Data governance and compliance
Data governance and compliance for HubSpot migrations
Decide what may move before anything is exported: personal data, consent, retention, residency and regulated records.
Method
Governance questions to answer first
- What personal data is held, and on what legal basis?
- Which consent and opt-out states must carry across?
- What retention and deletion rules apply?
- Where must the data reside, and who may access it?
By platform
Find your system
Open a category, or filter by platform name.
Horizontal CRM4
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Sales Cloud | Possible health, financial or minors' data in custom fields or notes, depending on the org, Free-text notes and emails may contain sensitive data | To confirm |
| Microsoft Dynamics 365 Sales | Possible health, financial or minors' data depending on the customer | To confirm |
| Zoho CRM | Depends on the customer's use; check for health, financial or minors' data. | To confirm |
| Pipedrive | Files may contain sensitive content; the Pipedrive guide mentions screening them. | To confirm |
Real estate CRM3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Follow Up Boss | Possible financial information in buyer pre-approval fields, TCPA/DNC consent for texting and calling | To confirm |
| Wise Agent | Financial information in real estate transactions, Children's names stored on contact records, Trust accounting and brokerage compliance records stay outside HubSpot | To confirm |
| Top Producer | Financial details in transactions, Possible anti-spam rules (CASL/CAN-SPAM) for opt-outs | To confirm |
Lending, wealth & insurance CRM3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Financial Services Cloud | Financial account and holdings data, Possible minors as household members or beneficiaries, Identification documents | To confirm |
| Microsoft Cloud for Financial Services | Financial account and holdings data, Insurance and policy data, Possible minors' data in household records | To confirm |
| Redtail CRM | Financial/wealth client data, Compliance-relevant advisor notes, Possible minors in family records | To confirm |
Admissions & enrollment3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Education Cloud | Minors' data (applicants and guardians), Education records (FERPA/GDPR-type regimes apply by region), Possible health or financial aid data | To confirm |
| Ellucian CRM Recruit | Minors (under-18 applicants and guardians), Student education records (FERPA in the US, where applicable), International applicants (GDPR) | To confirm |
| Ellucian CRM Advise | Education records (FERPA in the US), Disability and health-related data, Minors (applicants and guardians) | To confirm |
Patient acquisition & engagement3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Health Cloud | HIPAA/PHI, Health/medical data, Possible minors' data | HubSpot portals that indicate HIPAA data cannot migrate data centers later. |
| Microsoft Cloud for Healthcare | Protected health information (PHI), Health data subject to HIPAA/GDPR, depending on region, Possible minors' data | To confirm |
| Veeva CRM | Health data, Possible patient-identifiable information, HCP professional data | To confirm |
Recruitment CRM & ATS3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Bullhorn | Employment and hiring data, Possible payroll and financial data, Possible government ID or right-to-work documents in attachments | Bullhorn runs data centres in the US, APAC, UK, Germany and France. Match HubSpot's data hosting region to your requirements. |
| Vincere | Employment and right-to-work documents, Background screening results, Possible financial or payroll data | To confirm |
| Recruit CRM | Candidate resumes may include sensitive data, Possible diversity or right-to-work data, Payroll/timesheet data | To confirm |
Professional services & legal CRM3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Clio Grow | Attorney-client privileged information, Possible health, financial or minors' data in matter notes, Professional conduct and confidentiality rules | Clio operates separate US, CA, EU and AU API regions. Check the region for the firm's account. |
| Lawmatics | Attorney-client privileged information, Possible health data (for example personal injury medical expenses), Possible financial data | To confirm |
| Law Ruler | Attorney-client privileged information, Possible health or injury details in personal injury intakes, Possible minors' data | To confirm |
Industry sales & booking systems3
| Platform | Regulated data to check | Residency |
|---|---|---|
| VinSolutions | Financial/credit data (GLBA-type obligations), Government ID documents, Call recording consent | One partner lists US-based data residency; this is not confirmed by Cox. |
