A super admin is a HubSpot user with full access to every tool and setting in the account, including user management, integrations, data exports and deletions. It is the highest level of access a user can hold in a portal.
Most HubSpot permissions are granular: a user can view, edit or delete specific objects, and access specific tools. Super admin access skips all of that. A super admin can add and remove users, change their permissions, connect or disconnect integrations, edit properties and pipelines, and export or delete records across the whole portal. In most accounts, only an existing super admin can grant the role to someone else.
Because the role covers everything, every extra super admin widens the risk. One compromised login, or one well-meaning person running a bulk delete, can affect the whole portal. Broad admin access also weakens your change history: when many people could have changed a setting, the audit trail answers fewer questions.
A common pattern is two super admins: enough that the account is never locked out if one person leaves, few enough that the list is easy to control. Everyone else, including agency staff and contractors, gets a permission set that matches their actual job. Require two-factor authentication for super admins and review the list at least quarterly.
When someone leaves the company, remove or downgrade their access the same day. A former employee who still holds super admin access is one of the most serious findings in any portal review.
A 40-person software company found that nine users were super admins, including two former agency contacts and a sales rep who had asked for access to build one report. The operations lead kept two super admins, moved the sales rep to a sales manager permission set, and removed the agency accounts.
Most portals do well with two. One is a single point of failure if that person is away or leaves. More than two or three is usually a sign that access was granted for convenience rather than need.
No. The role is defined by full access. If someone needs most admin rights but not all, give them a permission set with the specific settings and tools they need instead of super admin access.
Ancil connects to HubSpot read-only in about 60 seconds. Nothing changes in your portal without your approval.