HubSpot Sub-Processors

This document is HubSpot's Sub-Processors Page (last modified April 14, 2026), incorporated by reference into HubSpot's Data Processing Agreement (DPA) and governing Agreement, which establishes the legal basis for third-party data processing under those contracts. The document discloses three categories of Sub-Processors: infrastructure Sub-Processors (Amazon Web Services, Cloudflare, Google LLC, Snowflake Inc.) with access to Customer Data across US, EU, Australian, and Canadian data centers; feature-specific Sub-Processors (including OpenAI, Google LLC, Amazon Web Services, Stripe, Twilio, Meta Platforms, Dropbox, Mux, Litmus, Ably, ConvertAPI, and Hyperdoc) engaged for AI, payments, calling, SMS, e-signature, video, and chat functionality; and fifteen HubSpot affiliate entities across North America, Europe, Asia-Pacific, and South America engaged for services and support. The document states that by agreeing to the DPA, customers consent to all infrastructure and affiliate Sub-Processors having access to Customer Data, while feature-specific Sub-Processors are categorized as either default or opt-in, with notification promised before opt-in features are activated. The Sub-Processor list and its update notification mechanism engage GDPR Article 28 obligations (which require controllers to be informed of sub-processor additions and substitutions, with a right to object), as well as equivalent requirements under UK GDPR, Swiss data protection law, and other jurisdictions where HubSpot operates under its DPA. Material compliance considerations include the geographic scope of data transfers (including to Singapore, India, Japan, Colombia, and other jurisdictions outside the EEA), the adequacy of transfer mechanisms for each Sub-Processor location, and the 30-day advance notice period for Sub-Processor changes, which may or may not satisfy the objection rights required under applicable data protection frameworks depending on the customer's contractual terms with HubSpot.