Marketing Automation
HubSpot Marketing Hub
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 3 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by HubSpot, Inc. · www.hubspot.de
Compare with Evalanche → Compare with ActiveCampaign (Automation) → Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
HubSpot Marketing Hub scores best on consent, tracking & profiling and journeys & orchestration, where the evidence shows automation at volume — up to 300 workflows for 10 teams at Professional and up to 1,000 for 300 teams at Enterprise — plus behavioural-event triggers, unlimited automated actions from Professional, and consent tooling of up to 100 banners with GPC signal support. It is weakest on sovereignty: the vendor is HubSpot, Inc. of Cambridge, Massachusetts, every sovereignty attribute — jurisdiction, ownership, data residency, subprocessor exposure — is listed as unknown, affiliates act as subprocessors under a DPA annex whose contents the evidence does not show, and HubSpot is controller of tracking-code visitor data. CRM integration & data model rests on 'über 2.000' marketplace apps with no CRM sync mechanics documented. The judges genuinely split on pricing transparency: the Data Protection Officer credited unusually public tier boundaries and metered credit rates, while the Lifecycle Marketer scored near the floor because no currency figure, billing period or overage rate appears, leaving the annual invoice incomputable.
Speaks for it
- Automation scales by tier: up to 1,000 workflows for 300 teams at Enterprise with behavioural-event triggers and unlimited automated actions from Professional
- Consent capture is tooled: up to 100 banners with geotargeting and GPC signal support
- Subject-rights handling is documented: access, deletion, objection, correction, portability, restriction and withdrawal
- Custom events are code-free and bounded: 500 definitions, 30 million completions per month
- Limits are disclosed in unusual detail: send volumes at 5x/10x/20x of the marketing-contact tier and credit rates such as 50 per resolved conversation
Held against it
- Every sovereignty attribute — jurisdiction, ownership, data residency, subprocessor exposure — is listed as unknown under vendor HubSpot, Inc. of Cambridge, Massachusetts (0 of 10)
- HubSpot is controller of tracking-code visitor data, and affiliates act as subprocessors under a DPA annex whose contents the evidence does not show
- No CRM sync mechanics are documented — no named CRM, field mapping, deduplication or conflict resolution, only 'über 2.000' marketplace apps
- 'Omni-Channel-Marketingautomatisierung' is asserted without naming a second channel: no SMS, push or ad audiences are evidenced
- No currency price, overage rate, onboarding fee or VAT treatment appears anywhere, so a real annual invoice is not computable
Best for
- You need high-volume behavioural workflows — 300 at Professional, 1,000 at Enterprise — and can operate without documented collision handling
- Your programme is email-led and you need EU-facing consent capture — up to 100 banners with geotargeting and GPC signal support are confirmed
- You accept a US contracting vendor and its affiliate subprocessor chain, and sovereignty is not a procurement gate
- You want tier boundaries and limits visible before sales contact, even though no currency figure appears
Avoid if
- You require EU data residency or a published subprocessor chain — the evidence lists every sovereignty attribute as unknown
- Your implementation turns on CRM join mechanics — ask the vendor: the public pages we read do not show it
- You must compute a total annual cost before committing — ask the vendor: the public pages we read do not show it
- You need explainable lead scores or journey collision control — ask the vendor: the public pages we read do not show it
The scores
Journeys & orchestration
Show reasoningHide reasoning
How this is scored
Multi-step automation: triggers, branching, waits, and — the part that decides whether it survives contact with reality — what happens when journeys collide.
0 — Autoresponders on a single trigger; no branching, no waits, no conditions.
3 — Linear sequences with simple conditions, one entry trigger per journey, and no visibility into where a contact currently sits.
5 — A visual builder with branching on attributes and behaviour, waits and goals, entry and exit conditions, and per-contact journey state visible.
8 — Event-driven entry from external systems, frequency capping and suppression across journeys, priority when a contact qualifies for several, versioning of a live journey, and testing against real records.
