Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement prohibits use of the Subscription Service for regulated sensitive data categories including HIPAA, COPPA, GLBA, and FISMA-governed data unless the customer separately enables Sensitive Data functionality and accepts the HubSpot Sensitive Data Terms.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Organizations in healthcare, financial services, or those processing children's data must separately enable and accept the Sensitive Data Terms before using HubSpot to process regulated data categories; use of the standard Subscription Service for such data without enabling these additional terms is prohibited under the agreement.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →The agreement prohibits processing of HIPAA-covered health information, COPPA-governed children's data, GLBA-regulated financial information, and FISMA-governed data through the standard Subscription Service. Customers who require such processing must enable the Sensitive Data functionality in their account, which triggers the Sensitive Data Terms as an additional contractual obligation.
Cross-platform context
See how other platforms handle Sensitive Data Terms and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The HubSpot Sensitive Data Terms available at https://legal.hubspot.com/sensitive-data-terms are incorporated into this Agreement if you enable the Sensitive Data functionality in your HubSpot Account. To the extent specifically permitted under the HubSpot Sensitive Data Terms and subject to those additional terms, you may use the Subscription Services to collect, store, manage, or otherwise process information considered sensitive information under various regulations. You may not use the Subscription Service in a way that would violate local or industry-specific regulations (for example, the Children's Online Privacy Protection Rule consistent with the requirements of the Children's Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the Federal Information Security Management Act (FISMA), etc.).Excerpt from HubSpot's Terms of Service
1. REGULATORY LANDSCAPE: This provision directly implicates HIPAA (covered health information and business associate obligations), COPPA (children's online privacy), GLBA (financial institution data), and FISMA (federal information security requirements). HHS OCR enforces HIPAA, the FTC enforces COPPA and GLBA with respect to non-bank financial institutions, and FISMA compliance is overseen by federal agency inspectors general and OMB. Customers processing data subject to these regulations must assess whether the Sensitive Data Terms satisfy their specific regulatory obligations, including whether HubSpot qualifies as a business associate under HIPAA when processing PHI. 2. GOVERNANCE EXPOSURE: High for regulated industry customers. Use of the Subscription Service to process HIPAA-covered, COPPA-regulated, or GLBA-governed data without enabling the Sensitive Data Terms is a contractual violation and may create independent regulatory liability for the customer. The provision places the responsibility on the customer to identify applicable regulations and enable the appropriate functionality. 3. JURISDICTION FLAGS: Healthcare organizations subject to HIPAA, financial institutions subject to GLBA, education platforms subject to FERPA, and any organization processing data about minors under COPPA face heightened exposure. State-level data protection laws in California, Illinois, New York, and others may impose additional sensitive data category obligations beyond those named in this provision. 4. CONTRACT AND VENDOR IMPLICATIONS: Legal and compliance teams must review the Sensitive Data Terms at legal.hubspot.com/sensitive-data-terms in full before enabling the functionality. For HIPAA-covered entities, the Sensitive Data Terms or DPA must function as a Business Associate Agreement; legal review should confirm this. Procurement teams should incorporate a review of the Sensitive Data Terms into vendor risk assessments for any HubSpot deployment in regulated contexts. 5. COMPLIANCE CONSIDERATIONS: Organizations should conduct a data classification review to identify whether any data processed through HubSpot falls within regulated sensitive categories before deploying the Subscription Service. The Sensitive Data functionality must be explicitly enabled in the account before regulated data is uploaded or processed. Ongoing compliance monitoring should verify that account settings and data flows remain consistent with the applicable Sensitive Data Terms.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Organizations in healthcare, financial services, or those processing children's data must separately enable and accept the Sensitive Data Terms before using HubSpot to process regulated data categories; use of the standard Subscription Service for such data without enabling these additional terms is prohibited under the agreement.
The agreement prohibits processing of HIPAA-covered health information, COPPA-governed children's data, GLBA-regulated financial information, and FISMA-governed data through the standard Subscription Service. Customers who require such processing must enable the Sensitive Data functionality in their account, which triggers the Sensitive Data Terms as an additional contractual obligation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.