HubSpot
Certifications & attestations
| Certification | Status | Source | Last verified |
|---|---|---|---|
| SOC 2 Type II Confidential report available to customers and prospects via HubSpot's Trust Center. A public SOC 3 report is also downloadable. | Verified | vendor source ↗ | June 10, 2026 |
→ Direct answer: Does HubSpot have SOC 2?
Subprocessors
Subprocessor extraction for HubSpot is pending. The vendor publishes a list here: source ↗
Hosting & data residency
- InfrastructureAmazon Web Services
- Data residencyEU data hosting available — customers can choose or migrate to HubSpot's Frankfurt, Germany data center (confirmed on HubSpot's security page, 2026-06-10).
Trust documents & links
- Trust centerhttps://trust.hubspot.com
- Security pagehttps://legal.hubspot.com/security
- DPAhttps://legal.hubspot.com/dpa
- Status pagehttps://status.hubspot.com
Security incidents & disclosures
No incidents on record in the public sources we track, as of June 10, 2026. Absence of a record is not a guarantee — see methodology.
Change history
2026-06-10
Vendor added to StackPosture — initial snapshot from published trust documentation. Verification pass pending.
2026-06-10
Correction: removed ISO 27001 from HubSpot's certifications. HubSpot's security page attributes ISO 27001 to its cloud infrastructure providers (AWS), not to HubSpot itself, and HubSpot publishes no ISO 27001 certificate of its own. SOC 2 Type II confirmed; EU (Frankfurt) data residency and AWS US-East hosting verified.