HubSpot security log: token, export and user events to review

Why it matters

Tokens, exports and new users are how data leaves a portal. A token created by someone who has since left, or a large export nobody remembers, is exactly what an attacker or a careless process looks like.

Regular review also helps with security questionnaires and audits, because you can show that sensitive changes are checked rather than assumed.

How to find it in HubSpot

1. 1Open Settings and find the account security or audit log area. What you can see depends on your subscription.
2. 2Filter or scan for private app and token events, export events, integration events, and users added or removed.
3. 3For each event, note who acted, when, and what changed.
4. 4Compare the users involved with your current team list.

How to fix it safely

1. 1Review the events with the portal owner and record for each whether it was expected and who approved it.
2. 2For any event nobody can explain, rotate the affected private app token and review the user’s access straight away.
3. 3Remove access for anyone who has left, and reassign the integrations they owned.
4. 4Set a regular review of the security log, for example monthly, with a named owner.

How Ancil checks this

Rule

GOV-004

What it looks for

Reads the HubSpot account security activity Ancil can access, and flags events whose type mentions tokens, private apps, user additions or removals, integrations or exports.

Severity

Info.

Evidence shown

Event IDs, event types, acting user and time for up to 50 events.

Governed fix

Not automated. Ancil never changes users, tokens or permissions automatically. It reports the events, and your team or an INSIDEA expert reviews them.

Related checks