Sensitive Data

So we'll talk about what sensitive Data is in HubSpot terms and definitions. We'll talk about how HubSpot supports sensitive data, what are the most recent rollouts that we have released, and we'll also do a live demo. So I'll go through the product and show you all how you can set things up and what use cases are being opened up today. We'll end with some helpful resources. We've created a whole bunch of enablement artifacts that we can go through, make sure that you know where to find them and hopefully we'll have enough time for questions because I'm sure this crowd will have many and I want to make sure this is as helpful as it can be for you all. Great. Let's start out with what is sensitive data. Sensitive data, basically a type of personal data. I'm going to read a little bit from this slide now, but this is pretty accurate. So, type of personal data which requires special protection by law to keep it safe and out of reach from all outsiders unless they have permission to access it. So a lot of it has to do with permission. If lost, compromised or disclosed without authorization, sensitive data could result in substantial harm, embarrassment, inconvenience or unfairness to an individual. So for these reasons, the processing of such data is considered high risk and it's subject to additional security measures. So we need to be more careful with that. This is kind of a broad definition of what sensitive data is, but let's take a look at how we are approaching privacy at HubSpot and especially nowadays when we're in July. So, so lots of developments have happened in HubSpot. So now we are supporting HIPAA compliance with features like audit logging, advanced authentication, session timeouts. We are providing enhanced security through recommendations and tenant specific encryption. I'll talk about that in a bit. And then we have a bunch of enablement resources, as I mentioned, in terms of how you could be handling sensitive data and compliance with HIPAA. And a lot of that is on HubSpot's trust center, which if you haven't checked out, we'll talk a lot about today. It's a great resource and I encourage everyone to get familiar with it, but not necessarily all personal data is considered sensitive. So we actually have a little bit of a kind of a diagram here and we'll go through this now to make sure that everyone is on the same page for how we're using these terms at HubSpot and in this presentation. So the biggest bucket that we're talking about is personal data. All personal Data. Also, you've heard personal identifiable information or also known as pii. Not all of it is considered sensitive. You can think of this as like first name email, that's pii, but it's not necessarily sensitive information. When we look at sensitive data, we've categorized that actually into three buckets based on the risk and the needs that we've seen from our customers. So we're looking at the broadest bucket here is just sensitive data. And within it we have HIPAA specific data and highly sensitive data. And we'll talk about them in a second. So the level of protection increases as we kind of go down the list here. And because there's different legal requirements and obligations and the product experience mimics that and restricts availability and access of this data in appropriate places. So we still need to balance out how much information is restricted, but also what actual valid use cases exist for our customers and kind of meet in the middle there. And so that's how we've approached our rollouts. And this year we have rolled out sensitive data. Number one there, HIPAA data number two and three is what's being worked on right now. But I know these sound broad right now and I'll give you a couple of examples to visualize that real quick.

Maggie Victoria asked the question that I've lost. It may have been answered. But how, how. HIPAA is US Specific, but these other definitions, these are just general definitions. Right. This isn't tied to US Law or any other regional office. It's just kind of how the terms are defined.

