Security: Bulk Property Import & Export

Last updated: 16 October 2026

This page describes how Bulk Property Import & Export protects your HubSpot account and data.

Least privilege

• The app asks only for property settings permissions (crm.schemas scopes) for contacts, companies, deals and tickets, plus optional custom object settings. It has no permission to read or change CRM records and uses no sensitive data scopes.
• It never deletes anything in your account unless you explicitly choose to: removing options needs a separate confirmation, and copying only archives properties in the target account when you tick that option. Archived properties stay restorable in HubSpot for 90 days.

Authentication and request integrity

• The app connects through HubSpot’s OAuth flow. HubSpot shows the requested permissions before you connect.
• Every request from the app’s pages in HubSpot to our backend carries HubSpot’s signature (X-HubSpot-Signature-v3). The backend checks the signature with the app’s client secret and rejects requests that are unsigned, changed or more than five minutes old. The HubSpot account and user come from the signed request, never from the request body.
• Downloads, the upload window and billing links use short-lived links signed by the backend (15 minutes, or two hours for result reports).
• Stripe webhooks are verified with Stripe’s signature.

Data protection

• OAuth refresh and access tokens are encrypted at rest with AES-256-GCM. Each ciphertext is bound to its HubSpot account ID, so it cannot be used for another account. The encryption key is kept as a Cloudflare secret, separate from the database.
• Every database query filters on the HubSpot account ID from the verified request; tests check that one account cannot see another account’s previews, jobs, change log or uploads.
• Copying between two accounts is only possible after someone with access to both accounts links them with a single-use code.
• All traffic uses TLS. Hosting is on Cloudflare Workers with a D1 database located in Europe.
• The app stores no CRM records. It stores property settings snapshots, the change log, previews and uploads for up to two hours, and import results for 30 days. See the setup guide for retention and deletion.

Reliability

• Calls to HubSpot stay under HubSpot’s limit of 110 requests per 10 seconds per account, and the app waits and retries when HubSpot answers 429 (rate limited) or a 5xx error.
• Large imports run as background jobs in small batches; each change is recorded once it succeeds, so an interrupted job continues without repeating changes.
• We monitor the share of successful HubSpot API calls (target above 95%) and rate-limited calls (target below 5%).

Uninstall and deletion

Disconnecting in the app settings uninstalls the app through HubSpot’s uninstall API, revokes the token and deletes the account’s data immediately. Uninstalling in HubSpot is picked up from HubSpot’s app lifecycle events within the hour; the remaining account record is deleted after 30 days.

Reporting a vulnerability

Email support@kayabyte.dev with the subject “Security”. We confirm receipt within one business day. Please do not test against accounts you do not own.

See also the data processing agreement, sub-processors and the privacy policy.