How do you handle security and access control for custom tools?
Least privilege access, scoped credentials, encryption, and logs of who did what.
Least privilege by default: every person and every integration gets the narrowest access that lets it do its job. Scoped credentials instead of shared logins, secrets kept out of source code, encryption in transit and at rest, and logs showing who did what.
Access control for people
Define roles before you build screens. Decide what each role can see, edit, export and delete, and treat export as its own permission, because the fastest way to lose a customer database is a report anyone can download. Use single sign-on wherever the platform supports it, so that removing someone from your identity provider removes their access everywhere at once. Offboarding failures, not break-ins, are how most small companies actually lose control of their data. Setting up SSO in HubSpot covers that side.
Access control for systems
- Scoped credentials per integration. In HubSpot that means a private app with only the scopes it needs, not a portal admin's login. One key per integration, so you can revoke one thing without breaking everything.
- No secrets in code. Keys live in a secrets manager or environment configuration, never in the repository. A key committed to a repository is compromised even if the repository is private.
- Separate environments. Development and production should not share credentials or data. Use scrubbed data for testing.
- Rotation and an owner. Every credential has a named owner and a rotation plan, and gets rotated when someone leaves.
Data handling
Encryption in transit over TLS everywhere, encryption at rest for stored data, and a deliberate decision about what you store at all. The most reliable way to protect a field is not to keep a copy of it. Where a record can live in the source system and be referenced rather than duplicated, do that.
Audit logging
Log who accessed what and when, log configuration changes, and keep those logs somewhere the application itself cannot rewrite. When something goes wrong, the question is always what changed and who changed it, and a system that cannot answer that costs days.
Regulated data has requirements beyond good practice. For healthcare, start with our answer on HIPAA-compliant integrations and whether HubSpot is HIPAA compliant. Our build approach is on the custom integrations page.
Related: What infrastructure do you use for custom integrations?. What is a HubSpot Private App?. Does LevelUp Digital build custom web applications?.