Yeah. So HIPAA is U S. Specific. The other ones, we, we're not, we're not talking about specific regions oftentimes and, and here on the slide we talk about this a bit. But there can be sensitive data in general can be defined by different regulations around the world. So like gdpr, for example, is a regulation that you're all familiar with. I know. And not all of the GDPR data is considered sensitive, but there are special causes of gdpr. For example, those that reveal here this third bullet point about demographic data that includes race and sexual orientation. This NGDPR is considered like a special category of GDPR being more sensitive. So that's one example. But it will be definitely up to everyone to kind of review the information and think about like the, the local and regional guidelines. So it's, we're, we're not looking at every single regulation that's out there and we're making sure that we're as, as comprehensive as we can be about the data Types and what we provide with each one of them, which everyone will have to do some due diligence to see if that is enough based on what their legal team says for a specific regional regulation, if that makes sense. But HIPAA is very much US specific, so. Yeah, we'll talk about that in a sec. So starting with sensitive data here, which is kind of this broadest bucket, examples of it would include citizenship and immigration status, government issued IDs like a driver's license or a passport number. Demographic data such as race, sexual orientation, religious beliefs is another example of that. And then there can be health data not subject to hipaa. So for example, there may be fitness information if you're in the United States, or maybe if you have some health information but you are selling in the uk, for example, that would be, that could be that category in there. As we talked about, this category is defined by different regulations around the world. And a lot of those will affect customers, businesses, not all of them. And so this, by providing this additional level of security for such data, we are bringing HubSpot into scope for a number of regulations that will require us to apply a heightened security and to protect customer data. And I'll talk about a little bit about what that means in a second. I'm just going through the buckets now. So the next bucket is HIPAA data specifically. And so HIPAA data, as we just talked about, is US specific. It's HIPAA stands for Health Insurance Portability and Accountability Act. It's a US law and it's designated to provide strict data privacy and security provisions for safeguarding medical information. So what are some examples of medical information? We're looking at patient medical records, health insurance information, billing, lab results, prescriptions, condition or diagnosis. All of that would fit in as some examples of what HIPAA information could look like. If you're based in the United States and if you're, let's say a hospital, HIPAA sets standards and rules for the protection and sharing of sensitive patient information. You may have heard of protected health information, phi, that's a very frequent term that gets used to talk about what specifically should be protected under the HIPAA law. A bit more about this. There's a concept of HIPAA covered entities and then there's a concept of business associates. So covered entities are really three types. Health care providers, insurers and clearinghouses. And they're dealing with protected health information. And a business associate are entities handling PHI to protect the health information on behalf of covered entities. So actually this, I should have edited the words Here, but basically we would be, HubSpot would be a business associate in this context. And you as a customer who may be, let's say a hospital or insurance insurance company, will be entering a business associate agreement with HubSpot in which we are entering a legally binding contract for how we're going to be protecting the personal health information of your end customers and end users. So hopefully those two concepts make sense. I think for those of you in the industry, they should resonate. And last but not least, we have this third group of data that we've considered also sensitive but marked as highly sensitive. We are looking at bank account numbers, Social Security numbers, international bank account numbers like iban. We're considering those examples of data as highly sensitive. And the reason why is because that's also a tightly regulated industry within finance. And we need to have top notch protections in here that's reflective of the risk that is involved with this type of data. So storing such highly sensitive data further increases the risk of being targeted by bad actors and that might result in high regulatory penalties, litigation, reputational damage. So we want to make sure that again, we are balancing this risk with the use cases that exist from what we've heard from customers and making sure access will be as restricted as it makes most sense. And there's any kind of additional protections that I'll talk about in a second with this. But these are kind of the three different types of sensitive data. Again, they go from kind of highest to or lowest risk and highest risk. But you can, you can determine for yourself also by looking at the examples and the regulations. So what is supported in HubSpot today? I know, I think I saw a question come in. Looking at these three buckets for sensitive data. This is available to all of our customers today who have an enterprise account with HubSpot. You can get started with that and you could be storing, as we talked about, let's say passport number, driver's license or religious beliefs. And you could be using that in your marketing, sales service activities to, to deliver on the service or the product that you've promised that to get started with that you will go to Settings, privacy and Consent and then you'll see that option it looks like this. I'll go through it in the live demo so you'll see how it looks exactly for HIPAA data. This is in public beta right now. And again, all of our enterprise customers can get started with the beta. You'll see that you can enter the same from