Agent Hub Security: What Can It Read?

Agent Hub Security: What Can It Read?

By default, Agent Hub’s agents can access your HubSpot CRM data and customer conversation data (like call transcripts and emails), while access to file data is off by default. Admins with Super Admin permissions control all of this from the account’s AI settings, can turn any data access off at any time, and can separately opt out of having account data used to train HubSpot’s AI models. This post walks through exactly what’s accessible, who controls it, and how to adjust it.

If “what can this actually see” is the question standing between your team and turning on an agent, this is the post to read before any of the others in this series.

What Data Can Agent Hub’s Agents Access?

Per HubSpot’s own AI settings documentation, generative AI features, including the agents inside Agent Hub, can draw on three categories of account data, each controlled by its own toggle:

  • CRM data — metadata and user-generated content such as CRM records and default properties. On by default.
  • Customer conversation data — call transcripts, emails, and other customer conversations, used so AI can summarize and respond accurately. On by default.
  • Files data — public files or files stored in your HubSpot account’s files tool. Off by default.

The “Give users access to generative AI tools and features” switch is the master toggle: it has to be on for any generative AI feature, including Breeze Assistant and Agent Hub’s agents, to function at all. It’s on by default as well.

Who Controls Agent Hub’s Data Access?

Only users with Super Admin permissions can manage AI settings. That’s a deliberate design choice: data access for every AI feature in the account, not just Agent Hub, routes through one settings area rather than being configured feature by feature.

To review or change these settings: go to the settings icon in the top navigation bar, then Account Management > AI, then the Access tab. Any of the toggles above can be switched off at any time, and doing so doesn’t require deactivating the agents themselves.

Is My Data Used to Train HubSpot’s AI Models?

This is a separate setting from the data-access toggles above, and it’s worth understanding as its own decision. HubSpot’s AI Model Training setting controls whether your account’s customer data can be used to train HubSpot’s AI models. It’s on by default, but:

  • Turning it off means your data isn’t used for model training and isn’t shared with other HubSpot customers, and you can still use AI features normally.
  • Accounts with Sensitive Data mode turned on are opted out of AI model training by default, and can’t opt back in.
  • Toggle changes here are logged in your account’s audit logs.

What Happens When HubSpot Works With Third-Party AI Providers?

According to HubSpot’s AI Trust & Safety documentation, HubSpot contractually requires any third-party AI provider it works with to meet its security and privacy standards. Vendor data retention is limited: third-party providers can only process data temporarily, to deliver the specific feature, and HubSpot maintains contractual guarantees that these providers do not train their own models on HubSpot customer data.

Access more broadly is also restricted through role-based access controls, meaning only authorized systems and personnel can reach the data needed to deliver a given AI feature, documented in HubSpot’s data processing agreements.

How Do I Limit or Turn Off Agent Hub’s Data Access?

If you want to restrict what agents can see without turning Agent Hub off entirely:

  1. Go to Settings > Account Management > AI > Access tab.
  2. Toggle off Customer conversation data or Files data individually if you want to restrict specific inputs, while keeping core generative AI features on.
  3. Toggle off Give users access to generative AI tools and features entirely if you want to disable all generative AI, including every agent in Agent Hub, at the account level.
  4. Separately, toggle AI Model Training off if your concern is specifically about your data being used to improve HubSpot’s models rather than about day-to-day feature access.

One practical note directly from HubSpot’s own guidance: avoid entering sensitive information into prompts or other AI inputs in the first place, since that’s a simpler and more direct safeguard than relying on settings alone.

The FSM Perspective: Settings Control Access, Governance Controls Outcomes

HubSpot’s data controls answer “what can Agent Hub technically see.” They don’t answer “should this specific agent be looking at this specific data for this specific use case,” and that second question is where most of the real risk conversations with clients actually live.

This connects back to the Context tab we’ve covered throughout this series: if your Knowledge Vaults contain outdated or overly broad information, tightening data-access toggles won’t fix that, because the agent is still working from what you told it to reference. Good AI governance in HubSpot is a combination of both: using the access controls HubSpot provides, and treating what you feed into Context and Knowledge Vaults with the same discipline you’d apply to any other system of record. That’s the kind of due diligence we build into every engagement under the Visibility pillar of our Scalable Business Framework, knowing not just that data is flowing, but exactly what’s flowing and why.

Frequently Asked Questions

Does Agent Hub have access to my CRM data by default? Yes, CRM data access is on by default, alongside customer conversation data. File data access is off by default.

Can I turn off AI data access without deleting my agents? Yes. Toggling off a data-access setting restricts what agents can see going forward; it doesn’t require deleting or deactivating the agents themselves.

Who is allowed to change these settings? Only users with Super Admin permissions in your HubSpot account can manage AI settings.

Is my data used to train HubSpot’s AI models? By default, yes, but this is a separate, independently controllable setting from feature-level data access, and it can be turned off at any time.

Does HubSpot’s AI share my data with other customers? No. HubSpot states that when the AI Model Training setting is off, your data isn’t used to train models and isn’t shared with other customers.

Want a second set of eyes on your account’s AI governance before you activate more agents? Let’s talk it through.