hubspot
11 Dtwo policies tagged "hubspot", including HubSpot Block Deal Closure, HubSpot Cap Bulk Export. Browse by what the control does rather than which app it targets.
HubSpot Block Deal ClosureBlocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.HubSpot Cap Bulk ExportCaps how many records a single agent call can pull out of HubSpot, so an agent (or a prompt injection steering one) can't bulk-export the CRM.HubSpot Freeze Destructive OpsBlocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.HubSpot Protect AssociationsBlocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).HubSpot Protect Deal OwnerBlocks HubSpot CRM-object update calls that set or change a deal's owner.HubSpot Protect Lifecycle StageBlocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.HubSpot Read-OnlyMakes the HubSpot connection read-only by blocking the write tool.HubSpot Read-Only Except Call NotesKeeps the HubSpot connection read-only for agents, with one exception: the agent can log a call note against a contact.HubSpot Redact PIIRedacts sensitive contact information from HubSpot tool responses before they reach the caller.HubSpot Role-Gate Schema and ConsentSits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…HubSpot Role-Gate WritesGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…