the same setting, privacy and consent, and choose what type of Data that you want to be storing with HubSpot. And you'll see that is in beta there. And then the last one which I just talked about is the highly sensitive data, which is work in progress, so stay tuned for that. You'll hopefully get some product updates from us, but it's not yet available in the product. Okay, so how does support sensitive data? Let's get to the nitty gritty here. Really. We approach it from these three pillars for how the product experience should change based on if you want to be storing sensitive data in HubSpot. First, we want to make sure that access is appropriately restricted. What does that mean? It means that only the folks who really will be using this data and need to access this data are the ones who see it versus someone who shouldn't have access and for some reason is seeing it. So what we are trying to accomplish here is a couple of things. We're trying to reduce access of data stored for both our customers as well as HubSpot employees to make sure that that data, the risk around a data leak here and visibility is as reduced as possible. So making sure that you have the tools to restrict that visibility. And HubSpot employees as well have limited if any view into it as well. The second part of it is being secure. So we are adding additional layer of encryption for property data and files, which are the two main ways that you can be storing sensitive data in HubSpot and that additionally is decreasing the risk of data leak. That also is a way that we accomplish the first goal of appropriately restricting access. Because now with the encryption, not everyone like it's not easy to decrypt such information and access it. So the two go hand in hand. And the last bit here is auditable and making sure that the data access can be audited and there's a paper trail so you can see which employee has access what or in the case of like HubSpot employees who could be getting that information as well. So we're providing auditing tools for customers and HubSpot employees to ensure we can do monitoring in case of suspicious behavior or regular audits that you might need to do. So these are kind of the three pillars and the way that we approached the problem space. I will just give a couple of examples of how how sensitive data manifest itself. If we're looking at something like the contact record. So here we're looking at a contact record in my test account. And the first example of, and the most frequent example of how you most likely will be storing sensitive information would be in a property or a property value. So I've created a property called medical symptom. And in this case this contact has no medical symptoms. But that could say something else, right? So this would be the information information where you could be storing again like passport number you could be storing health information you could be storing. Well, that's actually a file. But other types of sense information goes and go in properties. The second most frequent way in which you might be receiving sensitive information could be through CRM activities like email. So someone just emails you and says hey Maggie, yeah, here's my passport number so you can finish the transaction or whatever it is that you offer. That could be one way that you receive that information. And and then last but not least, a really frequent way in which you can be getting or using sense information Hub so will be through attachments. And the example here would be like a board certificate. I know I chatted with an accelerator who has to collect information like that in order for the enrollment of their students to go through. So that's one example here to give with file or attachments specifically on records. So hopefully this kind of visualizes how the data could look like in HubSpot and how it could be captured. And then this is a bit nitty gritty here, but I just wanted to show you again the data types, what the description of it is and what's permitted for sensitive data versus HIPAA data. And of course the terms, HubSpot's terms are the source of truth. But this table helps to visualize a bit better. So let me go through this really quickly. If we're looking at value in a sensitive property like we looked at medical symptom just in the previous screen, like symptom anxiety, you could store that for any, for sensitive data that we talked about as well as for HIPAA data, which would be the US law, right. CRM attachments. So how we looked at the birth certificate just a second ago is also will be files that appear on the CRM record. They're permitted for both types of sensitive and HIPAA data. There is probably a frequent question about files in general. So you may think of files in HubSpot are so large you can be uploading a picture of a cat in the file manager and that's not necessarily sensitive. And so we, we, we are not encouraging folks to be using the file manager for strong sensitive data because that is independent. That's also independent of any records or CRM information like deals and contacts and so on. So really the focus is CRM attachment. So hopefully this kind of makes sense. People have huge files also. You could do like CSS file and so on, and that's not sensitive either. We just have such a big, such big product and so many different file types that we support CRM activity like email notes and tasks, those show up as we showed in the previous slide at the top of the record pages. And you could be using the, using these for sensitive data today. We are not encouraging people to use that for HIPAA data. So for example, if someone emails you their MRN number, like medical number, you should delete that email from HubSpot. And we would discourage people from exchanging health information. If you're a HIPAA covered entity, proactively with your, with your end users, because email is inherently an insecure channel and so it could get breached when it's even outside of the walls of HubSpot. Right. There is risk to it. Most HIPAA covered entities that we see try to put some sort of an authentication. So if you need to access, let's say lab results, you have to go into a separate patient portal and you can see that sensitive