# HubSpot privacy rating

Customer platform whose Marketing Hub sends marketing email, with a CRM, forms, landing pages, automation and open and click tracking.

## Summary

HubSpot scores 41 out of 100 (grade D) on the newsletter platforms criteria. It meets 3 of 8 criteria: transparency report, tells users about requests and TLS configuration. It partly meets independent audit and security headers. It does not meet open source, no trackers or telemetry and no ads or data sales. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.hubspot.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Android, iOS, Web
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Analytics, Google Tag Manager, HubSpot
- Category: [Newsletter platforms](https://privacyratings.com/newsletters/)
- Grade: D (41/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy covers ad network cookies and web beacons on the website, and marketing emails track opens and clicks unless turned off. | https://legal.hubspot.com/privacy-policy |
| No ads or data sales | No | The privacy policy states identifiers were sold or shared with advertising partners, and business contact data from its commercial dataset is sold to customers of its enrichment products. | https://legal.hubspot.com/privacy-policy |
| Independent audit | Partial | A SOC 3 report is public. The SOC 2 Type 2 report and penetration test summaries are only available to customers and prospects. | https://legal.hubspot.com/security |
| Transparency report | Yes | Publishes yearly counts of US and international government and civil requests for customer data and how each was answered. | https://legal.hubspot.com/en/data-disclosure-policy-and-transparency-report |
| Tells users about requests | Yes | HubSpot notifies customers of requests for their data unless prohibited by law or in an emergency involving danger of death or serious injury. | https://legal.hubspot.com/en/data-disclosure-policy-and-transparency-report |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=hubspot.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=hubspot.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/newsletters/hubspot/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/newsletters/hubspot.md