Choosing a HubSpot Audit Provider in Europe: What to Ask Before You Grant Access

A typical version of the question reaches me like this. A RevOps lead at a company in Finland has a portal that has grown untidy over five years. She wants an outside audit. She has a shortlist of two agencies and one app, and she asks me which is "best".

I can't answer that honestly. HubSpot's own directory shows partner reviews, and I know of no independent ranking of audit providers in Finland or anywhere else in Europe. What I can tell her is which questions separate a careful provider from a careless one. Most of those questions are about access and data, because that is where an audit carries risk. Everyone selling an audit will tell you about deliverables. Almost nobody tells you what they copy out of your CRM.

That matters more in Europe than she might expect. Her portal may sit in HubSpot's EU data centre, but the audit happens wherever the provider works: their laptops, their file storage, the AI service they paste findings into. The data centre setting does not follow your data there.

This guide is that question list, with HubSpot's documentation quoted wherever it settles a point. If your main question is price, the audit cost breakdown covers it in detail. If you are choosing between software tools, see the tool comparison.

The four types of audit provider, compared

Every HubSpot audit provider is one of four types, and the type decides how much of your data leaves the portal.

Provider type	How it usually gets in	Who sees your data	Paperwork to ask for	Best when
In-house review	Existing user seats	Your own staff	None beyond your normal policies	You have a RevOps owner with 20-40 free hours
Freelance consultant	User invite, sometimes as Super Admin	One named person	Contract, data processing agreement (DPA), confirmation of where exports are kept	You need judgement on processes, not just data
Agency (Solutions Partner)	Partner access link or user invite	The agency team, possibly subcontractors	DPA, sub-processor list, staff access list	Multi-hub portals, stakeholder interviews, a roadmap
Software tool	App install through OAuth	The vendor's systems; staff only if their terms allow	Published scope list, DPA, sub-processor list, hosting location	Repeatable checks, or a baseline before you hire people

The cost picture for each type is in the cost breakdown. The point of this table is different. A freelance consultant with Super Admin rights and a laptop full of CSV exports can carry more risk than an agency with a signed data processing agreement, even at a lower price.

What a provider actually gets when you grant access

There are three ways in, and each grants a different kind of access.

Route 1: an app install (OAuth)

Software tools connect through OAuth, a standard way of granting an app access without sharing a password. HubSpot requires it for listed apps: an app on the Marketplace "must use OAuth as its sole authorization method" (listing requirements).

Two facts from HubSpot's OAuth documentation matter here.

First, who can install: "Users installing apps in their HubSpot account must either be a Super Admin or have HubSpot Marketplace Access permissions."

Second, and most people miss this one: "Access tokens reflect the scopes requested from the app and do not reflect the permissions or limitations of what a user can do in their HubSpot account. For example, if a user has permissions to view only owned contacts but authorizes a request for the crm.objects.contacts.read scope, the resulting access token can view all contacts in the account."

In plain words: an app's reach is set by its scope list, not by the person who clicked Install. Read the scope list before you approve it.

Marketplace listings give you a head start. HubSpot requires a Shared data table that "must be accurate, up-to-date, and reflect the scopes your app requests", a live privacy policy URL, and that apps "only request scopes your app needs" (listing requirements). An app shared by direct link, outside the Marketplace, has not passed that listing review.

Route 2: a Solutions Partner access link

Agencies in HubSpot's partner programme can send you an access link. According to HubSpot's partner access article, once a client approves it, "you will be created as a partner employee in their HubSpot account with Partner Admin permissions."

The same article lists what a Partner Admin cannot do: add, remove or downgrade Super Admins, change billing, make payments, or "Manage Sensitive Data". That is a narrower grant than handing over a Super Admin seat.

Route 3: a user invite

Some consultants ask to be added as an ordinary user. HubSpot's user article states that "Super Admin permissions are required to create new users and customize their permissions." You set the permission level, so set the lowest one the audit needs. If a provider asks for Super Admin, ask which part of the audit requires it.

Where your data goes during an audit

Your HubSpot data stays where HubSpot hosts it until a provider copies it out. After that, it lives under the provider's terms.

HubSpot's hosting FAQ lists a European Union data centre in Germany and says "customer data is processed and stored in that location." You can check yours under Privacy & Consent settings, on the Data Hosting tab. The same FAQ adds the caveat that matters for audits: "The App that you integrate may process data and transfer data outside of the data center location."

So an EU-hosted portal does not make an audit EU-only. The question is where the provider's own servers, spreadsheets and AI services sit.

The EU's General Data Protection Regulation (GDPR) gives the frame. When a provider processes personal data on your behalf, it acts as a processor and your company is the controller. Article 28 of the regulation says the controller "shall use only processors providing sufficient guarantees" of appropriate technical and organisational measures. It requires a binding contract, usually called a data processing agreement (DPA). It says a processor "shall not engage another processor without prior specific or general written authorisation of the controller". And it requires that the processor "deletes or returns all the personal data to the controller after the end of the provision of services". The official text is on EUR-Lex.