information there. So that's a much more secure way to approach that website activity. So that would be track page visits that appear on CRM record timeline. Let's say you visited, Maggie has visited a consultation page, for example. That is information. You can have that information for sensitive data. We are not supporting this for HIPAA data. So for example, if I were to seek a second opinion on like breast cancer treatment, that could be considered sensitive based on HIPAA laws. So we would encourage folks to disable cookie tracking on those pages basically so that you're not tracking that specific behavior. Last. But, well, not last. Last couple ones here. Inbox conversations. That could be very similar to email, incidentally. You could receive mentions over chat or inbox. That's raw text and it's not a property. We don't know where to store it because you could have a wall of text and then a couple of words and they are sensitive. For now, we are not encouraging customers to exchanging sensitive information in conversations, but we'll be considering opening this up because I know there's some interesting ways that our customers are thinking about creating bots or creating interesting services for their end users. Last but not least, a lot of folks have been using custom CRM cards, which is a cart within a CRM record that displays data from an external app or service. This is a bit nuanced. If the card is built using CRM components and the data is stored in sensitive properties that's fine. Or the data is iframe. That's also fine. So you could host the data in this fashion. Hopefully this makes sense. I know we got a bunch of questions and inbox chat. That's what I meant. Here is just conversations that come in through your chat chat and on that you might place on your website and try to get some of these questions in a bit. All right. So again, source of record or source of truth, sorry is our legal terms and you can see the link legal.HubSpot.com Sensitive data terms in there. But I'll share, we'll share it also at the end of this presentation within the helpful resources section here you'll see what are the permitted features, what's the permitted data and the business associate agreement which is applicable for HIPAA specifically. That will be your source of truth for all of that because we will be updating and adding more features, more use cases and more data types. What I presented just now was a snapshot and a point in time. We do want to be learning from all of our customers, learning what use cases you have, what maybe we are not accommodating for you and expand and grow from here. So this is another two more dense slides I have and then it gets a little bit lighter. But this I think can because we've gotten so many questions about like well tell me what is cover if I have like just a general enterprise account versus if I, if I enable sensitive data in my enterprise account, what will be the difference? And this is kind of what this tries to visualize here. I'm sure I could do a better job to make it this more visually appealing. But if we're looking at just a general enterprise account that hasn't had sensitive data turned on, you still have the option to restrict access based on specific users and teams. When it comes to your properties, you would be using field level permissions for that. I'm sure a lot of you are familiar with it. You can still be tracking in audit logs changes to properties like who's created a property and how the property has changed over time. That's good visibility. And then we have the standard encryption with our with all of HubSpot's accounts. So we are encrypting in transit and we're encrypting at rest as well. And you can read more about this on our trust website center as well with sensitive data. So I did see someone asked this about like you have to turn on. Yes, you have to go and turn on and say yes, I will be Storing sensitive data in HubSpot. And this is the data I'll be storing. Once you do that here is kind of what will change. You will keep, of course you can keep using field level permissioning and restrict property access very granularly. You'll be tracking things in audit logging. You still have the regular encryption tab that all HubSpot data has. And then we're adding an additional layer of encryption for the data marked as sensitive. So some properties will be marked as such. And then that's an additional application layer encryption. There will be some restrictions on where the data will be used. So you won't be able to use these types of properties that are marked as sensitive as personalization tokens again for reducing the risk of leak of such data. You won't be able to sync this data in sandboxes to reduce unnecessary access. And we also will not be training on this data for our ML models. And last but not least, you are probably familiar there is a setting in HubSpot where you can say, hey, can I have SPOT employee look at my account? And that's in the case of your calling support. And they need to troubleshoot. So even if someone can troubleshoot in this account, they cannot see these types of property values. So we're restricting access on, on our end from, from that perspective. And it's very similar for CRM attachments. That's the other main way that we are permitting the use of sensitive data in HubSpot. So today that can be restricted to specific users in teams. It has the general encryption and transit at rest. And so you maintain that if you turn off sensitive data and then there's some additional protections. For example, you're not allowed to share externally without authentication. If you send, let's say Kai a link to a CRM attachments, he will not be able to open that unless he has permission to log into your account and see it. And then there's additional layer of encryption here. And similarly HubSpotters wouldn't be able to see those files. Employees wouldn't be able to see those files. Hopefully this made sense. I know it's. It's a lot to go through, but now we'll go through the live demo and I think that will clear a lot of questions. Hopefully I will stop sharing so I can reshare again. And Kyle, feel free to pause me if there's a lot of questions on something more specific.

