{"id":404,"date":"2025-11-12T05:01:28","date_gmt":"2025-11-12T05:01:28","guid":{"rendered":"https:\/\/blog.coffee.ai\/security-and-data-privacy-compliance-ai-crm-for-sales\/"},"modified":"2026-09-13T05:06:45","modified_gmt":"2026-09-13T05:06:45","slug":"security-and-data-privacy-compliance-ai-crm-for-sales","status":"publish","type":"post","link":"https:\/\/www.coffee.ai\/articles\/security-and-data-privacy-compliance-ai-crm-for-sales","title":{"rendered":"Automate HubSpot Call Logging Securely: Compliance Guide"},"content":{"rendered":"<p><em>Written by: Doug Camplejohn, CEO &amp; Co-Founder, Coffee | Last updated: September 12, 2026<\/em><\/p>\n<h2 id=\"key-takeaways\">Key Takeaways<\/h2>\n<ul>\n<li>HubSpot stores only call metadata. Recordings and transcripts belong in a separate encrypted store to keep a clean compliance boundary.<\/li>\n<li>Use a webhook receiver that verifies signatures, redacts PII, and enforces idempotency before writing to the HubSpot Calls API.<\/li>\n<li>Request minimum OAuth scopes and map <code>external_call_id<\/code> to HubSpot call IDs at write time to support GDPR and CCPA erasure jobs.<\/li>\n<li>HubSpot Sensitive Data does not auto-redact <code>hs_call_body<\/code> or govern external recordings, so manual redaction and separate storage stay mandatory.<\/li>\n<li>Coffee automates this compliant call logging architecture for HubSpot, handling the heavy lifting for your team. <a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\"><strong>See how Coffee handles the compliance layer for you<\/strong><\/a>.<\/li>\n<\/ul>\n<h2>How HubSpot Handles Phone Calls And Recordings<\/h2>\n<p>HubSpot\u2019s Calls API stores call metadata such as direction, duration, disposition, timestamps, and CRM associations. It also accepts free-text call notes in the <code>hs_call_body<\/code> property.<\/p>\n<p>As of August 31, 2026, HubSpot changed how recorded meetings are logged. Meetings recorded via Notetaker or a video conferencing integration now create a meeting record only. Recordings made through HubSpot\u2019s calling feature still create call records. The call object represents phone calls, while the meeting object represents video sessions.<\/p>\n<p>Compliance-sensitive deployments keep recordings and transcripts out of HubSpot. HubSpot\u2019s Product Specific Terms, Section 8.8, state that HubSpot does not guarantee compliance for calling recording features and that customers remain responsible for recording content. The safe boundary is simple: store metadata in HubSpot and store content in a separate encrypted system.<\/p>\n<h2>How To Automate HubSpot Call Activity Logging Securely<\/h2>\n<p>Enforcing the metadata-versus-content boundary requires a layer between your telephony provider and HubSpot. That layer is a webhook receiver that inspects every event before it reaches the CRM.<\/p>\n<p>The automation mechanism is a webhook receiver that sits between your telephony provider and the HubSpot Calls API. The diagram below shows the critical split: metadata flows through the redaction and validation layer into HubSpot, while recordings and transcripts branch to a separate encrypted store and never touch the CRM.<\/p>\n<p><code>Telephony Provider \u2192 Webhook Receiver \u2192 Redaction\/Validation Layer \u2192 HubSpot Calls API \u2192 HubSpot Call Record<\/code><br \/> <code>Recordings\/Transcripts \u2192 Separate Encrypted Store (AES-256, TLS 1.2+)<\/code><\/p>\n<p>The HubSpot endpoint for creating a call record is <code>POST \/crm\/objects\/2026-03\/calls<\/code>. The payload below shows the minimum-necessary write. <code>hs_call_body<\/code> carries only a redacted summary, and <code>hs_call_recording_url<\/code> stays empty because the recording itself lives in your encrypted store.