Quick Answer
A HubSpot-Salesforce integration audit is a structured inventory of every connection moving data between your CRM platforms — native syncs, middleware, custom API jobs, and the personal Zapier or Make accounts nobody documented. It matters for any organization running HubSpot and Salesforce together, especially after a merger, an acquisition, or turnover on the team that originally built the connections. The audit tells you what's actually syncing what, who owns each path, and whether an undocumented integration is just clutter or an active data-risk problem. Vantage Point runs this exact inventory as part of a complimentary CRM health check for organizations that no longer have a clear picture of their own integration layer.
TL;DR
- What it is: A full inventory of native connectors, middleware, custom APIs, and shadow automations moving data between HubSpot and Salesforce.
- Why it matters: Nobody can govern, secure, or troubleshoot an integration they don't know exists.
- Best for: Organizations that inherited their tech stack through growth, acquisition, staff turnover, or years of "just add another connector."
- Decision point: Whether your unknown integrations are harmless clutter or an active data-governance and security gap.
- How Vantage Point helps: Our HubSpot-Salesforce integration team runs a read-only audit as the first phase of any dual-platform engagement.
Why "We Don't Know What's Connected" Is So Common
Ask most operations leaders to list every integration touching their CRM, and you'll get a confident answer about the two or three integrations someone set up on purpose — the native HubSpot-Salesforce sync, maybe a marketing automation connector. Ask a follow-up question about what else might be pulling or pushing data, and the confidence usually drops fast.
This isn't a sign of a poorly run team. It's what happens naturally when two CRM platforms have been in place for more than a couple of years. Someone in sales ops set up a Zapier connection to solve a one-off reporting problem in 2023 and never told anyone. A consultant built a custom API job during an implementation project and left the company before documenting it. Marketing added a new tool that "just needed API access" to both platforms. An acquisition brought in a second Salesforce org with its own sync running in parallel to the one everyone knew about. None of this happened out of negligence — it happened because integrations are easy to add and easy to forget.
The fix isn't a lecture about documentation discipline. It's an audit: a systematic pass that finds every connection currently moving data, whether or not anyone remembers approving it.
What Is a HubSpot-Salesforce Integration Audit?
An integration audit is a structured inventory and review of every mechanism currently moving data between your CRM platforms — what's connected, what data flows in which direction, who or what owns the connection, and whether it's still needed. It is not a redesign project and not a migration. It's a diagnostic step that answers one question clearly: what is actually connected to our CRM right now?
A complete audit typically covers four categories of connection, because each one hides in a different place and requires a different discovery method.
How the Audit Works: Four Places Integrations Hide
1. Native and certified sync tools
Start with the connections everyone already knows about — HubSpot's native Salesforce integration, or a certified app from the HubSpot Marketplace or Salesforce AppExchange. These are the easiest to find because they show up in each platform's connected-apps or integrations settings. Document exactly which objects and fields each one syncs, in which direction, and on what schedule. Even "known" integrations are frequently misconfigured — syncing more fields than anyone intended, or running on a stale field-mapping from an earlier stage of the business.
2. Middleware and iPaaS platforms
Next, check for integration platforms sitting between HubSpot and Salesforce — tools like Workato, Zapier (business/team accounts), Make, or a MuleSoft instance. These are usually set up deliberately, but ownership tends to erode over time as the person who built the workflows changes roles or leaves. Pull the full list of active workflows or "recipes" in each platform, not just the ones currently top-of-mind, and check the connected-account credentials — a workflow authenticated under a departed employee's login is both an audit finding and a security exposure.
3. Custom API integrations and webhooks
These are the hardest to find because they don't live in a marketplace listing — they're code, usually built by a developer or a former consultant, calling the HubSpot or Salesforce API directly. Look at API usage logs in both platforms (Salesforce Setup shows API usage by connected app and user; HubSpot's account activity log shows API call sources) and match every active API key or connected app back to a known, currently-supported integration. Any API credential you can't attribute to a documented purpose goes on the findings list.
4. Shadow automations
The last category is the one most audits miss entirely: personal automation accounts. An individual employee's personal Zapier or Make account, a browser extension that syncs contacts, a scheduled export to a personal spreadsheet — these move real data and often use an individual's personal login rather than a service account. They're rarely malicious, but they're invisible to IT, survive employee departures as orphaned automations, and frequently violate whatever access policy the organization thinks it has. Finding these usually requires asking department leads directly: "what have you or your team set up yourselves to move data between systems?"
What a Healthy Two-Platform Architecture Looks Like
The goal of the audit isn't zero integrations — dual-platform organizations legitimately need several. The goal is knowing which ones you have and whether they meet a basic standard of health.
| Characteristic | Typical sprawl | Healthy architecture |
|---|---|---|
| Source of truth | Ambiguous — the same field can be edited in either platform and overwritten by the next sync | Defined per object and field: one platform is authoritative, the other reflects it |
| Ownership | Unknown or tied to a former employee's account | Assigned to a role or team, documented, and transferable |
| Credentials | Personal logins, shared passwords, or expired API keys still active | Dedicated integration/service users with scoped, least-privilege access |
| Documentation | None, or out of date since the last reorganization | A current map of every connection, its direction, and its purpose |
| Monitoring | Nobody notices until a report looks wrong | Sync failures and volume anomalies are visible and alertable |
| Redundancy | Multiple tools quietly doing the same sync job | One tool per data path, consolidated deliberately |
When Unknown Integrations Are a Data-Risk Issue, Not Just Clutter
Not every undocumented integration is urgent. A forgotten one-way export that nobody relies on anymore is clutter — annoying, worth cleaning up, but not dangerous. Treat an integration as a genuine risk, not just tidiness, when the audit turns up any of the following:
- It moves sensitive fields without a documented purpose — contact PII, financial data, or account-level details flowing to a tool nobody can explain.