There are a lot of questions, but that's okay. I think, I think we'll get to them. One, one very specific question in regards to HubSpot users will not be able to view those things. What about partner users? Or do they have those same restrictions?

Or there's no like there's no setting for. So specifically in HubSpot there's a setting for can a HubSpot employee. When it comes to partners, we have a partner permission set a specific partner role that we encourage everyone to be using because that is not quite Super Admin, but it's like a mini Super Admin role so it tries to be more accustomed to what a partner would need. I don't know if it's exactly fitting the bill for everyone, but that's probably a good one to look at. And overall I think our recommendation would be take a look at who is a super Admin in your account. If when you turn on this feature, this is a good time to do that and do your due diligence and make sure oh like this person hasn't been in my company for a while, they still have Super Admin access for some reason, like remove that or if you feel like someone has super admin access but doesn't need that anymore. And part of the reason why that might be is because maybe we didn't have a granular permission for billing in the past or something like that and now we do. And so they don't no longer need Super Admin, they just need that one permission that was tied to only Super Admin. So I think you can make some of those that's just good clean living. But it becomes more important with this because super admins by default will be able to see this data and then they'll decide who else can see it based on as they control field level permissions and CRM attachment permissions. All right, so let's dig into the demo. So how you turn this on? As I mentioned, you go to privacy and consent in Settings and you will see I've turned it on in this test portal. But basically you'll see sensitive data protection at the very top. Everyone who is a Super Admin and in an enterprise account should see this today. So you could follow along with me if you wanted to. You'll see in your case it will say turn on sensitive data. For me it says edit because I've already turned it on. But what you'll see is that in my case I've said that the types of data I will be capturing in HubSpot, since you have to make the selection, I said I'll capture personal sense information as well. Health, medical data and specifically I am a HIPAA covered entity and that's what I've selected here. If I wanted to also add financial data, I could, but that's sort of hitting the several big industries here. And this is for tracking purposes and this information will be used in the case there's a breach and we need to notify people that there was a breach. We can narrow down who is storing what so that we can inform you of what's happened. And then in this process you'll also agree to the terms. We link to the HubSpot sensitive data terms here so you can visit that page and look at again the permitted uses permitted data and get familiar with the Business Associate Agreement. If it's applicable to you, this is where you would agree to the terms. I know a lot of folks are also asking this question as like, well, where do I agree to the terms or where do I sign the Business Associate Agreement? This is how you would do it basically. So take your time, look through the, the terms and then once you're ready, if you have any questions like let Cal know, let me know and help out. But whenever you're ready, you can just go ahead and agree to the terms. And then if applicable, you'll be agreeing to the Business Associate Agreement and signing it in this fashion. So this is how you turn on the setting and then, so what can you do? Okay, we've turned it on. What happens next? I have opened different tabs, but I think I have to keep. I figured it out. Okay. Okay. So what you can do next is create properties and mark them as sensitive. So in my case I, I've created these properties here and I've marked all of them as sensitive. Loan type, medical history, monthly income, passport number. And then also this property which best describes you because let's imagine that my test account is actually providing fertility services. And so I'm trying to identify someone is starting a family or not ready to start a family and I might want to do an assessment for them on my website. And so. Excuse me. So you'll see that there's a tag here that says sensitive data. Basically, whenever you create a new property, that's what's going to appear and that's how you can distinguish. So let's go ahead and create a new property together to make sure you know how to do this. So let's put it in the contact object, we'll put it in contact information. And what did I let's say again, go with the example of fertility. We'll say what are you interested in learning about more. We'll make this a sensitive property. This is where you choose. Is it sensitive or non sensitive? And yes, this will be gathering protected health information phi, which is what LHIPA covers. And then I'll go next, I'll select that this is going to be, let's say multiple check boxes. And I have prepared, let's say I'm looking for testing and diagnosis is one of the options that I might be interested in. And then maybe fertility preservation is another one. Oops. All right, we have this extra one here. Go next. And I've created this property. Now, this is another property that will be marked as sensitive. And it just gets added to that. Here it is. It just gets added to the list that I'm filtering for right now. What can I do with this? I can go ahead and use it in a form. I've already prepared a form for infertility evaluation form. I've put in email which best describes you. But let's say what did I just create? Learning. What are you most interested in learning about? Come on. Did you switch screens, Maggie? Oh, sorry, I did. Here is. Here is my form. Thanks for that. And I'm trying to add this way. I struggle with it, but. Okay, well, you can drag it over and maybe I just need to update or something. But I have a form basically that I've created where I've added those sensitive properties and then someone can go ahead and fill out the form and then you can set up so. So you can basically put that on your website. Like you can collect that information to a form safely. And the other thing that you can decide to do afterwards is create an email, right, that says like, if you are trying to talk, like, get people to ultimately request an appointment, you can send them some information about what selection that they picked, what they might be interested in and have them request an appointment. You could be then creating a workflow. So in this case, I've created a workflow. If people fill out this form, I'll send them that email that I just created. And of course you can add more to it if you wanted to. And then the other thing you could do, I'm just going to refresh. This is in the audit logs, which are located also in settings. You can come and see that I have created a property that's sensitive. We see that information. So I did it and when I've done it. And then you can go ahead and update it for different contacts. Let's see. I will just update it for one of our HubSpot employees here hopefully they don't mind. But yeah, passport number is another example of this. But if you go view all properties and search for what are you interested in learning more about, you can pick that option. Clearly I have an empty version here. And then you can use the property that you would normally however you normally use it but with the additional security that we've talked about already. What is restricted though? What are some things that you should know are restricted? First we'll go back to the email for a second. One of the things that you won't be able to do is if you go to personalizations and decide to personalize based on this information. I'm trying to find it. Am I in the wrong property?