10 — Orchestration is coherent across the whole programme: one decision layer deciding what a person receives next regardless of which journey wants to send it, holdout groups for measurement, and a journey a colleague can read months later without a diagram.
The Demand Gen Lead
The evidence proves workflows at volume (300 at Professional, 1,000 at Enterprise) driven by behavioural events with unlimited actions at Pro+, plus code-free custom events — beyond bare autoresponders. But nothing on branching, waits, per-contact journey state, and worst for me, silence on what happens when journeys collide: no frequency capping, suppression, priority or versioning anywhere. 2
The Sales Ops Manager
Unlimited workflow actions from Professional up, with behavioural events usable as triggers and journey analytics up to 15 phases, so this is a real engine — but nothing evidences branching, waits, entry/exit conditions or per-contact journey state, and the collision handling that stops two workflows double-mailing one lead (frequency capping, cross-journey suppression, priority) is completely absent from the evidence. 2
The Data Protection Officer
Workflows with behavioural event triggers and unlimited automated actions exist from Professional upward (up to 300/1,000 workflows per account), plus journey analytics over 15 phases — that clears the single-trigger autoresponder floor. But the evidence is silent on branching, waits, goals, entry/exit conditions, and entirely silent on collision handling: no frequency capping, no suppression across journeys, no priority, no versioning, no per-contact journey state. 2
The Lifecycle Marketer
The tier table evidences genuine multi-step automation — up to 300/1,000 workflows driven by behavioural events, unlimited actions from Professional — but the evidence is silent on everything that makes journeys survive contact with each other: no frequency capping, no cross-journey suppression, no priority when a contact qualifies for several, no versioning, no holdout groups. Branching, waits and per-contact journey state aren't evidenced either, so this lands between the linear and visual-builder anchors. 2
The Solution Architect
Up to 300–1,000 workflows with behavioural event triggers, unlimited automated actions and journey analytics over 15 phases puts this past a linear sequencer, and 10,000 logged interactions per contact gives some visibility into where a person sits. But the evidence is silent on the part that kills implementations: what happens when journeys collide — no frequency capping, no cross-journey suppression, no priority arbitration, no versioning of a live journey. 2
The Skeptic
The staircase is at least honest: Starter caps at 10 automated actions, 'unlimited' starts at Professional, and 'unlimited' workflows turn out to be 300 there and 1,000 at Enterprise, with behavioural-event triggers. But nothing evidences branching, waits, goals, per-contact journey state, or what happens when two workflows want the same person — every collision question is unanswered, so this never reaches the visual-builder anchor. 2
Lead scoring, routing & lifecycle
Show reasoningHide reasoning
How this is scored
Scoring, qualification and handover to sales — including whether the customer can explain to a lead why the system decided what it decided.
0 — No scoring or lifecycle model; every contact is treated alike.
3 — A single additive score with fixed rules, no decay, no lifecycle stages and no routing.
5 — Configurable scoring on attributes and behaviour with decay, lifecycle stages, and routing to owners or teams with notification.
8 — Multiple scoring models per product or region, negative scoring, account-level scoring alongside contact-level, SLA on follow-up, and score history visible per contact.
10 — Scoring is explainable and accountable: the contribution of each signal visible per record, model changes versioned with their effect on the funnel, routing rules auditable, and predictive scoring — where offered — documented well enough for a DPO to assess it as automated decision-making.
