How to Secure Your HubSpot Portal in 20 Minutes

Learn about HubSpot’s Three Principles of Security and Privacy and how to keep your HubSpot account safe. 

Data privacy, security and control are essential when managing customer data. After all, if you’re holding customer data, it’s your legal responsibility to keep it safe.

For most of us, a security breach would be a nightmare. For others, it’s a frightening reality. Security Magazine reported that, on average, Americans had their personal information stolen at least four times in 2019. And Microsoft (MS) revealed that around 1.2 million MS accounts were compromised in January 2020.

“28% of data breach victims are small businesses.” Verizon

As an Elite-tier HubSpot solutions partner, our customers' security is incredibly important to us. We're sure you feel the same about your company data. But with HubSpot at your fingertips, data security doesn't have to be complex. In fact, there are some simple steps you can take to quickly and easily secure your HubSpot portal. 

Specifically, HubSpot recommends that you follow its Three Principles of Security and Privacy:

1. Engage
2. Limit Access
3. Secure

What does each of these principles mean and how can you implement them yourself to keep your portal, your customers’ data, and your reputation safe?

Looking for help with HubSpot? Speak with one of our certified experts today.

HubSpot’s Three Principles of Security and Privacy

1. Engage

Engage your business in discussions about security. 

Often in small to medium-sized businesses, there aren’t people dedicated to thinking about security, which means the responsibility falls to everyone for the business to be secure. 

As a marketer, the best way to get conversations about security going is to simply ask. Ask questions of your team and the wider business such as:

• what does this mean for the business’ security?
• what is the risk?
• at what point does the business need to ask for help?

To capture the answers to these questions and begin documenting your company’s security policies, think about creating a security playbook.

A playbook can become your company’s go-to source of security information, compiling all your policies and best practices and even filling in the gaps so everyone knows what to do and where to turn in the event of an emergency. 

Another way to always keep your company’s security front of mind is to ask your colleagues: what would your customers say if they knew how well you were managing their data?

At a time when your customers’ trust means everything, taking this approach can really help to provide some valuable context for your security discussions.

2. Limit access

Limiting access will always be a balancing act between enabling users to access the information they need and preventing them from accessing all your customer information. 

When thinking about who has access to what, the rule of thumb is to only grant access to the information a user needs.

Remember, access can mean external access as well as internal access.

In terms of internal access risks and what to watch out for, many businesses will grant access to their users by making them Super Admins. That means they have the ability to make a meaningful change anywhere in your account, from changing billing details to adding new users and sending emails to all of your subscribers, for example. 

Now, if one of those Super Admins gets compromised or even just makes a genuine mistake, your business is at risk. 

You know how important your HubSpot account is — and so do HubSpot. To help you keep it safe, HubSpot has introduced granular control over almost every aspect of a platform. Use it to tailor who has access to what to reduce risk and lessen the severity of anything that could happen in your account

So what about external access?

When we’re talking about this in HubSpot, what we’re really discussing is integrations. The right integrations can make your working life so much easier, but they usually require access to your data to work properly.

Take an email integration. It’s going to want permission to read your emails in order to work effectively. How well do you trust that application or software? Does it need that access?

• To keep external access clean, regularly review which integrations and tools have access to your HubSpot account.
• If an integration has access to your data but it isn’t used anymore, remove it.
• Consider regularly rotating your HubSpot API key to make sure its risk of compromise remains low.
• Review API key, security activity and login history logs to ensure that you’re aware of who’s accessing your account and what they’re doing.
  
  

Secure

Multifactor authentification (MFA) is the single best way right now to secure your account. You’re likely familiar with it already, but are you using it for your HubSpot account?

In case you’re not familiar, MFA adds an extra layer of security to your accounts. All too many passwords are easy to guess, and once a password gets out into the world or an account is otherwise breached, MFA is the only thing standing between you and a threat.

MFA in HubSpot:

• keeps data safe by requiring a phone or smart device to log in 
• means that knowing your password alone isn’t enough for a malicious person to access your account 
• can be easy to manage (and set up as a requirement for all your HubSpot account users) in your HubSpot User Preferences

Make it as difficult as possible for anyone trying to access your account to do so. MFA is the best way to do that.

You might also consider setting up Single Sign-On (SSO). Less well-known than MFA, SSO allows you to log into HubSpot using an identity provider to manage your accounts. It’s simple to set up, takes away all the pain of having multiple logins and passwords to remember, and you can still set important security policies and processes like MFA requirements or restricting log-ins from outside your corporate network using it.

How to secure your HubSpot portal: next steps

Of course, we want you to keep your HubSpot account safe first and foremost. But your security is only as strong as your weakest link.

What’s so great about the Three Principles of Security and Privacy is that they can be applied to all your other accounts and applications, too, so wherever your customers’ data is, and whatever technology you’re using, you can stay safe.

To find out more about securing your HubSpot account, or to speak with one of our HubSpot experts, click the image below and get in touch.

Author Bio

Hollie Higa

Hollie is the in-house Marketing Manager at BabelQuest, an Elite-tier HubSpot Solutions Partner based in Abingdon, Oxfordshire.