<\/p>\n<pre><code>{ \"properties\": { \"hs_timestamp\": \"2026-09-12T14:00:00Z\", \/\/ ISO 8601 UTC; required \"hs_call_direction\": \"OUTBOUND\", \/\/ INBOUND or OUTBOUND \"hs_call_duration\": 187000, \/\/ milliseconds \"hs_call_disposition\": \"CONNECTED\", \/\/ use your portal's disposition GUID \"hs_call_status\": \"COMPLETED\", \/\/ COMPLETED | MISSED | CANCELED \"hs_call_body\": \"[REDACTED \u2014 see encrypted store ref: ext_call_id_abc123]\", \/\/ PII-stripped summary only \"hs_call_recording_url\": \"\", \/\/ leave empty; recording lives in encrypted store \"hs_call_external_id\": \"ext_call_id_abc123\" \/\/ your system's call ID for erasure mapping }, \"associations\": [ { \"to\": { \"id\": \"CONTACT_ID\" }, \"types\": [{ \"associationCategory\": \"HUBSPOT_DEFINED\", \"associationTypeId\": 194 }] }, { \"to\": { \"id\": \"COMPANY_ID\" }, \"types\": [{ \"associationCategory\": \"HUBSPOT_DEFINED\", \"associationTypeId\": 182 }] } ] }<\/code><\/pre>\n<p>Store the returned HubSpot call ID alongside <code>hs_call_external_id<\/code> in your own database immediately after a successful <code>201<\/code> response. Without that pairing, a later erasure request gives you no way to find the HubSpot record that matches a given recording. That mapping becomes the foundation of every downstream erasure workflow.<\/p>\n<h2>How HubSpot Sensitive Data Applies To Call Objects<\/h2>\n<p>HubSpot\u2019s Sensitive Data feature is available only on Enterprise tiers of Marketing Hub, Sales Hub, Service Hub, Data Hub, Content Hub, or Smart CRM. Activation is permanent. Once enabled, you cannot turn it off or remove selected data categories. To store HIPAA-covered data, an admin must select both the \u201cHealth\/Medical Data\u201d checkbox and the \u201cWe are a HIPAA-covered entity or business associate\u201d checkbox so HubSpot can track BAA application.<\/p>\n<p>Sensitive Data covers an extra layer of application-layer encryption on designated custom properties, restricted access for HubSpot employees, and automatic exclusion from HubSpot AI model training.<\/p>\n<ul>\n<li>Sensitive Data does not automatically redact free-text content in <code>hs_call_body<\/code>. A Super Admin must run a scan and manually confirm redaction of detected values in activities such as calls, and developers remain responsible for safe handling before the write.<\/li>\n<li>Recordings and transcripts stored outside HubSpot fall under the third party\u2019s own policies, as described in HubSpot\u2019s Sensitive Data documentation.<\/li>\n<li>Only custom properties can store Sensitive Data. Default properties cannot be converted into Sensitive Data properties.<\/li>\n<li>Activating Sensitive Data does not restrict OAuth scopes. Apps must explicitly add sensitive scopes such as <code>crm.objects.contacts.sensitive.read\/write<\/code> to access those values.<\/li>\n<\/ul>\n<p>Sensitive Data provides a valuable control layer for specific properties and must work alongside PII redaction, minimum scopes, and a separate encrypted store for recordings. On its own, it will not satisfy a compliance review for call logging.<\/p>\n<h2>Minimum OAuth Scopes For HubSpot Call Logging<\/h2>\n<p>A call-logging integration that creates call records and associates them with contacts and companies can run on a small, focused scope set.<\/p>\n<ul>\n<li><code>crm.objects.calls.read<\/code> to read existing call records for idempotency checks<\/li>\n<li><code>crm.objects.calls.write<\/code> to create and update call records<\/li>\n<li><code>crm.objects.contacts.read<\/code> to look up contact IDs for association<\/li>\n<li><code>crm.objects.contacts.write<\/code> to update contact activity timestamps when needed<\/li>\n<li><code>crm.objects.companies.read<\/code> to look up company IDs for association<\/li>\n<li><code>crm.associations.read<\/code> and <code>crm.associations.write<\/code> to manage call-to-contact and call-to-company associations<\/li>\n<\/ul>\n<p>For a <strong>private app<\/strong>, configure scopes under Settings \u2192 Integrations \u2192 Private Apps on the Scopes tab. HubSpot\u2019s private app documentation confirms that unused scopes can be removed after configuration, which supports a minimum-privilege pattern. Rotate the access token every six months. HubSpot\u2019s \u201cRotate and expire later\u201d option expires the old token after seven days.