The Demand Gen Lead
One mention of 'automatisches Leadscoring' bundled with workflows — that is the entire scoring story: no lifecycle stages, no decay, no routing, no negative or account-level scoring, no score history, nothing explainable to sales. The vendor's own enrichment from a commercial dataset makes scores even harder to account for, and multi-touch attribution's 10,000 logged interactions is interaction logging, not score transparency. 2 3
The Sales Ops Manager
'Automatisches Leadscoring' is named for Professional/Enterprise workflows and attribution logs up to 10,000 interactions per contact — that is the entire evidentiary basis. No lifecycle stages, no routing to owners or teams, no decay, no negative or account-level scoring, no score history, and nothing that would let me explain a score to a lead or a DPO. 2
The Data Protection Officer
Automatic lead scoring is confirmed at Professional+ driven by behavioural events, with up to 10,000 logged interactions per contact at Enterprise — but nothing on configurable rules, decay, lifecycle stages, routing or score history. From my chair the decisive absence is explainability: the evidence offers nothing on how a score is computed, so nothing here could be assessed under Art. 22, let alone contested by the individual it scores. 2
The Lifecycle Marketer
'Automatisches Leadscoring' appears once as a Professional/Enterprise workflow capability and that is the entire scoring story — no decay, no lifecycle stages, no routing, no score history, nothing a rep could explain to a lead. For a vendor that also runs a commercial enrichment dataset, the total absence of documented score lineage is the gap that worries me most. 2 3
The Solution Architect
The only scoring evidence is 'automatisches Leadscoring' bundled into Pro/Enterprise workflows; there is nothing on decay, lifecycle stages, routing to owners, multiple models, negative scoring or per-contact score history. A score exists, so not 0, but the evidence will not carry it past the fixed-score anchor. 2
The Skeptic
Automatic lead scoring fed by behavioural events is confirmed, but only as a clause inside the Enterprise workflow limit — scoring begins where the invoice is largest. No lifecycle stages, no routing, no decay, no score history, no explainability: the handover half of the criterion is entirely unevidenced. 2
Channels & personalisation
Show reasoningHide reasoning
How this is scored
What the platform can actually send and personalise: email, SMS, push, on-site content, ads audiences — judged on what shares one profile and one suppression list.
0 — Email only.
3 — Email plus one further channel, managed separately with its own list and no shared suppression.
5 — Email, SMS or push and web forms driven from one contact profile, with dynamic content blocks and shared unsubscribe handling.
8 — The above plus on-site personalisation, ad-audience sync to the major networks, cross-channel frequency capping, and content personalised on behaviour rather than only on stored fields.
10 — Channel is a delivery detail: one profile and one consent state across every channel, next-best-channel selection, and personalisation that draws on the full behavioural record without the marketer assembling it by hand.
The Demand Gen Lead
Email is evidenced with tiered send limits, 'Omni-Channel-Marketingautomatisierung' is asserted by label at Pro+, and web presence shows up via custom events and consent banners — but no channel is actually enumerated: no SMS, no push, no ad audiences, no dynamic content, no shared suppression. A marketing label is not a channel list; I can't plan a cross-channel programme on it. 2
The Sales Ops Manager
Email is documented down to per-tier send limits (5x/10x/20x of contact level), custom event tracking (500 definitions, 30M completions/month) and a credit-metered Customer Agent exist, and 'Omni-Channel-Marketingautomatisierung' is claimed at Professional+ — but no second channel is ever named, and SMS, push, on-site content, ad audiences, dynamic content and shared suppression are all silent. 2
The Data Protection Officer
Email send limits per tier are explicit and 'omni-channel marketing automation' is asserted at Professional+, but the evidence never names a second channel — no SMS, no push, no on-site personalisation, no ad sync. Crucially there is no evidence that channels share one profile and one consent state; what I see is a tracking code under which HubSpot itself acts as controller of visitor data, which is not a unified customer-controlled profile. 2 3
The Lifecycle Marketer
Email is fully evidenced with tier-based send limits, and 'Omni-Channel-Marketingautomatisierung' plus 30M custom-event completions/month imply behavioural data feeding automation — but no second channel is ever named, let alone a shared profile, shared suppression or cross-channel frequency capping. SMS, push, on-site personalisation and ad audiences are all unevidenced. 2
The Solution Architect
Email limits are concrete — sends as a multiple of the marketing-contact tier — and custom events plus the HubSpot tracking code feed behavioural data into the per-contact record, which is more than email-only. But 'Omni-Channel-Marketingautomatisierung' is asserted without naming a single second channel: no SMS, no push, no ad audiences, no evidence of shared suppression, so I cannot credit a 5 on an unnamed channel. 2 3
The Skeptic
Email is documented down to the send (2,000 free with branding; 5x/10x/20x the contact tier) and on-site behaviour is covered via the tracking code and 500 custom event definitions. But 'Omni-Channel-Marketingautomatisierung' is a label, not a channel list: no SMS, no push, no ad-audience sync, and no evidence of one profile or one suppression list shared across channels. 2 3
Consent, tracking & profiling
Show reasoningHide reasoning
How this is scored
The platform builds behavioural profiles of named people. Consent capture and proof, tracking that can be limited, retention, and whether automated decisions about individuals are documented and contestable.
