Find sensitive files in HubSpot attachments

By Kayabyte

Attachments in HubSpot collect passports, ID photos, contracts, CVs and payslips over the years, and nobody has a list. A HubSpot Community user asked in June 2024 for an export of all attachments so they could scan for personal data and remove it (Export ALL attachments); the thread has no answer. This guide covers manual checks, an API method and a free audit that works from file names and types. Last verified 11 November 2026.

Be clear about what a name-based scan can do

A scan by file name and type finds files called “passport_scan.pdf” or “payslip_march.pdf”. It will miss “IMG_2041.jpg” that is a passport photo, and it will flag harmless files that happen to have a keyword in the name. It is a way to find the obvious ones fast, not a content scan.

Manual

Open a record’s Attachments section and look through the files, or use View all attachments to see names (HubSpot article updated 22 December 2025). That works for a few key records and does not scale.

API

List the files per record through engagements and read hs_attachment_ids, then read the file metadata (name, type, size, access level). See the API guide. Then apply your own keyword list.

Audit mode in Attachment Exporter

Full disclosure: we built Attachment Exporter: Bulk File Download. Audit mode scans the contacts, companies, deals or tickets you choose (all, a list or a date range) and produces the manifest CSV only; no file is downloaded or stored. Each row gets a risk level (high or medium) and flags. The flags are: identity (passport, ID card, driving licence, national ID and similar), payroll, medical, contract, resume or CV, financial (bank statements, credit cards, invoices), tax, password (a password-like word in the name), executable files, key or credential files, archives, and spreadsheets or archives with “password” in the name. Keywords cover English, Norwegian, Swedish, Danish, German, Dutch, French and Spanish. Audit mode is free and the app is read-only. It installs from our site, not the HubSpot Marketplace.

Files HubSpot marks as sensitive

HubSpot has a “sensitive” access level for files. Downloading those through the API needs a special permission HubSpot staff describe as meant for privately distributed apps (community thread, Nov-Dec 2025). Attachment Exporter does not request it: such files are listed as restricted in the manifest with the reason, and you open them from the record.

What to do with the result

Sort the audit CSV by risk level, review the high rows first, then delete or move the files in HubSpot as your policy says. Deleting is a HubSpot action; the app cannot delete.

FAQ

Does the audit read file contents? No, only names and types.

Does it download files? No.

Is audit mode free? Yes.

Will it find passport photos named IMG_1234.jpg? No.

Questions or corrections: support@kayabyte.dev. HubSpot is a registered trademark of HubSpot, Inc. Kayabyte is an independent developer and is not affiliated with HubSpot or the other products named here.