<\/p>\n<p>For a <strong>public OAuth app<\/strong>, declare only the scopes above in the authorize URL. <a href=\"https:\/\/appnigma.ai\/blogs\/hubspot-oauth-scopes-guide\" target=\"_blank\" rel=\"noindex nofollow\">HubSpot\u2019s May 2026 certification review<\/a> enforces an active-use rule that requires at least one API call per declared scope within the trailing 30 days. Scopes that are declared but never called are flagged and must be justified or removed. Avoid speculative scopes that expand risk without delivering value.<\/p>\n<p>Least privilege matters because a compromised token with broad scopes can read or modify deals, tickets, and marketing contacts that sit far outside the call-logging use case. Scope minimization also appears in the HubSpot Developer Terms and in HubSpot Marketplace certification checks.<\/p>\n<h2>HubSpot Webhook Signature Verification For Call Events<\/h2>\n<p>Scopes control what your integration can do after authentication. Signature verification controls whether the events reaching your receiver are genuine in the first place, and many call-logging guides skip this step entirely.<\/p>\n<p>For telephony providers that sign their webhooks, your receiver should verify the signature before processing any payload. Twilio signs with HMAC-SHA1, and Aircall provides a per-account token. The pattern below follows Twilio\u2019s documented algorithm, since <a href=\"https:\/\/twilio.com\/docs\/usage\/security\" target=\"_blank\" rel=\"noindex nofollow\">Twilio\u2019s security documentation<\/a> offers the most detailed vendor standard among major providers.<\/p>\n<pre><code>import hmac, hashlib, time def verify_twilio_signature(auth_token, signature, url, post_params): # 1. Build the signed string: URL + sorted POST params concatenated s = url for key in sorted(post_params.keys()): s += key + post_params[key] # 2. Compute HMAC-SHA1 using AuthToken as key mac = hmac.new(auth_token.encode(\"utf-8\"), s.encode(\"utf-8\"), hashlib.sha1) computed = base64.b64encode(mac.digest()).decode(\"utf-8\") # 3. Compare in constant time to prevent timing attacks return hmac.compare_digest(computed, signature) def reject_replay(event_timestamp_seconds, tolerance_seconds=300): # 4. Reject events older than tolerance window return (time.time() - event_timestamp_seconds) &gt; tolerance_seconds<\/code><\/pre>\n<p>Enforce TLS 1.2 or higher on the receiver endpoint. <a href=\"https:\/\/twilio.com\/docs\/usage\/security\" target=\"_blank\" rel=\"noindex nofollow\">Twilio will not connect to HTTPS webhooks that use self-signed certificates<\/a>. Store recordings at rest with AES-256 encryption to align with common security expectations.<\/p>\n<p><strong>Idempotency:<\/strong> Telephony providers deliver webhooks at least once and often more. Aircall fires multiple events per call, including <code>call.created<\/code>, <code>call.answered<\/code>, and <code>call.ended<\/code>, and <a href=\"https:\/\/developer.aircall.io\/docs\/work-with-call-data\" target=\"_blank\" rel=\"noindex nofollow\">Aircall\u2019s documentation<\/a> requires upsert logic keyed on <code>call.id<\/code> to avoid duplicates. Before calling <code>POST \/crm\/objects\/2026-03\/calls<\/code>, query HubSpot for an existing call record that matches your <code>hs_call_external_id<\/code>. If a match exists, issue a <code>PATCH<\/code> instead of a <code>POST<\/code>. This pattern prevents duplicate HubSpot call records from repeated webhook deliveries.<\/p>\n<h2>How To Redact PII From HubSpot Call Notes Before Logging<\/h2>\n<p>The <code>hs_call_body<\/code> field stores free text, and everything written there lives in HubSpot and falls under data subject access requests. <a href=\"https:\/\/thoughtly.com\/blog\/pii-handling-data-retention-ai-call-workflows\" target=\"_blank\" rel=\"noindex nofollow\">Regulators expect organizations to know what data they collect, where it lives, and who can access it<\/a>. A full transcript pasted into <code>hs_call_body<\/code> breaks that expectation immediately.<\/p>\n<p><strong>Before redaction (unsafe to write to HubSpot):<\/strong><\/p>\n<pre><code>Rep confirmed account for Jane Smith, DOB 04\/12\/1981, SSN 123-45-6789. Card ending 4242 charged $350. Email: jane.smith@personal.com.