0 — Tracking always on and undocumented, single opt-in, no consent record, no retention rule, no way to exclude a person from profiling.
3 — Double opt-in available with a timestamp, cookie tracking that cannot be disabled per contact, and retention described as the customer's problem.
5 — Double opt-in as documented default with a stored consent record including source, per-channel consent states, tracking switchable per contact, and stated retention for inactive records.
8 — Consent reproducible as evidence with the wording versioned, profiling suppressible per person, retention executed per data category, documented handling of access and erasure requests including derived scores, and a cookieless or first-party tracking mode.
10 — Built for the accountability principle: a per-contact history of what was tracked, scored and decided, automated decision-making documented well enough to support an Art. 22 assessment, profiling off by default for anyone who has not consented to it, and deletion that removes derived scores as well as raw events.
The Demand Gen Lead
Rights handling is documented (access, deletion, objection, restriction, withdrawal) with delete-or-anonymize retention, consent banners support GPC, and there is an opt-out form for the commercial enrichment dataset. But the anchor-5 essentials are missing: no per-contact tracking switch, no per-channel consent states, no stored consent record with source, no fixed retention — and HubSpot is controller of tracking-code visitor data, which means the vendor itself profiles your visitors. 3 2
The Sales Ops Manager
Consent capture is genuinely tooled — 100 banners with geotargeting and GPC signal support — and the full rights set (access, deletion, objection, correction, portability, restriction, withdrawal) is documented. But retention is purely purpose-bound ('no ongoing legitimate business need') with no fixed period for inactive records, no per-channel consent states or per-contact tracking switch are evidenced, and HubSpot declares itself controller of tracking-code visitor data, which leaves the profiling accountability genuinely murky. 2 3
The Data Protection Officer
There is real consent capture tooling — up to 100 banners with geotargeting and GPC support — and a full subject-rights list including objection and consent withdrawal, plus a delete-or-anonymise retention statement. But retention has no fixed period and no per-data-category execution, there is no evidence of a stored consent record with source or wording version, no per-contact switch for tracking or profiling, and nothing on deletion of derived scores; I also note HubSpot positions itself as controller of data collected via the tracking code, which weakens the customer's accountability position. 2 3
The Lifecycle Marketer
Consent banner tooling with GPC support exists and the policy documents the full rights catalogue, but retention is only 'no ongoing legitimate business need' with no stated period, and there's no evidence of per-contact tracking switches, stored consent records with source, or erasure that removes derived scores. Worse for my taste: HubSpot itself is controller of the visitor data its tracking code collects — the vendor profiles your visitors under its own controllership. 2 3
The Solution Architect
The rights catalogue is complete (access, deletion, objection, correction, portability, restriction, withdrawal) and consent banners with GPC support and geotargeting exist. But retention is a vague need-based delete-or-anonymize with no fixed period or per-category rule, and the evidence says nothing about stored consent records with source, per-channel consent states, per-contact tracking suppression, or deletion of derived scores — including whatever the AI credit-burning agents decide. 2 3
The Skeptic
Consent banners with GPC support and geotargeting are real capture tooling, and access/deletion/objection rights plus a stated retention policy are documented — though retention has no fixed period and no per-category rules. Missing: per-contact profiling suppression, per-channel consent states, stored consent records with source, and any Art. 22-grade documentation — and note the vendor itself profiles people through a commercial enrichment dataset, with an opt-out form as the only brake. 2 3
CRM integration & data model
Show reasoningHide reasoning
How this is scored
The join that decides the implementation: how the platform and the CRM stay in agreement about who a person is, and what happens when they disagree.