It was called what are you learning was one of the dropdown options.

Yeah, that's what I remember. Hold on. CRM contact. I don't know why it's not showing up, but you wouldn't be able to select that property in here. Basically. That was going to drive me crazy. There you go. It would say this property store sense information cannot be used for personalization and this is to decrease again the risk for once The CMA leaves HubSpot's walls. Right. You could get intercepted in some way. We're trying to reduce the potential of people finding out that like if you have my first name and this information in there that could potentially be sensitive. So that's one restriction that you'll know about. And then as we mentioned already, sandbox syncing will not work with this, with this data specifically and we will not be doing any training on this data either for ML models. So that's kind of a quick demo of how it's going to come into fruition. It's not drastically different from how you've been using HubSpot. We're trying to strike the right balance of adding the additional protection but also meeting the use cases that you would have to choose this data in your day to day activities. I'm sure there's some more questions about this but I'll at this point go back to my presentation to wrap it up here so we have time for live questions. Well, I guess one of the live questions here I had is like what, what industry you're in. I was curious about that but maybe we've passed that stage. If you're so inclined, feel free to share that. If you're in finance versus healthcare, NPO or something else where you'll be using sensitive data, it's a nice way to get a pulse check on. Yeah. Where people are coming from but in summary, yeah, thanks Alfred, for jumping in here. In summary, where we are at is that HubSpot provides privacy and security protections that enable our customers to operate our products in compliance with hipaa. So of course this is like a bit of a mouthful, but if someone wanted to do something really wrong, they could do something really wrong, right? Like you. Still we're providing the tools to be HIPAA compliant, but it's still up to the customer to do that. Right. And to follow kind of to follow the instructions or follow the best practices. And it's very similar to gdpr. I think I've heard a bunch of people mention this too, like we asked. We provide the tools to be GDPR compliant, but if you wanted to do something wild out there, you still could. So I just wanted to kind of draw that distinction. The features that we are offering today are comprehensive audit logging that we showed quickly. There's advanced authentication. I didn't show the inactive session timeout, but that you can find in settings and you can say basically Kyle hasn't been active for, I don't know, 10 hours, just log him out. So that's a way to restrict also access. We also have account security recommendations. For example, if you don't have two FA set up or if you have too many super admins or if you have partners who are super admins and you should revisit that, you'll get recommendations on that. You have application level per tenant encryption and more. And I think that's field level permissioning. We talked about already restricted access of the data across HubSpot tools and so on. The Trust center which was mentioned, I think Jason put in the link is awesome for resources of storing sensitive data to make sure that you're using our products and services in a way that supports your HIPAA obligations. I already talked about this, but this is enterprise feature. You know how to get to it now and excuse me, last note on partners for partners. The responsibility for partner training is on. Excuse me, on HIPAA and the partner axis lives with the HubSpot customer. So ultimately partners are going to be users in the account. So. Excuse me. So the customer should take a look at the responsibilities that they have in training and make sure that they've hired someone who can provide those services and be trained and responsible. Fortunately, we're at the end here, so. Okay, Kyle, can you help and read some of these?

Yeah, absolutely. If you want to drink from water, I'm here for you. I'm unmuted and ready to go. So yeah, some more FAQs is all health information HIPAA data? No, HIPAA is a US law that that applies to covered entities, mostly doctors and insurance companies and stuff and their business associates or the companies who provide services to them. Health information outside of the US or form company or from companies that are not covered entities or business associates might have other regulations that apply, but they are outside the scope of HIPAA and there's a.gov website there that can give you all the details. What is a BAA and where do I find HubSpot's BAA? I saw someone ask how do I get a copy of this it so first of all, first question what is it? It reflects each party's responsibility for handling protected health information. The HubSpot BAA is included by reference in the Sensitive Data terms. So if you go to that Sensitive Data Terms page you can find the BAA there. Can HubSpot sign our BAA? Customers will need to agree to HubSpot's BAA and do the use cases a customer can carry out change depending on which hubs they have. And Sensitive Data is a CRM feature. Once you have any enterprise hub, your entire portal has access to the features we've been talking about here. That being said, different hubs unlock different functionality and there will be some use cases not specific to sensitive data that require certain host thanks now yeah, you feeling better?