This is not legal advice, and whether an audit counts as processing in your case is a question for your own privacy adviser. In practice, a contact list or deal export is personal data, and most audits touch both. Ask your provider how they see their role. A provider who has never thought about it has told you something useful.

For background on your own obligations, the enterprise governance guide covers retention, access control and deletion inside HubSpot.

Nine questions to put to any HubSpot audit provider

Send these in writing before you grant access. Ask a freelancer, an agency and a software vendor the same nine.

#	Question	A good answer	A warning sign
1	How will you access the portal?	Names the route: app install, partner link or user invite	"Just make me Super Admin" with no reason given
2	Which scopes or permissions do you need, and why?	A list with a reason for each	No list, or write access for a read-only review
3	Who will see our data?	Named people or roles, including subcontractors	"Our team" with no detail
4	Where is the data stored and processed?	Country and provider for servers, files and any AI service	Unknown, or "the cloud"
5	How long do you keep it?	A stated period for exports, samples and reports	Indefinitely, or no answer
6	How do you delete it, and how will we know?	A deletion step at the end, confirmed in writing	Relies on you to ask later
7	Will you sign a DPA?	Yes, or a published DPA you can accept	Has never been asked
8	Which sub-processors do you use?	A dated list, with notice before changes	Not sure, or no list
9	What exactly do we get for the price?	Named deliverables, a fixed fee or clear day rate	A free audit that ends in a sales call

A few notes on using the list.

Question 2 is the one to push on. For an app, the scope list is the access. For a person, the permission set is. Many audits are read-only by nature, so if a provider wants to edit records, ask what they plan to change and who approves it.

Questions 4 and 8 catch AI tools. If a provider runs your property names or records through an AI model, that model's operator is a sub-processor. Ask which one, and where it runs.

Question 9 protects your budget. Free audits exist, and they are usually lead generation for an implementation project. That can still be useful. Just know what you are being sold.

Once the audit is done, you need to act on it. The data quality audit guide explains how to turn findings into fixes, and the governance policy guide covers how to stop the same problems returning.

What provider pages say, and what they leave out

Most audit provider pages I checked describe deliverables and price. Very few say how they handle your data.

In November 2026 I read the audit pages of five agencies that rank for HubSpot audit searches: Vye, Revstac, Fuelius, RevPartners (a RevOps consultancy, audit page) and Resonate. A pattern showed up:

• Price is either a fixed package, a quote on request, or free.
• Scope is described well: workflows, properties, pipelines, reporting, sometimes AI readiness.
• Access method is stated by two of the five. Vye says it needs "access to your HubSpot portal in order to conduct the audit", and Revstac asks for "view-only access to your HubSpot portal".
• Data handling (where data is stored, how long it is kept, a DPA, sub-processors) appears on none of the five pages. Fuelius links its general privacy policy from the sign-up form, under a tick box that says it needs "to keep you in the loop with your portal audit".

Software tools on the Marketplace are a partial exception, because HubSpot makes them publish a Shared data table. One audit app's listing showed which objects it reads but said nothing about where it stores results or for how long.

So the information is usually there if you ask. It is just not volunteered, which is why the question list matters.

Removing access when the audit ends

Plan the exit before you grant access. Each route has its own off switch:

• Apps: HubSpot's connected apps page lets you review "the features currently authorized for the app" and disconnect it.
• Users: "Super Admin permissions are required to deactivate another user" (removal article). A deactivated user's "user profile and associated data will remain for reporting and forecasting", so deactivation keeps your history intact.
• Partner employees: HubSpot says Partner Admins "can remove employees from a client's account via the Partner account". They are created as users in your account, so check your user list yourself too.

Disconnecting stops new access. It does nothing to copies a provider already made. That is what question 6 is for.

Where a software tool fits

A software tool suits the first look; a person suits the judgement calls. A tool gives you a baseline in minutes, and it publishes its scopes, so you know the access before you grant it. A consultant or agency adds the process review that no scan can do. Many teams use both: a tool first, then a person for the fixes that need a decision. The health score explainer shows what a tool-based baseline measures.

PortalPilot is one example of the software type, and I built it, so weigh this accordingly. It connects through OAuth from the HubSpot Marketplace. Its application and database run on Hetzner in Helsinki, Finland. Its security page lists every OAuth scope it requests with a reason for each, including the write scopes used only for changes a user previews and approves. It publishes a DPA and a dated sub-processor list, with 30 days' notice of changes. Ask it the same nine questions you would ask anyone else.

Start your free portal health check at portalpilot.io

View pricing plans

Peter Sterkenburg is the founder of PortalPilot, a continuous portal health analysis platform for HubSpot. He runs it from Finland and thinks every audit should start with the question "what will you copy out of our CRM?"