0 — CSV import and export; no CRM integration and no identity resolution.
3 — One-way sync into a named CRM on a schedule, with duplicates resolved by hand and no conflict rules.
5 — Bidirectional sync with at least one major CRM, field mapping, deduplication rules, and a sync error log somebody can act on.
8 — Configurable conflict resolution per field, account and contact objects both modelled, custom objects supported, near-real-time sync with retry, and a documented API with rate limits.
10 — One record, two systems, no ambiguity: identity resolution across anonymous and known states, field-level ownership defined per system, replay of failed syncs, and a data model the customer can extend without vendor services.
The Demand Gen Lead
The only data-integration evidence is 'über 2.000' marketplace apps — breadth with no mechanics: no bidirectional CRM sync, no field mapping, no conflict rules, no sync error log, no identity resolution. The evidence never even says this sits on HubSpot's own CRM, so as far as I'm allowed to know, the join that decides the implementation is undocumented. 2
The Sales Ops Manager
This is the join that decides my implementation and the evidence offers exactly one fact: 'über 2.000' marketplace apps. No named CRM, no sync direction, no field mapping, no deduplication rules, no conflict resolution per field, no sync error log, no documented API — a big marketplace proves connectors exist; it says nothing about who owns a field when two systems disagree or how I replay a failed sync before the pipeline report is wrong. 2
The Data Protection Officer
A 2,000-app marketplace evidences that integrations exist, and custom-event ingestion and a data agent writing 'smart properties' show the model is extensible in some fashion. But the evidence says nothing about sync mechanics: no bidirectional sync, no field mapping, no deduplication rules, no conflict resolution, no identity resolution between anonymous and known states — the join that decides who a person is is simply undocumented here. 2
The Lifecycle Marketer
The only data-model evidence in the entire sheet is 'über 2.000' marketplace apps — not one named CRM sync, no direction, no field mapping, no deduplication rules, no conflict resolution, no API documentation, no identity resolution. The join that decides the implementation is completely undocumented here, so I can't score past the lowest anchors. 2
The Solution Architect
This is the join that decides the implementation and the evidence describes none of it: no CRM sync — not even one-way into a named CRM — and nothing on field mapping, conflict resolution, custom objects, identity resolution or an API with documented rate limits. Code-free custom events (500 definitions, 30M completions/month) show a customer-extensible surface without vendor services, which is the only reason this is not a 0. 2
The Skeptic
A 2,000-app marketplace and 500 custom event definitions evidence connectivity and an extensible event model, but the evidence never names a CRM sync, field mapping, dedup rules, conflict resolution, or a documented API with rate limits. The join that decides the implementation is entirely unevidenced. 2 3
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where behavioural profiles of named EU residents are processed, who the contracting entity is, and which subprocessors see them. Independently sourced by the sovereignty pipeline; scored here as this buyer weighs it — which given the profiling is heavily.
0 — Non-EU vendor and contracting entity, hosting unstated or non-EU, subprocessors unnamed, behavioural data leaving the EU with no stated basis.
3 — EU data residency for storage while tracking, sending or support access remain non-EU, or the contracting entity sits outside the EU.