Yes, I'm better. I'm recovered. But yeah. These are some of the FAQs we've been getting from customers so figured I'll include them in here I'm sure. Now we've collected some more from from the chat which thank you for okay, last but not least, I'll just go through the resources and then we'll open it up to for live questions, what are some helpful resources? So we have of course Kyle is front and center here, but we have an awesome product page. If you just type in HubSpot sensitive data you'll get to the product page which talks about what are the features that we support. Cal has made a great video as well and tries to simplify the explanation and just really highlight the top features. The Trust center which we've talked about quite a bit, you can go and you can learn all about other regulations as well. I can learn about SOX compliance in here and so on gdpr, but for the sake of like our examples you'll see that there is security and compliance overview so you can learn about HubSpot's overall security posture and that's in different languages. It's an awesome resource and Then we have sensitive data beta FAQs, so you can copy that, open that up and you can see all these FAQs. We're adding more. I feel like this is even an outdated screenshot I have, and we've added more since then, but just dig into that and I think this is a resource where it'll be helpful for perhaps other folks on your teams who might have additional questions and you can go to it and send that to them. This the terms and services. We already talked about this, but this is a snapshot of what that will look like. So you see the covered services. It says you can store information, sends information in CRM properties, you can import it, you can export it, you can use the API. And I didn't talk a ton about this, but yes, you can sync all this data to proprietary or any other integrations that you need to be syncing back and forth with. And then we give examples of the permitted sensitive data that you could be storing. This table is awesome. And again, we'll be updating it over time as well to include more in it. Yeah, this is what it is. The knowledge base also has been a helpful resource. We have two core articles to remember. One of them is the Storing sensitive data in HubSpot and talks to you a little about even before you get started, what plans are available step by step, how to properties, and so on. And then we have a separate one that's about storing protected health data in HubSpot, and that's a shorter one. It ends up linking to this quite a bit, but whatever is unique in it, you'll see there as well. Did talk about integrations briefly just now, but the HubSpot developer docs include information about this as well. Specifically, the information that I wanted to call out is that we have sensitive data scopes to make sure that if you want an app to be accessing sensitive data, you need to grant those sensitive data scopes to the applicable object. Those are the scopes mentioned here, making sure that whoever you want to be syncing data actually has permission to this data. You can look through this and you could start leveraging it. The APIs are the same. You'll still be using the APIs you know, and you're familiar with. So for CRM properties and just syncing. Yeah, I think those are the main resources that I will add. And then I want to make sure we have a bit of time for questions. It's not as much time as I hope, but still.

Right, thank you so much. This has been really informative I think you've answered a lot of the questions that have come through the chat. But if everyone wants to head over to the Q and A. Now, if you look down at your buttons at the bottom, I believe it's the one farthest to the right or at least pretty close to there's Q and A. You can go over there and you can upvote questions that you would like answered. We will work from most upvoted to least upvoted in the nine minutes we have remaining. But I'll give you just don't click leave. I guess that's the farthest right button. So if sudden drop in attendance, 100% my fault. So yeah, if you all want to go over there, we'll. We'll let the upvoting filter through for a bit. Yeah, fun story, because we all know I cannot hold silence for the 30 seconds that takes you to vote. That video you saw of me talking about sensitive data, everything in it was very carefully reviewed by our legal team and I had to say a word for word verbatim and it was given to me and Kyle. Here's a script. Can you record it really quickly? We need it right now. So that was actually filmed down in my basement. And the reason there are plants in odd places and is because they're covering up the industrial shelving. So I don't think it shows. But that is a very quickly thrown together video, which is why it looks so different from my other ones. All right, good enough. Let's look at the most upvoted questions. Here I am seeing with 12 upvotes from my good friend Lyndon, who features in the Revenue Operations certification course given by HubSpot Academy. I have pro clients collecting sensitive company and contact information through forms like salary information, employment info, company tax compliance docs, etc. Yesterday I was asked if this can be activated in their portal, but I saw that it is only enterprise. Anything on the forecast for moving this to pro users?

Thank you, Linden. Yes, we don't have any plans at this point to move this to professional, but I think we have only just begun. Right. The launch happened in for sensitive data in June and then the public beta for HIPAA was also in June. So this is a new territory for us. I think in general we want to make sure that we have learned from everyone. We have created all the resources that we need to be creating and expanding the use cases and feel good about that. I think it's not out of the question. Right, but it's too early to make that move at this point, but it's definitely something I've heard from several customers already and we'll be keeping an eye on the radar.

