At HubSpot, we’re committed to helping our customers harness the power of AI while keeping their data secure. To deliver AI-powered features, like Breeze, HubSpot partners with a select number of trusted AI service providers.
Transparency, trust, and compliance are at the core of how we work with AI service providers. We carefully vet each provider through our vendor review process to ensure they meet HubSpot’s strict security and privacy standards.
Importantly, we do not permit the AI service providers we engage to provide the Subscription Services to use customer data for model training, and we enforce zero data retention wherever possible.
This article answers common questions about HubSpot’s AI Cloud Infrastructure, including how AI service providers process data, where that processing takes place, and the safeguards we have in place to comply with global privacy regulations like GDPR.
It also provides links to key resources such as the HubSpot’s Trust Center, HubSpot Model Cards, and AI Trust FAQs.
What are HubSpot AI service providers?
AI service providers are third parties, such as OpenAI, that HubSpot engages to help deliver its AI-powered features and functionality. They process data on HubSpot’s behalf in order to provide some AI capabilities as part of the Subscription Service. They are listed on the HubSpot Sub-Processors Page, under the Purpose column.
Do HubSpot AI service providers use my data for model training?
No. We do not permit HubSpot AI service providers that we engage to provide the Subscription Service to use your data for model training. In our agreements with AI service providers, we also have commitments to minimize data retention, including zero-day data retention where possible.
For more information, see the HubSpot Model Cards and AI Trust FAQs.
Where is my data processed by HubSpot AI service providers?
When you review the HubSpot Sub-Processors Page, you’ll see your data center location (United States, European Union, Canada, Australia). In each column, you can see the location of where data is processed by each AI service provider listed.
You’ll see references to European Economic Area regions. For information on the specific EEA processing locations for each AI service provider, see AWS, OpenAI, and Google.
How does HubSpot ensure compliance with GDPR and other privacy regulations when processing data across borders?
HubSpot has a robust privacy program that is designed to align with many regions’ data hosting needs. The GDPR permits transfers of personal data outside of the European Union, subject to certain conditions. HubSpot has relevant data transfer mechanisms in place between its entities and has undertaken a review of its data centers to ensure they comply with HubSpot's requirements, including with regard to SOC2 compliance.
HubSpot's Data Processing Agreement includes the EU and U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework, and the European Commission’s Standard Contractual Clauses (SCCs) as the mechanism to transfer data from the EU to the U.S..
To learn more, see HubSpot's Data Processing Agreement, Data Privacy FAQ, and Transfer Impact Assessment.
More information about HubSpot’s privacy program is included in the Privacy Policy, HubSpot's legal page, and on HubSpot’s Trust Center.
How do I know my data is secure when processed by HubSpot AI service providers?
Our AI service providers go through HubSpot’s robust vendor review process, which includes checking their security and privacy requirements against HubSpot’s strict standards. We also have strong security, incident response, and privacy commitments in our contracts with AI service providers.
For more details on HubSpot’s security program, review the Security Overview located on the HubSpot Trust Center and AI Trust FAQs.
Where can I find the most up-to-date information on HubSpot’s infrastructure and data handling practices?
More information about HubSpot’s infrastructure and data handling practices is included in the Security Overview located on the HubSpot Trust Center and the Privacy Policy.