| DealerSocket | Financial/credit application data, Government ID or driver's licence data possible, Marketing consent (TCPA/CAN-SPAM) | To confirm |
| Elead CRM | Possible financial data (credit applications, trade-in values), Driver's licence data if captured, Consumer privacy law obligations (CCPA, TCPA) for texting and calling | To confirm |
Nonprofit & membership CRM3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Nonprofit Cloud | Financial (donation and payment data), Possible minors' data, Possible health-related data for some charities | To confirm |
| Blackbaud Raiser’s Edge NXT | Donor financial and giving data, Possible minors' data, Deceased-donor records | To confirm |
| Blackbaud CRM | Financial (donation and payment data), Possible minors (youth programs), Possible health-related data in notes | To confirm |
Marketing automation & email3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Adobe Marketo Engage | Consent and opt-out records under GDPR, CASL and CAN-SPAM, Check custom fields for health or financial data | To confirm |
| Oracle Eloqua | May hold GDPR/CCPA-covered personal data, Check for health, financial or minors' data in custom fields or CDOs | To confirm |
| Salesforce Marketing Cloud Account Engagement | Form fields may capture health or financial data, Minors' data possible in education | To confirm |
ABM, advertising & social3
| Platform | Regulated data to check | Residency |
|---|---|---|
| 6sense | Possible GDPR/CCPA scope for profiled contacts | To confirm |
| Demandbase | Intent and identification data may count as personal data under GDPR and CCPA | To confirm |
| Terminus | Visitor identification and tracking data may be covered by GDPR and ePrivacy rules. | To confirm |
Forms, events & conversion3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Typeform | Survey answers may contain health, financial or minors' data depending on use | To confirm |
| Jotform | Health data, if forms collect it, Payment data, Minors' data (education forms) | To confirm |
| Formstack | Forms may collect health, financial or minors' data, so check the form content., File uploads may hold sensitive documents. | To confirm |
Customer support & help desk3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Zendesk Support | Support tickets may contain health, financial or payment data typed by customers, Minors' data possible, Attachments may hold sensitive documents | To confirm |
| Freshdesk | Tickets and attachments may contain health, financial or minors' data depending on the customer, Regulated accounts should use an engineer-led migration with an audit trail | To confirm |
| Intercom | Support chats may contain health, financial or minors' data | The API has US, EU and AU regional base URLs. |
ITSM, contact centre & field support3
| Platform | Regulated data to check | Residency |
|---|---|---|
| ServiceNow ITSM | Cases may hold health, financial or minors' data in free text, Employee HR data if HR cases are in scope | To confirm |
| Jira Service Management | Tickets may hold health, financial or minors' data depending on the customer base., Attachments may contain credentials or sensitive data. | To confirm |
| Freshservice | Tickets may include credentials, security incidents, HR or health information, or financial data., Employee data in HR service requests. | To confirm |
Customer success, feedback & knowledge3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Gainsight | Free-text timeline notes and attachments may contain sensitive or contractual data | To confirm |
| ChurnZero | Customer feedback and notes may contain sensitive data | To confirm |
| Totango | Free-text notes may contain sensitive customer data, NPS and survey data about end users | US and EU regional API endpoints exist. Full residency terms were not verified. |
CPQ, proposals & sales documents3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce CPQ | Financial or contract terms, Possible customer pricing confidentiality | To confirm |
| Salesforce Revenue Cloud | Financial/contract terms, Possible tax IDs | To confirm |
| Oracle CPQ | Contract and pricing terms are commercially confidential, Possible export-control or regulated product data in manufacturing | To confirm |
Billing, subscriptions, payments & accounting3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Stripe Billing | Financial/payment data (card data stays in Stripe; do not copy PANs), Tax and invoice records | To confirm |
| Stripe Payments | Financial/payment data, Card data stays in Stripe and is not migrated | To confirm |
| Chargebee | Financial/payment data (card tokens, PCI scope stays with the gateway), Tax and invoicing data | To confirm |
