Connect HubSpot to noombat

Yes, and HubSpot itself enforces it. The private app holds read scopes only. Every write endpoint checks for the paired .write scope, which the app lacks, so the platform rejects any write attempt. There is nothing to configure to get this guarantee; it is how HubSpot scopes work.

Companies and contacts (who you sell to), deals (pipeline and revenue), the engagements logged on your records (calls, meetings, emails, notes), list memberships, form submissions and marketing email opens and clicks (how your market responds), and owners (who works what). noombat keeps a read-only mirror, scores your market against it, and connects the companies it names to the meetings and revenue that follow. History matters: the scoring learns from what already happened, which is why a forward-only feed such as a webhook is too little.

HubSpot's scopes are object-level, so a token cannot be limited to specific properties the way Salesforce field-level security works; HubSpot's own docs note that its user-facing property restrictions leave API access untouched. Two things do help. First, noombat requests the specific properties it uses, and we share the exact list. Second, on Enterprise, HubSpot's Sensitive Data feature gates any property you classify as sensitive behind dedicated *.sensitive.* scopes, which we never request, so those values are blocked to our token by the platform.

Nothing. Private apps are included in every HubSpot tier, the free CRM included, with up to 20 per account, and a private app is an account-level credential rather than a user, so no seat is consumed. The one tier-dependent piece is the optional content scope (marketing email opens and clicks), which HubSpot offers on Marketing Hub or CMS Hub Professional and Enterprise; everything else works on any tier.

A webhook pushes one object's changes in real time and stops there: it sends changes from today on, while noombat learns from the existing history; each object needs an automation built and kept on your side; and a receiver ends up calling the API for the full record anyway. We add webhooks on top of API access for time-sensitive events when a customer asks.

At once, from your side, in either of two ways: on the app's Auth tab choose Rotate and expire now (the old token dies immediately), or delete the private app (its token is permanently revoked). Nothing on our side can restore access. For a graceful handover, Rotate and expire later keeps the old token alive for 7 days while the new one is delivered.

Yes. The private app's page in HubSpot has an API call log covering the past 30 days: every request with its method, endpoint and response code, filterable and exportable as CSV. Because noombat is the only thing using this app's token, everything in that log is attributable to us alone. HubSpot keeps the calls themselves in the log, without request or response payloads.

Your data is kept apart from every other customer's, in a schema of its own, encrypted in transit and at rest, read through connections that write nothing back, and deleted when we part ways. Data-processing terms written for a security review, for teams in the EU and in the US. We walk through them with your security team on request.