Emails land on CRM timelines because someone connected an inbox and turned on automatic capture or logging — and the default behavior is to sync everything that touches a known contact. To keep sensitive, personal, or internal emails out, use the platform's exclusion controls rather than turning sync off entirely: in Salesforce, maintain the Einstein Activity Capture Excluded Addresses list and move users who should not capture email at all into a configuration with emails disabled; in HubSpot, add addresses and domains to the Never Log list (personal or account-wide). Neither control is retroactive — exclusions apply to future mail only — so pair them with a one-time cleanup and a written policy about what may never appear in the CRM. This guide covers both platforms and the governance layer that makes the settings stick, the same approach Vantage Point applies in its integration engagements.
It usually surfaces the same way: someone opens a contact or account record, scrolls the activity timeline, and finds an email that clearly should not be there — a compensation discussion, a personal note between colleagues, a message from a family member who happens to share a domain with a customer, a thread with an attorney. Nobody chose to put it there. An integration did, faithfully following rules nobody ever reviewed.
The question "how do we keep certain emails out of the CRM?" is really two questions: which switches control capture, and who decides what belongs on the exclusion list. The settings are simple. The policy is where teams get it wrong.
Every major CRM email integration is designed around the same assumption: if a message involves a CRM contact, it is probably business-relevant, so it gets logged. Einstein Activity Capture continuously syncs email and calendar data for users assigned to a configuration. HubSpot's connected inbox logs emails that match your logging rules. Sales engagement tools, plugins, and BCC-to-CRM addresses add more paths for mail to land on records.
The failure modes are predictable:
Salesforce gives you two distinct levers inside Einstein Activity Capture, and they solve different problems.
The EAC settings include an Excluded Addresses tab where admins define email addresses and domains that the sync ignores entirely. This is the surgical option: add your own internal domains, your attorney's firm, payroll and benefits providers, and any address class that must never appear on a timeline, while leaving normal customer correspondence flowing. Build this list at implementation time — not after the first awkward discovery — and treat it as a living document someone owns.
For users whose mailboxes should not be captured at all — executives in sensitive negotiations, HR business partners, anyone handling whistleblower or personnel matters — Salesforce supports assigning them to an EAC configuration with emails disabled. When emails are disabled for a user, new messages are not added to the activity timelines of related records, are excluded from the Activities dashboard, and are not available to Einstein features such as Email Insights. Users can still send email from the timeline composer manually — capture is what stops, not sending.
Two behaviors to plan around, both straight from Salesforce's documentation:
EAC historically kept captured emails in Salesforce's own storage layer only if you enabled syncing emails as activities; without it, emails surfaced on timelines but lived outside your org's data. Either way, the control question is the same: exclusions and configurations decide what enters, and they are the only reliable place to enforce policy. Relying on users to remember which threads are sensitive does not survive a busy week.
HubSpot's equivalent control is the Never Log list, and it comes in two scopes:
Never Log entries suppress both email logging and synced meeting logging to the excluded addresses and domains. Two details from HubSpot's documentation matter in practice:
Beyond Never Log, HubSpot's email logging rules let you tune which contact emails log at all — for example, only logging when a contact already exists, or suppressing logging for contacts in specific lifecycle stages — and individual users control their own connected-inbox defaults. The account-wide list plus a sensible default rule covers most governance needs.
The settings are mechanical; this is the judgment call. A workable policy usually excludes:
Write the list down, assign an owner, and review it quarterly. Exclusion lists rot: firms change counsel, domains get acquired, new HR vendors appear. A five-minute quarterly review prevents the annual discovery incident.
Vantage Point configures email capture and logging governance as part of Salesforce implementation and HubSpot onboarding engagements — exclusion lists, capture configurations, and the written policy behind them — so sensitive correspondence never becomes CRM content. For orgs that have already logged mail they regret, our managed services team handles the retroactive cleanup and sets the review cadence. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
A short working session is usually enough to inventory every path email takes into your CRM, set the exclusion lists, and document the policy. Contact Vantage Point to schedule one, or explore our integration services for broader sync and data-flow work.
No. Neither Salesforce's Excluded Addresses nor HubSpot's Never Log list is retroactive — both apply to future messages only. Anything already captured or logged has to be located and deleted from the records (and, in Einstein Activity Capture, previously captured email remains in the capture infrastructure). Plan a one-time cleanup alongside the policy change.
Yes, and you should. Both platforms accept domain-level exclusions: Salesforce's EAC Excluded Addresses list and HubSpot's account-wide Never Log list both support whole domains. Excluding your internal domain is the single highest-value entry — it stops internal chatter from accumulating on customer and prospect records.
No. In HubSpot, if an email includes multiple contacts, it still logs to the contacts who are not on the never log list. The same principle applies generally: exclusions filter by address, not by thread. If a thread itself is sensitive, exclude the category of correspondence (for example, counsel's domain) rather than one participant.
Yes. In Salesforce, users in an email-disabled Einstein Activity Capture configuration can still send emails from the activity timeline composer; those emails are simply treated as ad hoc and are not captured going forward. Disabling capture stops collection, not communication.
Give it to whoever owns CRM data governance — typically the RevOps lead or CRM admin — with input from legal or compliance on privileged categories. The critical part is that it has a named owner and a recurring review; an unowned list goes stale within a year.
In HubSpot, yes — the Never Log list suppresses synced meetings to excluded addresses and domains as well as emails. In Salesforce, excluded addresses apply to Einstein Activity Capture's sync scope; if calendar events also need protection, review the EAC configuration's event settings alongside the email settings so the two stay consistent.
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI. Learn more at vantagepoint.io.