5 — EU hosting as standard and an EU contracting entity, but parts of the chain — tracking scripts, AI scoring, analytics — are non-EU without an explained safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, complete subprocessor list published, and any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: every profile, event and derived score processed in the EU by European subprocessors, certification published, and no transfer requiring a Schrems II argument to survive.
The Demand Gen Lead
Provenance is HubSpot, Inc., Cambridge, Massachusetts; data residency is unstated, and the subprocessor list lives in a DPA annex with US affiliates as subprocessors — that is a non-EU vendor with behavioural profiles of EU residents and no evidenced safeguard. A Berlin support line and an Annex-3 pointer don't change who processes or where; for a platform that is itself controller of tracked visitors, that's disqualifying in my book. 3 2
The Sales Ops Manager
The vendor is HubSpot, Inc. of Cambridge, Massachusetts, the sovereignty pipeline found jurisdiction, residency and subprocessor exposure all unknown (0 of 10), and behavioural profiles of EU website visitors run through a tracking code where HubSpot is the controller. A German support number and an Annex-3 affiliate subprocessor list do not offset that; there is no EU hosting, no published subprocessor chain and no transfer basis anywhere in this evidence. 2 3
The Data Protection Officer
The vendor is HubSpot, Inc. of Cambridge, Massachusetts, provenance rest-of-world, and every sovereignty attribute — residency, contracting entity, subprocessors — is unknown; the privacy policy confirms transfers to HubSpot affiliates acting as subprocessors under a DPA annex we cannot see. Behavioural profiles of named EU residents processed by a US controller with unnamed infrastructure and no stated safeguard in evidence: this is close to the floor, softened only marginally by the existence of a processing agreement. 3
The Lifecycle Marketer
Contracting vendor is HubSpot, Inc. of Cambridge, MA with every sovereignty attribute unknown; the policy only confirms data moves to unnamed HubSpot Affiliates acting as subprocessors wherever HubSpot has operations. Behavioural profiles of named EU residents with no stated EU residency, no published subprocessor list in evidence and no legal basis for transfers is an exact match for the 0 anchor — and given the profiling, I weigh it heavily. 3
The Solution Architect
HubSpot, Inc. is a US vendor, the tracking code makes HubSpot itself controller of visitor behavioural data, affiliates act as subprocessors with the list buried in a DPA annex, and no hosting location or EU contracting entity is stated anywhere. That is rubric level 0 almost verbatim — a Berlin phone number and a.de domain change nothing about where named EU residents' profiles are processed. 3
The Skeptic
The contracting entity is HubSpot, Inc. of Cambridge, Massachusetts, and every sovereignty attribute — jurisdiction, residency, subprocessor exposure — is unknown; the only EU signals are a German sales line and a.de domain, which is window dressing. Affiliates process as subprocessors under a DPA annex the evidence never shows, and behavioural profiles of EU residents leave with no stated EU basis or safeguard. 2 3
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual invoice for their contact base and send volume — including the tier where automation actually begins, overage, and mandatory onboarding — from public pages alone.
0 — No public prices at all; every tier is a sales conversation, and onboarding fees are never mentioned.
3 — A contact-tier headline exists, but the tier where journeys, scoring or CRM sync begin is unstated, as is any mandatory implementation fee.
5 — Contact-tier prices public with billing period and send limits stated, but at least one commonly needed capability sits in an unpriced enterprise tier.
8 — Every tier priced publicly with contact and volume limits, feature boundaries, overage rates, onboarding costs, minimum term and VAT treatment stated.
10 — Complete price computability: annual invoice derivable for a given contact count, send volume and feature set, including overage, additional users and any implementation fee stated outright.