<\/code><\/pre>\n<p><strong>After redaction (safe to write to <code>hs_call_body<\/code>):<\/strong><\/p>\n<pre><code>Rep confirmed account for [NAME]. DOB [REDACTED]. SSN [REDACTED]. Card ending [REDACTED] charged $350. Email [REDACTED]. Full transcript: encrypted-store:\/\/transcripts\/ext_call_id_abc123<\/code><\/pre>\n<p>Strip at minimum full card numbers and CVVs, since <a href=\"https:\/\/getlimina.ai\/en\/blog\/pii-redaction-call-transcripts-audio\" target=\"_blank\" rel=\"noindex nofollow\">PCI DSS Requirement 3.3 forbids retaining sensitive authentication data after authorization<\/a>. Also remove Social Security numbers, dates of birth, health information, and personal email addresses. Use a purpose-built NER model instead of regex alone. <a href=\"https:\/\/getlimina.ai\/en\/blog\/pii-redaction-call-transcripts-audio\" target=\"_blank\" rel=\"noindex nofollow\">General-purpose NLP tools reach only 60\u201370% recall on real call transcripts<\/a>, so a significant share of PII can slip through.<\/p>\n<p>Your redaction layer can pass every HubSpot write and still leak PII into application logs, so assert that its output, not just the CRM write, contains no raw SSN, card, or health-data patterns. Real calls include interrupted digit strings, corrections, and background noise that clean fixtures never show, so run these assertions against realistic recordings. Re-run them after any model or configuration change, because a redaction regression often appears only at the next audit.<\/p>\n<h2>How To Honor GDPR Erasure Requests For HubSpot Call Activity<\/h2>\n<p>The erasure workflow depends on the <code>external_call_id<\/code> and HubSpot call ID mapping you created at write time. That mapping lets you coordinate deletion across HubSpot and your encrypted stores.<\/p>\n<ol>\n<li>Look up all <code>external_call_id<\/code> values associated with the data subject in your mapping table.<\/li>\n<li>For each mapping, call HubSpot\u2019s GDPR delete endpoint with the HubSpot call ID to remove the call record and its engagement history.<\/li>\n<li>Delete the corresponding recording from the encrypted store using the <code>external_call_id<\/code> as the key.<\/li>\n<li>Delete the corresponding transcript from the encrypted store.<\/li>\n<li>Log the deletion event with a timestamp and operator ID for audit purposes.<\/li>\n<\/ol>\n<p>HubSpot\u2019s DPA, Section 3.6, requires deletion of Customer Data on termination or expiration and notes that archived data on backup systems must be isolated and deleted according to HubSpot\u2019s practices. Your own erasure job should mirror that standard across active records and backups.<\/p>\n<p>For <strong>CCPA<\/strong>, <a href=\"https:\/\/withallo.com\/blog\/call-recording-compliance\" target=\"_blank\" rel=\"noindex nofollow\">one source cites a 45-day response window<\/a>, while others cite 30 days, so your policy should state a clear internal target. For <strong>HIPAA<\/strong>, <a href=\"https:\/\/withallo.com\/blog\/call-recording-compliance\" target=\"_blank\" rel=\"noindex nofollow\">records involving patient information require at least six years of retention<\/a>, so you must weigh erasure requests against that floor. For <strong>GDPR<\/strong>, <a href=\"https:\/\/sipsymposium.com\/guides\/gdpr-voip-call-recording\" target=\"_blank\" rel=\"noindex nofollow\">no universal retention period exists<\/a>. Retention must match the documented purpose, which often ranges from six months for QA to seven years for disputes or regulated financial services.<\/p>\n<p>Run retention jobs as scheduled tasks that compare each call record\u2019s creation timestamp against its purpose-specific window. When the window closes, delete the record across HubSpot, the encrypted recording store, and the transcript store in a single coordinated step.<\/p>\n<h2>Aircall, RingCentral, Twilio, And Zoom Compared For Call Logging Compliance<\/h2>\n<p>The table below compares four major telephony providers on capabilities that shape a compliant HubSpot call logging design. Twilio offers the most auditable webhook signing and flexible recording storage, while Aircall\u2019s short-lived signed URLs push you to download recordings into your own encrypted store quickly. All data points are sourced inline.<\/p>\n<table>\n<thead>\n<tr>\n<th>Provider<\/th>\n<th>Encrypted Recording Storage<\/th>\n<th>Webhook Signing<\/th>\n<th>Transcript Handling<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Aircall<\/td>\n<td><a href=\"https:\/\/justcall.io\/blog\/aircall-review.html\" target=\"_blank\" rel=\"noindex nofollow\">Secondary review sources report TLS 1.2 in transit and AES-256 at rest<\/a>. Recordings live in AWS regions such as Oregon, Frankfurt, or Sydney based on account country code. Signed URLs expire within 1\u20133 hours, so your pipeline must download recordings to your encrypted store promptly.<\/td>\n<td><a href=\"https:\/\/developer.aircall.io\/docs\/work-with-call-data\" target=\"_blank\" rel=\"noindex nofollow\">Per-account webhook token<\/a> returned at webhook creation. Store this token and use it to verify inbound events.<\/td>\n<td><a href=\"https:\/\/justcall.io\/blog\/aircall-review.html\" target=\"_blank\" rel=\"noindex nofollow\">Transcripts currently store on US servers<\/a>, with EU storage in progress at the source date. A secondary review source notes transcript redaction for PCI, PII, and PHI since March 2026. Aircall recommends subscribing to <code>call.ended<\/code> plus <code>call.comm_assets<\/code> and accessing transcripts through <a href=\"https:\/\/developer.aircall.io\/docs\/calls\" target=\"_blank\" rel=\"noindex nofollow\">the Conversation Intelligence API<\/a>.<\/td>\n<\/tr>\n<tr>\n<td>RingCentral<\/td>\n<td><a href=\"https:\/\/ringcentral.com\/call-center-compliance.html\" target=\"_blank\" rel=\"noindex nofollow\">Encryption in transit and at rest<\/a> with role-based access controls and configurable retention schedules. <a href=\"https:\/\/ringcentral.com\/call-center-compliance.html\" target=\"_blank\" rel=\"noindex nofollow\">RingCentral\u2019s compliance guidance<\/a> highlights SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS certifications as vendor baselines.<\/td>\n<td>Webhook signing was not clearly documented in the reviewed sources. Confirm current signing behavior in RingCentral\u2019s developer documentation before you design your receiver.<\/td>\n<td><a href=\"https:\/\/ringcentral.com\/us\/en\/blog\/financial-services-call-center\" target=\"_blank\" rel=\"noindex nofollow\">Conversation intelligence features<\/a> include transcript search and redaction options, with configurable retention policies across regions.<\/td>\n<\/tr>\n<tr>\n<td>Twilio<\/td>\n<td><a href=\"https:\/\/twilio.com\/docs\/voice\/api\/recording\" target=\"_blank\" rel=\"noindex nofollow\">Recordings are encrypted at rest<\/a> and can route to customer-managed storage such as Amazon S3. <a href=\"https:\/\/twilio.com\/docs\/voice\/api\/recording\" target=\"_blank\" rel=\"noindex nofollow\">HIPAA workflows with Recordings require at least HTTP Authentication<\/a>. PCI Mode is available but disables native transcription.<\/td>\n<td><a href=\"https:\/\/twilio.com\/docs\/usage\/security\" target=\"_blank\" rel=\"noindex nofollow\">HMAC-SHA1 signatures on every webhook<\/a> appear in the <code>X-Twilio-Signature<\/code> header. Twilio documents this standard in detail, and official SDKs include built-in validation helpers.<\/td>\n<td><a href=\"https:\/\/twilio.com\/docs\/voice\/api\/recording\" target=\"_blank\" rel=\"noindex nofollow\">Transcriptions exist as a subresource<\/a> at <code>GET ...\/Recordings\/{RecordingSid}\/Transcriptions<\/code>. Native transcription is unavailable when PCI Mode is enabled.<\/td>\n<\/tr>\n<tr>\n<td>Zoom<\/td>\n<td>As of August 31, 2026, HubSpot makes meeting recording URLs private and requires authentication to access them. HubSpot instructs integrations to join the Conversation Recap Public API beta and use HubSpot\u2019s API to retrieve secure, signed URLs.<\/td>\n<td>Zoom documents webhook signing on its developer platform. Confirm the current algorithm and header name in Zoom\u2019s documentation before you implement verification.