Your sales team can connect Claude to HubSpot in about a minute. The HubSpot admin is the one who has to decide what it can see, what it can change, and how anyone would know. This guide covers that job: what to approve, how permissions and sensitive data work, what to log, and which admin tasks Claude can realistically help with. If you need the basics of the connector itself, start with our HubSpot connector for Claude review.
Claude for HubSpot admins comes down to three controls. In HubSpot, a Super Admin approves the connector, picks its optional data permissions and decides who may install it. In Claude, Team and Enterprise owners enable the connector for the organization and can set write tools to "Needs approval" or "Blocked." Each user then signs in with their own HubSpot account, and per HubSpot, Claude sees only what that user can already see. Create and update actions are attributed in HubSpot's audit log to both the user and the connector.
Status as of September 23, 2026: the connector is free for all HubSpot plans and requires a paid Claude plan (Pro, Max, Team or Enterprise), per HubSpot's Knowledge Base.
When someone connects Claude, the HubSpot admin owns four decisions: which Claude surfaces are allowed, what data each one can reach, whether it can write, and how activity gets reviewed. HubSpot now offers four ways to put Claude to work on HubSpot data. Each one has a different setup owner and a different control point.
| Surface | What it is | Who sets it up | Read / write | Where it's controlled |
|---|---|---|---|---|
| HubSpot connector for Claude | HubSpot's official connector, used from Claude's chat on web, desktop and mobile (HubSpot KB) | Super Admin approves; each user connects | Read, create and update; no delete | HubSpot Connected Apps and Approved apps; Claude organization and connector settings |
| Remote HubSpot MCP server | The HubSpot-hosted server at mcp.hubspot.com that powers HubSpot's AI connectors and custom agents (HubSpot developer docs) | A developer creates an MCP connector in HubSpot's Development area | Read and write, within the user's permissions | HubSpot Development settings, OAuth consent and user permissions |
| Claude skills (HubSpot Sales Plugin) | Purpose-built skills, such as Call Prep and Pipeline Pulse, that sit on top of the connector (HubSpot) | Users install the plugin in Claude | Same as the connector | The connector's controls, plus Claude's plugin settings |
| HubSpot Agent CLI (beta) | A terminal tool that AI agents such as Claude Code use for scripted, high-volume work (HubSpot KB) | A technical user installs it and signs in to HubSpot | Read, create, update and delete, depending on user permissions | The connected user's HubSpot permissions; dry-run previews |
Most admins will govern the connector first, because that's what business users turn on. Our guide to the HubSpot Agent CLI with Claude Code covers the developer side.
Setup happens in two places, and both matter. Enabling the connector in Claude doesn't grant anyone HubSpot access, and approving it in HubSpot doesn't turn it on in Claude.
| Step | Why | Owner |
|---|---|---|
| Choose a Team or Enterprise plan for company use | Organization-level connector controls live on these plans; audit logs and the Compliance API are Enterprise-only | Claude Owner / IT |
| Enable HubSpot under Organization settings > Connectors | Per Anthropic, an Owner or Primary Owner must add a connector before members can use it | Claude Owner |
| Set HubSpot write tools to "Needs approval" (or "Blocked" for a read-only start) | Anthropic says owners can restrict connector actions org-wide, and users can't override it | Claude Owner |
| Turn on the verified-domain connector restriction (Enterprise) | Stops people connecting company HubSpot accounts to personal Claude accounts; HubSpot is on Anthropic's supported list | Claude Owner |
| Use role-based connector permissions for a pilot group (Enterprise) | Limits the connector, or specific tools, to chosen roles | Claude Owner |
| Step | Why | Owner |
|---|---|---|
| Review who holds Super Admin or App Marketplace Access | These users can connect Claude without approval, including agency or consultant users | Super Admin |
| Approve the connector under Connected Apps > Approved apps | Lets you choose optional data permissions and which users or teams may install it | Super Admin |
| Tighten user permissions and record access | Claude inherits each user's HubSpot permissions, so over-broad roles become over-broad AI access | Super Admin / RevOps |
| Set up Connected Apps notifications | Emails or in-app alerts when an app is installed, disconnected or uninstalled | Super Admin |
| Check AI settings and the AI model training setting | Controls HubSpot's own AI features and data use; separate from the Claude connector | Super Admin |
On the HubSpot side, approval is handled through HubSpot's app access controls. On the Claude side, organization enablement and tool permissions are covered in Anthropic's connector guide. For the training setting, see HubSpot's AI model training setting explained.
HubSpot states that the connector "automatically respects the user permissions defined in HubSpot," so users see only the CRM data they can access in HubSpot. Where object access is limited to specific individuals or teams, Claude is limited the same way. Anthropic says the same thing about connectors in general: Claude inherits each person's permissions from the connected service. HubSpot's documentation talks about records and objects. It doesn't separately spell out field-level property permissions, so test a restricted user before rollout rather than assume.
HubSpot doesn't publish a fixed scope list for the connector. Its developer docs explain that MCP connector scopes are set by two things: the tools available when the user installs, and the permissions the user chooses to grant. Users choose permissions on HubSpot's consent screen when they connect. Super Admins set which optional data permissions are allowed when they approve the app. Required permissions can't be turned off. When a Super Admin grants new data permissions later, each user must reconnect to get them.
