Data

HubSpot and the GDPR: AI training, data location and DPA

Starter: Trains on your data unless you switch it off. EU hosting available · DPA in the terms.

Vendor: HubSpotSales, marketing and supportChecked on How we check

Verdict

Is HubSpot GDPR compliant?

Starter

Business

Trains on your data unless you switch it off

EU hosting available · DPA in the terms

Price: $20 / user / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does HubSpot train on your data?

Trains on your data by default?

Checked

Trains on your data unless you switch it off.

Yes: AI Model Training is on by default; a Super Admin can switch it off for future data. Third-party AI providers may not train on customer data

Source: knowledge.hubspot.comHelp article (updated 8 Sep 2026)Second source: knowledge.hubspot.comChecked on

Switch-off

How do you turn off AI training in HubSpot?

How to switch training off

Checked

You can switch the training off.

A Super Admin must act: Settings > Account management > AI > Access tab, turn the 'AI Model Training' switch off (on by default). It applies to future data only; data already used cannot be removed from trained models

Source: knowledge.hubspot.comSection 'Opt out of HubSpot's AI model training in your AI settings' (updated 8 Sep 2026)Checked on

Location

Where does HubSpot store your data?

Where data is stored by default

Checked

Assigned by sign-up location: US, Canada, Australia or EU (Germany); a sign-up from Germany is placed in the EU data centre

Source: knowledge.hubspot.comFAQ (updated 24 Jul 2026)Checked on

EU hosting on this plan

Checked

EU hosting available.

Yes: EU (Germany) data centre; paid Starter and above can change data centre later

Source: knowledge.hubspot.comHosting regions and migrationChecked on

Contract

Does HubSpot sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. DPA (last modified 16 Sep 2026) is incorporated into the Customer Terms of Service; DPF and SCCs

Source: legal.hubspot.comPreamble, sections 11 and 13.1Checked on

Processors

Who else handles HubSpot data?

Sub-processors (companies that handle the data for them)

Checked

16 listed.

Public (last modified 16 Sep 2026): 17 third-party companies; for EU accounts the AI providers process in the EEA (AWS, Google, OpenAI incl. Switzerland, Baseten from 16 Oct 2026); 30 days' notice to subscribers

Source: legal.hubspot.comInfrastructure and feature-specific tablesChecked on

EU–US Data Privacy Framework

Checked

On the list.

Active (HubSpot, Inc.; EU-US, Swiss-US, UK Extension)

Source: dataprivacyframework.govSearch 'HubSpot'Checked on

Retention

How long does HubSpot keep your data?

How long data is kept

Checked

Customer data is kept for the subscription and deleted or returned when it ends, under HubSpot's product-specific procedures; HubSpot enforces zero data retention with its AI providers where possible

Source: legal.hubspot.comSection 3.6 'Deletion or Return of Customer Personal Data'Second source: knowledge.hubspot.comChecked on

Security

Which certifications and admin controls does HubSpot have?

Security certifications

Checked

SOC 1 Type II, SOC 2 Type II and SOC 3; HIPAA; EU Cloud Code of Conduct; TRUSTe Certified Privacy. HubSpot cites ISO 27001 only for its hosting providers

Source: trust.hubspot.comTrust Center 'Badges'Second source: legal.hubspot.comChecked on

Admin controls for AI

Checked

Yes. Admins can turn off or limit HubSpot's generative AI features and the data sent to AI providers in the account's AI settings (Account management > AI)

Source: knowledge.hubspot.comFAQ 'Can I configure how generative AI features are used?'Second source: knowledge.hubspot.comChecked on

The vendor doesn't say: price.

Alternatives

HubSpot alternatives that don't train on your data

Other sales, marketing and support tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Pipedrive

    Growth · €39 / user / mo

    Says it doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Attio

    Pro · €74 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

  • Dynamics 365 Sales

    Professional · €56.30 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓?✓

  • folk

    Standard · €22 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✕

  • GetResponse Email Marketing

    Marketer · €44.28 / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices