Most CRM breaches don’t hit the CRM, they hit a third-party app that mishandled its access tokens. Here is exactly how the Zaags assistant connects to your HubSpot, and what keeps your data safe.
The assistant connects to your HubSpot portal that you authorise (OAuth), or a private-app token you paste. We never hold an admin password, and you can revoke it from HubSpot at any time.
We request read-focused scopes only (contacts, companies & deals read; tickets/tasks optional), never account-wide or “all data” access. The assistant can read only a short allowlist of records, and can only create tickets, notes, contacts and tasks, it can never edit or delete your data.
Access keys are stored encrypted (AES-256), never in plain text, never in our database in clear, and never shared with anyone. HubSpot uses one Zaags-owned platform app, we never hold a per-client secret. If you connect a private-app token instead, it is encrypted at rest and never shared.
When you disconnect, we call HubSpot to revoke the refresh token, a copied token cannot be reused later.
Before revealing anything personal, a customer is verified with a one-time passcode matched against your HubSpot contacts. No verification, no personal data.
We use the standard HubSpot API, nothing installed in your portal beyond the connected app you approve. Setup takes about ten minutes and every action is written to an audit log.
Every call from the assistant comes from a single IP. Lock your connection to it so only we can use it:
Security is shared. These settings live in HubSpot, we recommend them all, and our setup guide walks you through each:
209.16.158.237 if you allowlist by IP.Your keys are yours, encrypted, least-privilege, revocable in one click, and only ever used from one address, with a customer identity check before any personal data is shared. If a vendor can’t explain that simply, they shouldn’t hold your keys.