The Demand Gen Lead
Credit where due: the tier where real automation begins is explicit (Starter caps at 10 actions, unlimited plus omni-channel from Professional; 300 vs 1,000 workflows), and limits are unusually detailed — send volumes, campaigns, events, dashboards. But no currency prices, no billing period, no overage rates, no onboarding fee, no VAT treatment appear, and the agent credit system (50 credits per resolved conversation, 10 per smart property) adds a metered cost I cannot compute from this sheet. 2
The Sales Ops Manager
The tier where automation actually begins is unambiguous — 10 automated actions at Starter, unlimited plus omni-channel from Professional — and send volume is stated as a multiple of the contact tier with AI usage metered in published credits per resolved conversation, which is better boundary disclosure than most. But no monetary price, onboarding fee, VAT treatment or minimum term appears anywhere in the evidence, so I still cannot compute the annual invoice. 1 2
The Data Protection Officer
The public pricing page states tier boundaries where automation actually begins (1 action free, 10 Starter, unlimited plus omni-channel from Professional), send limits relative to contact tier, workflow and dashboard caps, and even metered credit rates for the AI agents — better than a bare headline. But no currency amounts are quoted in evidence, and overage rates, mandatory onboarding, minimum term and VAT treatment are all absent, so a real annual invoice is not computable from these pages. 1 2
The Lifecycle Marketer
The pricing page discloses tier boundaries, workflow limits and even AI credit burn rates, but not a single currency figure, billing period, overage rate, mandatory onboarding cost or VAT treatment — the annual invoice is not even approximately computable. That sits below the anchor that at least has a contact-tier headline price; a 14-day trial is not a price. 2 1
The Solution Architect
Tier boundaries are unusually public — send multipliers per tier, campaign caps, workflow counts, even credit burn per AI action — which resolves rubric level 3's usual deficiency. But not one monetary figure appears: no headline price, no overage rate, no onboarding fee, no term or VAT treatment, so the annual invoice is still incomputable and the entry point is a '14-tägige Demo' CTA. 1 2
The Skeptic
The staircase itself is unusually readable — automation actions per tier, 300 vs 1,000 workflows, and journeys visibly begin at Professional — which beats the usual hidden-tier trick. But no euro figure for any tier appears in the evidence, the 'x the contact tier' send multiples are unusable without a published contact-tier price, the AI credit meter (10 credits per smart property, 50 per resolved conversation) adds a second invoice with no published rate, and the mandatory onboarding fee I look for is absent as always. 1 2
European sovereignty — proven facts
3 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in IE ⚠ unverified | 3/3 pts | 3 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU optional ⚠ unverified | 1/3 pts | 4 Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 4 Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 2 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. 'HubSpot Ireland Limited' is named only as the data controller for EEA/UK website visitors in the privacy policy; the excerpts never state which HubSpot entity customers contract with, and the footers only carry 'Copyright © 2026 HubSpot, Inc.' without register or address.
- Weak sourcing — Data residency. The EU data center is tied to a paid Starter upgrade rather than a default, and the page does not state where data is stored otherwise, only that hosting runs on AWS infrastructure.
- Weak sourcing — Subprocessors. No server region is given for the AWS hosting of customer websites, and the privacy policy additionally names US-based Plaid for payment processing.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 51 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 20 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Product page www.hubspot.de Checked 16 Sep 2026 Details →
- 2 Pricing www.hubspot.de Checked 16 Sep 2026 Details →
- 3 Privacy policy legal.hubspot.com Checked 16 Sep 2026 +1 earlier capture: 2 Sep 2026 Details →
- 4 Security / trust page www.hubspot.de Checked 30 Sep 2026 Details →
- 5 Privacy policy www.hubspot.de Checked 30 Sep 2026 Details →
- 6 Journeys & orchestration — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 7 Journeys & orchestration — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 8 Lead scoring, routing & lifecycle — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 9 Lead scoring, routing & lifecycle — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 10 Channels & personalisation — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 11 Channels & personalisation — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 12 Consent, tracking & profiling — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 13 Consent, tracking & profiling — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 14 CRM integration & data model — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →
- 15 CRM integration & data model — found from sitemap www.hubspot.de Checked 1 Oct 2026 Details →