Revenue intelligence & sales engagement3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Clari | Call recordings may need two-party consent, Possible financial forecasting data, Sensitive information may appear in transcripts | To confirm |
| Gong | Call recordings may include special-category or financial data, Recording consent laws vary by jurisdiction | To confirm |
| Revenue.io | Call recordings may require two-party consent, Possible health or financial content in call audio, depending on the customer | To confirm |
Integration & workflow automation3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Zapier | Zaps may carry health, financial or minors' data, depending on connected apps | To confirm |
| Make | Health, financial or minors' data may be passing through scenarios depending on the customer. | To confirm |
| n8n | Workflows may carry health, financial or minors' data, depending on the connected systems. | To confirm |
Customer data, enrichment & data quality3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Twilio Segment | Possible health or financial data in custom traits, Minors' data if the consumer app serves them, GDPR/CCPA deletion obligations | To confirm |
| mParticle | Device advertising identifiers, Possible health or financial data in event payloads, depending on the customer | To confirm |
| RudderStack | Possible health, financial or minors' data depending on the events tracked, Review before syncing to HubSpot | To confirm |
Warehouses, databases & analytics3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Snowflake | Warehouses often hold financial, health or minors' data. Exclude these from synced views unless the HubSpot account is approved for them. | HubSpot says its warehouse integrations work across multiple cloud regions. Snowflake account region details are unverified. |
| Databricks | Warehouse tables may hold health, financial or minors' data depending on the customer; exclude it from syncs unless required. | To confirm |
| Google BigQuery | Health data: HubSpot does not send HIPAA-regulated data to BigQuery, Financial data, Minors' data | HubSpot says its warehouse integrations work across multiple cloud regions. Confirm the BigQuery dataset location against your requirements. |
Agent builders & conversational AI3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Salesforce Agentforce | Health records, Financial or account numbers, National identifiers | To confirm |
| Microsoft Copilot Studio | Chat transcripts may contain health, financial or minors' data depending on the use case. | To confirm |
| Google Vertex AI Agent Builder | Documents may contain health, financial or minors' data, Workspace email content | Data stores are created in a chosen location, such as global. Check the location before re-ingesting. |
CMS & website builders3
| Platform | Regulated data to check | Residency |
|---|---|---|
| WordPress | Membership or WooCommerce sites may hold payment-related or minors' data., Health or education sites may carry sensitive form data. | To confirm |
| WordPress.com | Check for health, financial or minors' data in form submissions, if present. | To confirm |
| Drupal | Check webforms for health, financial or minors' data., Check member-only or gated content. | Self-hosted, so residency depends on the host chosen. Not sourced. |
Headless CMS, content operations & SEO3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Contentful | Check entries for health, financial or minors' data before moving it | To confirm |
| Sanity | Check content for health or financial data in regulated sites | To confirm |
| Strapi | Frontend user data if the app stores it, Possible minors' or health data depending on the app | Self-hosted deployments depend on the customer's own infrastructure. Strapi Cloud region details were not verified. |
Ecommerce, learning & customer portals3
| Platform | Regulated data to check | Residency |
|---|---|---|
| Shopify | Payment-related order data, Possible minors' data for edtech, Possible health-related purchases | To confirm |
| Shopify Plus | Payment data stays in Shopify, so exclude card data., Possible minors' data in edtech use cases (category-level) | To confirm |
| Adobe Commerce | Payment data should never be exported; keep it out of HubSpot (PCI scope), Possible minors' data or education records, depending on the store | To confirm |
Quick answers
Frequently asked questions
What governance applies to a CRM migration?
Consent and opt-out states, retention and deletion, data residency, access control and any regulated records must be agreed before export.
Talk to a partner
Want a partner to run this move?
A network of 153+ tiered HubSpot partners and 1,800+ accounts of experience. Tell us what you are moving and which hub matters most.
Talk to a partner