Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Sep 17, 2026; our capture on Oct 15, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.”
“By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.”
“This HubSpot Sub-Processors Page is incorporated into the DPA and Agreement.”
“Some Sub-Processors will apply to you as a default, and some Sub-Processors will apply to you only if and when you opt-in.”
“We may deprecate a Sub-Processor to consolidate and minimize our use of Sub-Processors, or we may add a Sub-Processor if we believe that doing so will enhance our ability to deliver our Subscription Service.”
“OpenAI, L.L.C. AI Service Provider HubSpot AI United States European Economic Area and Switzerland United States United States”
This document lists the third-party companies HubSpot shares your data with and explains how that sharing is authorized. When you agree to HubSpot's DPA, you automatically consent to all listed sub-processors accessing your data—some are active by default, while others only apply if you turn on specific features. HubSpot can add or remove sub-processors at its discretion, but if you subscribe to email notifications, it must give you at least 30 days' notice before any change takes effect.
This document establishes HubSpot's sub-processor framework as incorporated into the DPA and Agreement, giving it binding contractual force. Customers consent to both affiliate and infrastructure sub-processor access to Customer Data through their agreement to the DPA, without a separate opt-in at the point of sub-processor engagement. HubSpot distinguishes between default sub-processors—active without affirmative customer action—and opt-in sub-processors, which require deliberate customer activation preceded by pre-activation notice. HubSpot retains discretion to add or deprecate sub-processors based on its own assessment of service enhancement or consolidation goals, subject to a 30-day advance notice obligation for customers who subscribe to email notifications.
By agreeing to HubSpot's DPA, a user consents in advance to all listed affiliate and infrastructure sub-processors accessing their Customer Data—including providers such as AWS, Cloudflare, and OpenAI for HubSpot AI features—without requiring a separate approval at the time each sub-processor is engaged. Some sub-processors are active by default, while others only become active when a user turns on a specific feature or integration; HubSpot will notify the user before they activate any feature that requires an opt-in sub-processor. To receive at least 30 days' advance notice before any sub-processor is added, replaced, or materially changed, a user can subscribe to HubSpot's email notification service for sub-processor updates.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.”
“By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.”
“Some Sub-Processors will apply to you as a default, and some Sub-Processors will apply to you only if and when you opt-in.”
“This HubSpot Sub-Processors Page is incorporated into the DPA and Agreement.”
“We may deprecate a Sub-Processor to consolidate and minimize our use of Sub-Processors, or we may add a Sub-Processor if we believe that doing so will enhance our ability to deliver our Subscription Service.”
“OpenAI, L.L.C. AI Service Provider HubSpot AI United States European Economic Area and Switzerland United States United States”
“We will notify you before you turn on a feature or install an integration that requires support from an opt-in Sub-Processor.”
“If you opt-in to receive a notification, we will notify you at least 30 days prior to any such change taking effect.”
“You may subscribe to receive notifications by email if we update this page to add or replace any Sub-Processors, if any of our Sub-Processors materially change the services that they provide, or if they change the country from which they …”
“Amazon Web Services, Inc. AI Service Provider HubSpot AI United States European Economic Area regions United States United States”
“Amazon Web Services, Inc. Hosting & Infrastructure Used as a on-demand cloud computing platforms and APIs United States Germany Australia Canada”
“Cloudflare, Inc. Content Delivery Network Used as a web infrastructure and website security, providing content delivery network services, DDoS mitigation...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Customer consent to HubSpot affiliate sub-processor access and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.