Per HubSpot, the connector has no access to custom Sensitive Data properties, including personal health information. If Sensitive Data is turned on in your account, Claude can't access any engagement data, such as emails, calls, meetings, notes and tasks. HubSpot's developer docs say the MCP server blocks activity and conversation data in that case too. Separately, HubSpot's AI settings control HubSpot's own generative AI features. HubSpot doesn't document those toggles as controls for the Claude connector, so don't rely on them to limit it.
The connector can create and update contacts, companies, deals, tickets, custom objects, engagements, content and more. It can also create properties and create or update pipelines, which are admin-level changes. It applies conditional property rules and pipeline stage validations, but not association label validations, and it writes at most 10 records per bulk request. A simple decision guide:
These use cases stay within the tools on the public Claude listing for HubSpot and HubSpot's object table. The example requests are our own illustrations.
The connector can read and search property definitions. Example request: "List contact properties with no description, and group near-duplicates like 'Phone' and 'Phone Number'." Caution: it can create properties but not edit or delete them, so cleanup still happens in HubSpot.
Claude can search records and count gaps. Example request: "How many open deals have no close date or no associated company? Show the owners." Caution: results reflect the asking user's permissions, so run it as a user who can see the whole pipeline.
Example request: "Find companies that share a domain and list them side by side." Caution: the connector can't merge or delete records. Use HubSpot's own duplicate tools or, for volume, the Agent CLI with dry-run.
Example request: "Summarize each deal pipeline's stages and probabilities, and flag stages where deals sit longest." Caution: the connector can also create and update pipelines. Keep write tools on approval so a review doesn't turn into an unplanned change.
Claude can read users, teams, properties, pipelines and organization details. Example request: "Draft a one-page guide to our ticket pipeline and required ticket properties for new support hires." Caution: workflows aren't on the connector's object list, so workflow documentation needs exports, manual review or the Agent CLI.
Example request: "Which campaign drove the most attributed revenue last quarter, and which landing pages converted best?" Caution: check key numbers against HubSpot reports before they go to leadership. HubSpot notes that Claude can make mistakes.
Example request: "List our teams and their members, then draft a first-week checklist for a new sales rep." Caution: Claude can read users and teams but can't change seats, roles or permissions. That stays in HubSpot user management.
Not supported through the connector: workflow audits, deleting or merging records, changing user permissions, and reviewing audit logs. Those need HubSpot's UI, exports, or developer tooling such as the MCP server or Agent CLI.
HubSpot says Super Admins can use audit logs to see who connected or reconnected the connector and when, plus every create and update made through it. What the log includes depends on your subscription. Property value updates and CRM object changes appear on Professional and Enterprise accounts. The Connected Apps page adds install history and an app log. On the Claude side, audit logs and the Compliance API are Enterprise-only. Anthropic's audit-log event list doesn't name connector tool calls, so confirm with Anthropic what's captured for your plan.
For a wider view of Claude governance across both CRMs, see how to deploy Claude safely with Salesforce and HubSpot data.
Vantage Point is a HubSpot partner and an official Claude partner (Member, Claude Partner Network). Through our HubSpot services and Claude implementation services, we help admin teams with:
Across 400+ engagements and 150+ clients, Vantage Point holds a 95% client retention rate and a 4.71/5.0 average engagement rating. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
Claude is only as safe as the permissions and data behind it. Vantage Point can review your HubSpot access model, configure the connector on both sides, and run a governed pilot your team can trust. Talk to Vantage Point about a Claude rollout for HubSpot.
No. Per HubSpot, Super Admins and users with App Marketplace Access can connect without prior approval. Other users can connect once a Super Admin has approved the connector and allowed them to install it. Each user also needs a paid Claude plan: Pro, Max, Team or Enterprise.
No. HubSpot says the connector respects each user's HubSpot permissions, so Claude sees only what that user can see. It has no access to custom Sensitive Data properties. If Sensitive Data is turned on, it can't access engagement data at all.
Yes. The connector can create and update records, log activities, create properties, and create or update pipelines, but it cannot delete. HubSpot recommends setting write tools to "Needs approval" in Claude so every change is confirmed first.
In HubSpot, Super Admins can uninstall the connector for specific users or revoke its approval for everyone under Connected Apps. HubSpot's audit log shows who connected and every create or update made through the connector. Users can also disconnect it in Claude's connector settings.
For company use, Team or Enterprise, because owners can enable connectors and restrict tools for the whole organization. Enterprise adds audit logs, the Compliance API, role-based connector permissions and the verified-domain connector restriction. Confirm current plan features with Anthropic before you buy.
Not quite. HubSpot says its AI connectors, including the Claude connector, are powered by the remote HubSpot MCP server. The connector is the ready-made version for Claude users. Developers use the MCP server directly to connect custom agents.
Review who has Super Admin and App Marketplace Access, then approve the connector for a pilot team only. Next, enable it in Claude with write tools gated and set up Connected Apps notifications. Test what a restricted user can see before you widen access.
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI — 150+ clients, 400+ engagements, and a 4.71/5 average engagement rating. Learn more at vantagepoint.io.