# HubSpot

> Connect HubSpot to Tidal Control so compliance tests read your CRM's user management, security settings and data configuration. Read-only access throughout.

Source: https://tidalcontrol.com/docs/integrations/hubspot

Tidal Control's HubSpot integration monitors your CRM's user management, security settings, and data configuration for compliance purposes.

## What this integration monitors

- **Users:** Inactive accounts and super admin count
- **Roles:** Roles defined on the portal
- **Owners:** Portal user association
- **Teams:** Team configuration
- **Account:** Data hosting location (EU vs. US)
- **Subscriptions:** Default opt-in settings on communication types
- **Audit log, login activity and security changes:** Audit events, sign-in activity, and security configuration changes such as MFA/SSO toggling (Enterprise only; see below)

## Requirements

- Super User role in Tidal Control
- HubSpot account with permission to create Private Apps

## Configuration step-by-step plan

We'll create a **HubSpot Private App** and copy its access token, then add the connection in Tidal Control.

**Configuration steps:**

1. **Create a Private App in HubSpot**
2. **Configure the integration in Tidal Control**

## Step 1: Create a Private App in HubSpot

- Log in to your HubSpot account
- Click the **settings icon** (gear) in the top navigation bar
- Navigate to **Integrations → Private Apps** in the left sidebar
- Click **Create a private app**
- On the **Basic info** tab, enter a name (e.g. `Tidal Control`) and optionally a description
- Switch to the **Scopes** tab and add the following scopes:

<table>
<thead>
<tr><th>Scope</th><th>Purpose</th></tr>
</thead>
<tbody>
<tr><td><code>crm.objects.owners.read</code></td><td>Read CRM owners</td></tr>
<tr><td><code>settings.users.read</code></td><td>Read users and roles</td></tr>
<tr><td><code>settings.users.teams.read</code></td><td>Read team configuration</td></tr>
<tr><td><code>communication-preferences.read</code></td><td>Read subscription / consent types</td></tr>
<tr><td><code>account-info.security.read</code></td><td>Read audit log, login activity and security configuration changes (requires Enterprise)</td></tr>
</tbody>
</table>

> **info:**

**The audit log, login activity and security change checks require a HubSpot Enterprise subscription** and the `account-info.security.read` scope. On lower tiers these endpoints return no data and the corresponding tests stay empty. The rest of the integration still works. The data-hosting (EU/US) check uses the default `oauth` scope that every Private App has, so no extra scope is needed for it.

- Click **Create app**
- In the confirmation dialog, click **Continue creating**
- **Copy the access token** shown on the app detail page

> **warning:**

**Save the access token immediately.** The full token value is only displayed once after creation. If you navigate away without copying it, you can rotate the token to get a new one, but the old token will stop working.

## Step 2: Configure the integration in Tidal Control

- Go to **Settings → Integrations** in Tidal Control
- Click the **plus icon** next to **HubSpot**
- Fill in the configuration:
  - **Name:** A descriptive name, e.g. `HubSpot`
  - **Access Token:** The access token from step 1
- Click **"Create"** to save the integration

## Configuration fields explained

The integration dialog asks for the following values:

**Name:**
- A descriptive name for this connection
- For example: `HubSpot`, `HubSpot Production`

**Access Token:**
- The Private App access token from HubSpot
- Created in step 1
- Keep this value secure

## Verification

The integration is working when all of the following are true:

- Settings → Integrations shows HubSpot under **Configured Integrations**
- HubSpot tests are available in the Tests section
- Test refresh delivers results without authentication errors

## Frequently asked questions

**Can I reuse the same Private App token for multiple Tidal Control environments?**
Yes, the same access token can be used across different Tidal Control instances.

**What happens if I add more scopes than listed?**
Additional scopes do not affect the integration. Tidal Control only uses the data it needs for the configured tests.

**Do I need to be a HubSpot super admin to create a Private App?**
You need sufficient permissions in HubSpot to manage integrations. Typically this requires a super admin role or an account with the "App Marketplace Access" permission.

## Common problems

**"Access Token is required"**
- Make sure you entered the access token value, not the app name or ID
- HubSpot Private App tokens start with `pat-`

**Tests show authentication errors after connecting**
- Verify the access token is still valid. Tokens can be rotated in HubSpot's Private App settings
- Check that all required scopes were added when creating the Private App

**Audit log, login activity or security change tests show no data**
- These checks require a HubSpot **Enterprise** subscription and the `account-info.security.read` scope
- Confirm the scope was added to the Private App, and that your HubSpot plan includes the account activity API

**"HUBSPOT_DATA_HOSTED_IN_EU" test fails**
- This test checks that your HubSpot account is hosted in the EU data centre
- This is a configuration of your HubSpot account, not the integration. Contact HubSpot support to change your data hosting location

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.