Yeah, not that my intuition is in any way a decision making factor in packaging out of HubSpot, but this feels like an enterprise Y feature to me. It just kind of has that flavor to me. I'm not I wouldn't be surprised if it stuck around there for a while. Chrissy asks Is there any progress toward the ability to set contacts or objects as private to be shared just across a small subset of information? Of course, only if that person has the ability to set private contacts.

Yeah, I think I'll answer the question how I understand it, but hopefully I'm understanding it correctly. When it comes to the records each we're treating the different information on it individually. So it's not just that we're not looking at the contact as a whole, but we're looking at the properties on the contact and the activities like emails on the contact or notes on the contact and associations and so on. So when it comes to making it private, I'd imagine like you're talking about restricting the visibility to specific users and teams, you can do that today with properties property values through field level permissioning. You can do that in the activities through we've created granular permissions for email notes and now in beta calling and meetings and tasks as well. So all of those you can restrict. So only the team that owns the record would see that information and then that's kind of how you would accomplish that basically. So if you wanted Kyle to see the email but not the property or vice versa, you have that flexibility. From my time in access management I've learned that customers just would want more and more granularity and it's hard to bulk it together because once you start to bundle it it inevitably needs to be unbundled at some point because there's a team that needs to see this, but they don't need to see some other piece of and information. That's how we're approaching it. I think there might be pieces of the record that are lacking that granularity, but for the most part like the bigger pieces of activities and property values can be restricted based on users and teams and you can accomplish that. But let me know if I didn't quite understand or answer the question. I'm happy to dig into it after this too.

Great. Sabrina asks so we were told to not hold any sensitive data board member employee info in case we get sued. Everything in the CRM is accessible for lawsuits. I'm not sure if that is true. Can you speak about that?

I mean I don't know if you were told this by who you were told it by, like was it like your legal team? And if that's the case, follow the advice of your legal team. Right. Like Kyle and I were joking earlier that like I will definitely not be giving legal advice and it's still up to you to like Review what does HubSpot offer? What are the tools? What does my legal team think about this? What do my security team think about this? And here's the decision that we're going to be making that's like definitely like in everyone, like everyone should be able to make that judgment and we can take feedback and like provide what we are missing potentially or clarifications. But if the advice is coming from like internal legal teams that you know, team, we can't be, we shouldn't be doing this then like listen to them like do kind of what they, they recommend. But, but talking about this broadly, if you like, whenever I chat with customers who need to store such information, they generally need to do it because there's like an appointment and they need to send a follow up or they need to be collecting the information. Again like I'll talk about that accelerator and they need to collect information of students who are apply for their, for their accelerator. Right. And like they need to provide some of this information and based on that they might meet certain criteria. Based on that there's going to be a workflow and so all that powers marketing, sales and services. So it's hard to not have that information in your CRM because you won't be able to take that action. But again, I don't know where the feedback or where the advice came from. If it was advice from HubSpotters, then it looks like it's outdated advice.

Okay, I see a couple of different questions about taking an existing property and turning it into a sensitive data property, which is not possible. But do you want to add a little bit?

Yeah, it's not possible. One of the big reasons why is up until now our terms did not permit storing sensitive data in HubSpot. So we've made the assumption that customers haven't been storing sensitive information in HubSpot. And with that assumption we basically are working with new properties going forward. New custom properties going forward can be marked as sensitive and can start storing some of this information. But everything up until now that's either like default property or you've created already would need to. If you happen to do that because maybe you didn't know that was the case or whatnot. I would say if you can export that data and re import it into the right property and delete the property that existed in the past, that would be what I'd recommend.

Got it. We are at time. I will export all these questions out for you and send them over to you so you and your team can review them. But in the last 60 seconds we have here, if people want to connect with you, do you have a preferred way for them to find you on the Internet or something?

I actually I would say I was going to give my email but might be too much but I was going to say I'm in this pocketeer because Kyle added me and now I'm like I can spy and learn from people. Hopefully you don't mind me being there. So yeah, like hit me up on it. Slack is probably the fastest and thank you all for the amazing questions and the awesome feedback. I'm so appreciative that we have a community like you to be working with and partnering with. So yeah, let's connect on Slack.

Excellent. All right, well thank you so much for being here. Really appreciate it. Thanks all of you for joining. Great discussion here. And that's the end of this session of HubSpot admins. Hug and hope to see. See you all back next week.

Bye Bye everybody.