Access guide · about four minutes

Granting read-only access

Before your Leak Check we need read-only access to your HubSpot portal so we can run the scan in advance. This page shows every click. If anything here doesn’t match what you’re seeing, stop and email us rather than guessing.

Create the private app

Six steps in HubSpot

You’ll need Super Admin permissions. If you don’t have them, forward this page to whoever does.

  1. Open Private AppsIn HubSpot, click the settings gear, then in the left sidebar go to Integrations → Private Apps.
  2. Create a private appClick “Create a private app”. Name it something recognisable — “CogniOps Leak Check (read-only)” works. Adding a description helps whoever reviews it later.
  3. Open the Scopes tabThis is the important part. Scopes control exactly what the app can see. Tick only the ones listed below and nothing else.
  4. Tick the read scopesUse the search box at the top of the scopes list to find each one. Every scope you need has “Read” next to it — if you see “Write” ticked anywhere, untick it.
  5. Create the appClick Create in the top right, then confirm. HubSpot will generate an access token.
  6. Send us the token securelyDon’t email it. Use the one-time secret link in your booking confirmation, or any password manager’s secure share. The link expires after we open it once.

Step four in detail

The exact scopes to tick

CRM — read only
  • crm.objects.contacts.read Contact records
  • crm.objects.companies.read Company records
  • crm.objects.deals.read Deal records and amounts
  • crm.objects.owners.read Who owns what, and who’s deactivated
  • crm.objects.line_items.read Deal line items, where used
  • crm.schemas.deals.read Pipelines, stages and property definitions
  • crm.schemas.contacts.read Contact property definitions
  • crm.schemas.companies.read Company property definitions
  • crm.lists.read List membership and logic

Scope names occasionally differ slightly between portals and HubSpot releases. If one of the above isn’t showing in your list, tick the closest read equivalent and tell us which — it’s not a problem, we’ll work around it.

One scope we deliberately don’t ask for

HubSpot’s workflow scope grants read and write together — there’s no read-only version. Because we’ve committed to never holding write access to a client portal, we don’t request it. That means our scan doesn’t inspect your workflows directly, and we’d rather have that limitation than a promise we can’t structurally guarantee.

If you’d like workflow analysis included, we can screen-share it with you during the call instead, with you driving.

Your control

Revoking access

You can revoke this at any moment, without telling us, and nothing breaks on your side. Go to Settings → Integrations → Private Apps, open the app, and click Delete. The token stops working immediately.

We delete the app at the end of your Leak Check call as a matter of course. You’re welcome to watch us do it, or delete it yourself the moment we hang up.

What we can and can’t do with this access
  • Read records and properties Yes
  • Read pipelines and stage history Yes
  • Create, edit or delete any record No
  • Send email from your portal No
  • Read email content or call recordings No
  • Change settings or permissions No
  • Add or remove users No

Data handling

What we store, and for how long

We query your portal and store aggregate findings — counts, calculations and the identifiers needed to show you a record on the call. We don’t retain exports of your contact database.

Findings are held in a structured form so we can build cross-portal benchmarks over time. Those benchmarks are anonymised and no client is ever identifiable in them. If you’d prefer your portal excluded from benchmark data entirely, say so and we’ll exclude it — it makes no difference to what you get.

The full version — scopes, retention periods, sub-processors, breach notification and your rights under the Australian Privacy Principles — is in our data handling statement. If your security or procurement team needs a signed agreement, ask and we’ll send one before you create anything.

Alternatives

If a private app won’t work for you

  • A read-only user account. Create a user for us with view-only permissions and no write access. Works just as well and some IT teams prefer it.
  • Screen share on the call instead. You drive, we tell you where to click. It’s a weaker version — we lose the pre-call scan, so expect fewer findings and a longer call.
  • A security review first. If your organisation needs one, tell us and we’ll send whatever documentation your team needs before you book.

Stuck on any of this?

Reply to your booking confirmation and we’ll get on a five-minute call to sort it. Access problems are our problem to solve, not yours.

Back to the Leak Check