<\/td>\n<td>Zoom can send completed transcripts directly to HubSpot even when HubSpot transcription is off. These transcripts appear on the meeting record, not the call object, as of August 31, 2026.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Twilio provides the clearest webhook signing standard and flexible recording storage, which simplifies audits. Aircall\u2019s short-lived signed URLs align with a secure architecture but demand a reliable download-on-webhook pipeline. RingCentral and Zoom can fit into a compliant design once you confirm their current signing behavior and retention options.<\/p>\n<h2>Why Coffee Is The Best Fit For Secure HubSpot Call Activity Logging<\/h2>\n<p>The architecture in this article requires ongoing engineering effort. Webhook receivers, redaction pipelines, idempotency logic, erasure jobs, and scope audits all need maintenance that most RevOps teams cannot absorb alongside core responsibilities.<\/p>\n<p>Coffee\u2019s Companion App for HubSpot deploys an intelligent agent on top of your existing HubSpot instance and handles the \u201cdata in\u201d process without manual effort. Coffee\u2019s agent auto-creates and enriches contacts, companies, and activities. It also logs last and next activity on its own, then unifies structured and unstructured data such as emails and call transcripts into one coherent view.<\/p>\n<p>Reps save 8\u201312 hours per week on data entry, and the CRM stays audit-ready without extra admin work. On the compliance side, Coffee is SOC 2 Type 2 and GDPR compliant, does not use customer data to train public models, and enforces minimum OAuth scopes.<\/p>\n<p>Coffee keeps recordings and transcripts in a separate encrypted store while writing only metadata and redacted notes to HubSpot, which matches the architecture described above. The <code>external_call_id<\/code> to HubSpot call ID mapping is maintained automatically so erasure requests can be honored across both systems in one coordinated job.<\/p>\n<p><a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\"><strong>See Coffee\u2019s compliant call logging in action<\/strong><\/a><\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>How Does HubSpot Treat Recorded Calls Versus Meetings?<\/h3>\n<p>HubSpot stores call metadata and free-text notes on the call object and uses the meeting object for recorded video sessions. As noted above, the August 31, 2026 change means recorded meetings now create only meeting records, while call records come from HubSpot\u2019s calling feature. For compliant setups, keep recordings and transcripts in a separate encrypted store and send only metadata and redacted notes into HubSpot.<\/p>\n<h3>How Can I Automate Call Logging In HubSpot Without Manual Entry?<\/h3>\n<p>Use the HubSpot Calls API endpoint <code>POST \/crm\/objects\/2026-03\/calls<\/code> behind a webhook receiver. The receiver validates inbound signatures from your telephony provider, then applies PII redaction to any free-text content before writing it to <code>hs_call_body<\/code>. It checks for an existing call record that matches your <code>external_call_id<\/code> to enforce idempotency and writes only metadata to HubSpot while routing recordings and transcripts to a separate encrypted store. Store the returned HubSpot call ID alongside your <code>external_call_id<\/code> immediately after a successful response so you can run coordinated erasure workflows later.<\/p>\n<h3>Which OAuth Scopes Should My Call Logging Integration Request?<\/h3>\n<p>A focused call-logging integration typically needs <code>crm.objects.calls.read<\/code>, <code>crm.objects.calls.write<\/code>, <code>crm.objects.contacts.read<\/code>, <code>crm.objects.contacts.write<\/code>, <code>crm.objects.companies.read<\/code>, <code>crm.associations.read<\/code>, and <code>crm.associations.write<\/code>. Extra scopes increase the impact of a compromised token and can trigger flags under HubSpot\u2019s May 2026 certification review if they remain unused for 30 days.<\/p>\n<h3>How Should I Handle Call Activity Deletion For GDPR And CCPA?