How many subprocessors does HubSpot use?

HubSpot lists 7 subprocessors on its published list, including Sensitive Data Beta FAQs, Compliance FAQs, SOC 3, Corporate Pentest Attestation, and Pre-filled security questionnaires and 2 more.

Where does HubSpot process customer data?

The subprocessors named by HubSpot are located in Updated, as stated on its list.

How quickly does HubSpot report a personal data breach to customers?

According to its DPA, HubSpot reports a personal data breach to customers within 72 hours: “We will notify you without undue delay, but no later than seventy-two (72) hours, after we become aware of any Customer Personal Data Breach”

How much notice does HubSpot give before adding a subprocessor?

HubSpot's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”

How does HubSpot transfer personal data outside the EU?

HubSpot's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and binding corporate rules: “HubSpot, Inc. participates in and certifies compliance with the Data Privacy Framework.”

When was HubSpot's subprocessor list last checked?

ClauseTrail last checked HubSpot's subprocessor list on September 25, 2026. Lists are re-checked daily.

How do I find out when HubSpot adds or removes a subprocessor?

ClauseTrail monitors HubSpot's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

HubSpot Subprocessors List (September 2026): Changes and History

HubSpot names 7 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 25, 2026 Official source ↗

HubSpot subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Sensitive Data Beta FAQs	New!	—
2	Compliance FAQs	New!	—
3	SOC 3	Updated	—
4	Corporate Pentest Attestation	Updated	—
5	Pre-filled security questionnaires	CAIQ v4 — Updated SIG Lite	Updated
6	Clearbit SOC 2 Report	Legacy	—
7	Clearbit TRUSTe Certification	Legacy	—

Get an email when HubSpot changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track HubSpot free

Key DPA terms at HubSpot

What HubSpot's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“We will notify you without undue delay, but no later than seventy-two (72) hours, after we become aware of any Customer Personal Data Breach”
DPA, legal.hubspot.com ↗
Notice of a new subprocessor: 30 days ahead

“We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
DPA, legal.hubspot.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and binding corporate rules

“HubSpot, Inc. participates in and certifies compliance with the Data Privacy Framework.”

“The Standard Contractual Clauses will be incorporated by reference and apply to the Restricted Transfer as follows:”

“to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws”
DPA, legal.hubspot.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“We will delete or return all Customer Data, including Customer Personal Data (including copies thereof) Processed pursuant to this DPA, on termination or expiration of your Subscription Service in accordance with the procedures set out in our Product Specific Terms.”
DPA, legal.hubspot.com ↗
Audit rights: Through certifications and audit reports only

“Upon request, we will supply (on a confidential basis) our SOC 2 report and summary copies of our penetration testing report(s) to you so that you can verify our compliance with this DPA.”
DPA, legal.hubspot.com ↗

Documents we track for HubSpot

AI terms: checked September 25, 2026 trust.hubspot.com ↗
DPA: checked September 25, 2026 legal.hubspot.com ↗
Privacy policy: checked September 25, 2026 legal.hubspot.com ↗
Subprocessor list: checked September 25, 2026 trust.hubspot.com ↗
Terms of service: checked September 25, 2026 legal.hubspot.com ↗

Change history

Tracking since September 25, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

HubSpot subprocessors FAQ

How many subprocessors does HubSpot use?: HubSpot lists 7 subprocessors on its published list, including Sensitive Data Beta FAQs, Compliance FAQs, SOC 3, Corporate Pentest Attestation, and Pre-filled security questionnaires and 2 more.
Where does HubSpot process customer data?: The subprocessors named by HubSpot are located in Updated, as stated on its list.
How quickly does HubSpot report a personal data breach to customers?: According to its DPA, HubSpot reports a personal data breach to customers within 72 hours: “We will notify you without undue delay, but no later than seventy-two (72) hours, after we become aware of any Customer Personal Data Breach”
How much notice does HubSpot give before adding a subprocessor?: HubSpot's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you.”
How does HubSpot transfer personal data outside the EU?: HubSpot's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and binding corporate rules: “HubSpot, Inc. participates in and certifies compliance with the Data Privacy Framework.”
When was HubSpot's subprocessor list last checked?: ClauseTrail last checked HubSpot's subprocessor list on September 25, 2026. Lists are re-checked daily.
How do I find out when HubSpot adds or removes a subprocessor?: ClauseTrail monitors HubSpot's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.