Security, data and compliance in Marketing Automation

How Marketing Automation protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through your identity provider where your HubSpot edition supports it, so your password and multi-factor policies apply; Moraph's service portal always uses your identity provider.

Role-based access

HubSpot permissions limit who can edit contacts, publish emails and export data, and exporting contacts is restricted to the roles you choose.

Data minimization

Nonpublic personal financial information is kept out of HubSpot unless your privacy team approves a specific field for a specific use.

Moraph staff access

Moraph engineers use named accounts with the permissions you approve, and their access is reviewed with yours.

Audit trail

Moraph's service portal records every change request, approval and pre-send check, alongside the activity history HubSpot keeps.

Audited operations

Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose. HubSpot's own data hosting follows its available regions and terms.

Requirements it supports

• CAN-SPAM Act (15 U.S.C. 7701 et seq.) and the FTC CAN-SPAM Rule (16 CFR Part 316)
• EU General Data Protection Regulation (Regulation (EU) 2016/679) and UK GDPR
• UK Privacy and Electronic Communications Regulations 2003 (PECR)
• Gramm-Leach-Bliley Act privacy provisions and Regulation P (12 CFR Part 1016)
• FINRA Rule 2210 (communications with the public), for broker-dealers
• SEC Marketing Rule (Rule 206(4)-1 under the Investment Advisers Act), for registered advisers

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• New HubSpot account: A HubSpot account provisioned through Moraph and configured to the agreed baseline.
• Existing HubSpot account: Your existing HubSpot account brought under management after a baseline review of consent, permissions and integrations.
• Data hosting: HubSpot data is hosted in the HubSpot data center region available for your account under HubSpot's terms; region choice is confirmed during discovery.

Limitations

• Moraph is not HubSpot. Moraph resells, implements and operates the platform; HubSpot develops it and runs its service.
• HubSpot's own service commitments, product roadmap and any outages apply. Moraph does not change them.
• Licences are subject to HubSpot's terms, which you accept as part of the purchase. Some features, such as approvals, audit logs and single sign-on, depend on the edition you license.
• Moraph does not write or approve your marketing content. Your institution decides what is sent and approves it.
• Pre-send checks confirm the elements Moraph has agreed to check; they are not legal advice and do not replace your compliance review.
• The service covers email marketing. Text messages and calls bring separate rules, such as the TCPA, and are not configured unless agreed separately.
• Opt-out synchronization works with systems that can be integrated; opt-outs held in systems without an integration must be handled by your process.
• HubSpot is not a records archive. Retention of sent communications relies on your archive.