpot services19 - [HubSpot pricing, explained](https://www.draidel.com/hubspot-pricing) - [HubSpot audit and portal review](https://www.draidel.com/hubspot-audit) - [HubSpot onboarding partner](https://www.draidel.com/hubspot-onboarding) - [HubSpot implementation partner](https://www.draidel.com/hubspot-implementation) - [HubSpot Marketing Hub implementation](https://www.draidel.com/hubspot-marketing-hub) - [HubSpot marketing automation](https://www.draidel.com/hubspot-marketing-automation) - [HubSpot Operations Hub implementation](https://www.draidel.com/hubspot-operations-hub) - [HubSpot Enterprise implementation](https://www.draidel.com/hubspot-enterprise) - [HubSpot security and compliance](https://www.draidel.com/hubspot-security-compliance) - [HubSpot lead generation](https://www.draidel.com/hubspot-lead-generation) - [HubSpot reporting and attribution](https://www.draidel.com/hubspot-reporting) - [HubSpot data cleanup and deduplication](https://www.draidel.com/hubspot-data-cleanup) - [HubSpot custom objects](https://www.draidel.com/hubspot-custom-objects) - [HubSpot ticketing and live chat](https://www.draidel.com/hubspot-ticketing) - [HubSpot landing pages](https://www.draidel.com/hubspot-landing-pages) - [HubSpot social media management](https://www.draidel.com/hubspot-social-media) - [HubSpot Breeze and AI implementation](https://www.draidel.com/hubspot-breeze-ai) - [HubSpot managed services](https://www.draidel.com/hubspot-managed-services) - [HubSpot or Salesforce?](https://www.draidel.com/hubspot-vs-salesforce) [All HubSpot services→](https://www.draidel.com/hubspot) Go to market11 - [GTM engineering](https://www.draidel.com/gtm-engineering) - [Go to market consulting](https://www.draidel.com/go-to-market-consulting) - [Go to market operations](https://www.draidel.com/go-to-market-operations) - [Go to market strategy for SaaS](https://www.draidel.com/saas-go-to-market-strategy) - [B2B go to market strategy](https://www.draidel.com/b2b-go-to-market-strategy) - [Go to market strategy for a product launch](https://www.draidel.com/product-launch-go-to-market-strategy) - [Go to market strategy for startups](https://www.draidel.com/startup-go-to-market-strategy) - [The go to market stack](https://www.draidel.com/go-to-market-stack) - [Go to market strategy for fintech](https://www.draidel.com/fintech-go-to-market-strategy) - [Medical device go to market strategy](https://www.draidel.com/medical-device-go-to-market-strategy) - [Go to market workshop](https://www.draidel.com/go-to-market-workshop) [All go to market→](https://www.draidel.com/go-to-market) © 2026 Draidel LLC — Miami, FL - [Careers](https://careers.draidel.com) - [Privacy](https://www.draidel.com/privacy) - [Terms](https://www.draidel.com/terms-and-conditions) - [Brand guide](https://www.draidel.com/brandguide) Nes gadol haya sham ```json { "@context" : "https://schema.org", "@id" : "https://www.draidel.com/#organization", "@type" : "ProfessionalService", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Miami", "addressRegion" : "FL", "streetAddress" : "66 West Flagler St" }, "description" : "Technical consulting firm and venture studio building revenue systems — migrations, RevOps, HubSpot architecture, AI and data, and engineering.", "foundingDate" : "2015", "knowsAbout" : [ "Revenue operations", "HubSpot CMS and CRM architecture", "CRM migration", "Systems integration", "Data warehousing", "Applied AI" ], "name" : "Draidel", "sameAs" : [ "https://www.linkedin.com/company/draidel", "https://www.instagram.com/draidel" ], "slogan" : "We build companies.", "url" : "https://www.draidel.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.draidel.com/#website", "@type" : "WebSite", "inLanguage" : "en", "name" : "Draidel", "publisher" : { "@id" : "https://www.draidel.com/#organization" }, "url" : "https://www.draidel.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.draidel.com/hubspot-security-compliance#webpage", "@type" : "WebPage", "about" : { "@id" : "https://www.draidel.com/#organization" }, "description" : "HubSpot security and compliance for regulated buyers. SOC 2 and ISO 27001 questions answered, SSO and two-factor enforced, consent and retention designed in.", "inLanguage" : "en", "isPartOf" : { "@id" : "https://www.draidel.com/#website" }, "name" : "HubSpot Security and Compliance — Draidel", "url" : "https://www.draidel.com/hubspot-security-compliance" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.draidel.com/hubspot-security-compliance#breadcrumb", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.draidel.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "name" : "Hubspot Security Compliance", "position" : 2 } ] } ```