<\/h3>\n<p>Store <code>external_call_id<\/code> alongside the HubSpot call ID at write time. When a data subject request arrives, look up all related mappings, call HubSpot\u2019s GDPR delete endpoint for each HubSpot call ID, delete the matching recordings and transcripts from your encrypted stores, and log the operation. Align your response windows with CCPA, GDPR, and HIPAA retention rules as described earlier in this article.<\/p>\n<h3>How Secure Is Coffee\u2019s HubSpot Integration?<\/h3>\n<p>Coffee is SOC 2 Type 2 and GDPR compliant and does not use customer data to train public models. The integration enforces minimum OAuth scopes, keeps recordings and transcripts in a separate encrypted store, and writes only metadata and redacted notes to HubSpot. Coffee also maintains the external call ID to HubSpot call ID mapping automatically so coordinated erasure across systems becomes a standard workflow instead of a custom build.<\/p>\n<h2>Conclusion: Build It Right Or Let Coffee Build It For You<\/h2>\n<p>Automating HubSpot call logging safely under GDPR, HIPAA, and CCPA requires a defensible architecture. Metadata stays in HubSpot, and content lives in a separate encrypted store. Every write carries redacted PII, every inbound event is signature-verified, and every call record creation follows an idempotent pattern. The <code>external_call_id<\/code> maps to the HubSpot call ID so erasure requests can be honored across both systems in one coordinated job. HubSpot\u2019s legal documentation confirms that compliance sits with the customer, so this architecture becomes your responsibility.<\/p>\n<p>Coffee\u2019s Companion App for HubSpot gives teams this architecture without the engineering burden. The Coffee agent handles the \u201cdata in\u201d process autonomously. It auto-creates contacts, companies, and activities, logs call metadata with redacted notes, keeps recordings and transcripts in a separate encrypted store, and honors erasure requests. Your CRM stays audit-ready while your reps stay focused on selling.<\/p>\n<p><a href=\"https:\/\/www.coffee.ai\/pricing\" target=\"_blank\"><strong>Talk to Coffee about compliant HubSpot call logging<\/strong><\/a><\/p>\n<section data-read-next=\"true\">\n<h2>Read Next<\/h2>\n<ul>\n<li><a href=\"https:\/\/coffee.ai\/articles\/ease-of-implementation-ai-crm-for-sales\" target=\"_blank\">How to Easily Automate HubSpot Call Activity Logging<\/a><\/li>\n<li><a href=\"https:\/\/coffee.ai\/articles\/cost-of-automation-tools-ai-crm-for-sales\" target=\"_blank\">Cost to Automate HubSpot Call Activity Logging: 2026 Guide<\/a><\/li>\n<li><a href=\"https:\/\/coffee.ai\/articles\/integration-compatibility-with-call-platforms-ai-crm-for-sales\" target=\"_blank\">How to Integrate Call Platforms with HubSpot for AI Sales<\/a><\/li>\n<li><a href=\"https:\/\/coffee.ai\/articles\/data-security-and-compliance-ai-crm-for-sales\" target=\"_blank\">Data Security Compliance for Sales Meeting Platforms<\/a><\/li>\n<li><a href=\"https:\/\/coffee.ai\/articles\/data-security-and-privacy-ai-crm-for-sales\" target=\"_blank\">How to Secure AI Post-Call Summaries and Action Items<\/a><\/li>\n<\/ul>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Automate HubSpot call logging with a compliance-ready webhook architecture. Coffee keeps your data secure and audit-ready. Get started today.<\/p>\n","protected":false},"author":11,"featured_media":1447,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/comments?post=404"}],"version-history":[{"count":5,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/404\/revisions"}],"predecessor-version":[{"id":9015,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/posts\/404\/revisions\/9015"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/media\/1447"}],"wp:attachment":[{"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/media?parent=404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/categories?post=404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coffee.ai\/articles\/wp-json\/wp\/v2\/tags?post=404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}