HubSpot Sub-Processors

This document lists the third-party companies HubSpot shares your data with and explains how that sharing is authorized. When you agree to HubSpot's DPA, you automatically consent to all listed sub-processors accessing your data—some are active by default, while others only apply if you turn on specific features. HubSpot can add or remove sub-processors at its discretion, but if you subscribe to email notifications, it must give you at least 30 days' notice before any change takes effect.

This document establishes HubSpot's sub-processor framework as incorporated into the DPA and Agreement, giving it binding contractual force. Customers consent to both affiliate and infrastructure sub-processor access to Customer Data through their agreement to the DPA, without a separate opt-in at the point of sub-processor engagement. HubSpot distinguishes between default sub-processors—active without affirmative customer action—and opt-in sub-processors, which require deliberate customer activation preceded by pre-activation notice. HubSpot retains discretion to add or deprecate sub-processors based on its own assessment of service enhancement or consolidation goals, subject to a 30-day advance notice obligation for customers who subscribe to email notifications.

By agreeing to HubSpot's DPA, a user consents in advance to all listed affiliate and infrastructure sub-processors accessing their Customer Data—including providers such as AWS, Cloudflare, and OpenAI for HubSpot AI features—without requiring a separate approval at the time each sub-processor is engaged. Some sub-processors are active by default, while others only become active when a user turns on a specific feature or integration; HubSpot will notify the user before they activate any feature that requires an opt-in sub-processor. To receive at least 30 days' advance notice before any sub-processor is added, replaced, or materially changed, a user can subscribe to HubSpot's email notification service for sub-processor updates.