- It runs under a personal login, especially one tied to someone who has since changed roles or left the company entirely.
- It has broad, unscoped access — an API key or connected app with far more permission than the workflow it supports requires.
- It conflicts with another sync, creating a race condition where two systems overwrite the same field in opposite directions.
- Nobody can name an owner. An integration with no accountable owner is, by definition, ungoverned — even if it happens to be working fine today.
Any one of these turns a routine cleanup item into a priority finding that belongs in front of whoever owns data governance or security at your organization.
What Businesses Should Do Next
If you're not confident you could list every integration touching HubSpot and Salesforce today, start with the inventory before you start any new integration project, platform migration, or AI rollout that depends on clean, trustworthy data flowing between systems.
- Inventory before you build. Don't add new automation on top of an architecture you can't fully see.
- Assign an owner to every connection you find, including the ones that turn out to be fine as-is.
- Retire what's redundant rather than layering a new sync on top of an old one that already does the job.
- Move shadow automations onto governed tooling — a documented workflow with a service account, not a personal login.
- Repeat the audit on a schedule, not just once. Integration sprawl rebuilds itself within a year or two if nobody owns the inventory.
How Vantage Point Helps
Vantage Point is a Salesforce and HubSpot partner, and our HubSpot-Salesforce integration team runs exactly this kind of audit as the diagnostic phase of a dual-platform engagement — a read-only review of native sync, middleware, custom APIs, and shadow automations, with findings tied to what we actually found in your environment rather than a generic checklist. For the API and middleware layer specifically, our system integration and data migration team maps every connection and flags anything that looks like a security or governance gap for your compliance and security review. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
For a deeper look at integration architecture patterns once your inventory is complete, see our related guides on building the integration layer and the complete guide to HubSpot-Salesforce integration.
Not Sure What's Actually Connected to Your CRM?
Vantage Point's complimentary CRM health check starts with exactly this question — an initial review and walkthrough of what's syncing, what's redundant, and what's an actual risk, with recommendations tied to your scope and timeline. Contact Vantage Point to schedule one, or explore our HubSpot-Salesforce integration services.
Frequently Asked Questions
What is a HubSpot-Salesforce integration audit?
It's a structured inventory of every mechanism currently moving data between HubSpot and Salesforce — native sync settings, middleware or iPaaS workflows, custom API integrations, and personal "shadow" automations — documenting what each one does, who owns it, and whether it's still needed.
How do we find integrations we don't know about?
Check each platform's connected-apps and integrations settings for known tools, pull API usage logs to match every active credential to a documented purpose, review any middleware platform's full workflow list rather than just the familiar ones, and ask department leads directly what they've set up themselves. That last step catches shadow automations that never show up in an admin panel.
What's the difference between native sync, middleware, and custom API integrations?
Native sync is a built-in or marketplace-listed connector configured directly in HubSpot or Salesforce settings. Middleware (like Workato, Zapier, or Make) sits between the platforms and runs workflows you build yourself, often connecting more than two systems. Custom API integrations are developer-built code that calls each platform's API directly, with no third-party tool in between — and no settings screen to discover them from.
Is a personal Zapier or Make account a real security risk?
It can be. The workflow itself may be harmless, but it typically runs under an individual's personal login rather than a dedicated service account, which means it has no owner of record, no handoff plan if that person leaves, and no visibility for IT or security. Combine that with access to sensitive fields and it becomes a genuine governance gap, not just a tidiness issue.
How often should we audit our CRM integrations?
Run a full inventory any time you've had significant staff turnover on the team that manages your CRM, after a merger or acquisition, and before any major new integration or platform project. Beyond that, an annual pass is enough to catch the sprawl that naturally accumulates as teams add point solutions.
Do we need to fix every issue an audit finds?
No. Most audits turn up a mix of genuine risks, redundant-but-harmless connections, and integrations that are simply fine as documented. The value of the audit is being able to tell those three categories apart and prioritize accordingly, rather than treating every finding as equally urgent.
How long does an integration audit take?
A focused first-pass inventory is typically measured in days, not months — most of the time goes into pulling logs and interviewing team leads rather than technical complexity. Follow-up cleanup work, like consolidating redundant syncs or migrating shadow automations to governed tooling, takes longer and depends entirely on what the audit finds.
Should the audit be read-only?
Yes. A proper integration audit shouldn't change any configuration — it should only observe and document what's currently in place. Any partner running the audit should be able to explain exactly what they're looking at and why without touching a single setting until you've reviewed the findings together.
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI. Employee-owned, with senior consultants only — no junior handoffs. Learn more at vantagepoint.io.
