CRM migration security checklist

The short answer: Before approving a CRM migration, confirm a signed data processing agreement, a documented data flow with no file exports, named and time-limited vendor access with two-factor authentication, masked test data, consent records reconciled like revenue, an incident process, and written proof at closeout that access was revoked and staging copies destroyed.

Moving to HubSpot means moving your entire customer base, usually with outside help, new integrations and temporary environments. If you’re the person who has to approve the project from a security standpoint, this checklist gives you the questions to ask, in the order you’ll need them.

Before the project starts

Is a data processing agreement and NDA signed with every vendor who will touch the data? No access before both are in place.
Has the vendor completed your security questionnaire? Treat the migration partner like any other processor of customer data.
Do you have a data inventory? Know which objects and fields hold personal, financial or contractually restricted data.
Is the data flow documented? Every system, environment and tool the data passes through, and where it’s stored at each step.
Will any data be exported to files? The right answer is no. Any exception should be specific, approved and time-limited.
Does any data cross a border it doesn’t cross today? Check where your HubSpot account’s data is hosted, and where the vendor and its tools process data.

Access and credentials

Who exactly will have access, to which systems, with which permissions, until when? Get it in writing.
Are vendor accounts named and individual? No shared logins.
Is two-factor authentication enforced on every account used in the project, in both systems?
Are API tokens and integration users scoped to the minimum needed?
How are credentials shared? Through a password manager, never in email, chat or tickets.
Are exports restricted in both systems during the project, so only named people can bulk-export records?

During the build and rehearsals

Do rehearsals run in a test portal, with sensitive fields masked unless a test needs real values?
Who can access the test portal? Only the project team.
Are HubSpot user permissions and team visibility designed and tested before launch?
Are consent, opt-out and deletion records migrated and reconciled like any other critical field? See GDPR and CCPA risks when moving to HubSpot.
Are new integrations reviewed? Any tool newly connected to HubSpot is a new route to your data.
Is there an incident process? Who is told, how fast, and who decides on notification?

Cutover and closeout

Is there a rollback plan that doesn’t involve exporting data to files in a hurry?
When will vendor access be revoked, and who confirms it?
Will every staging copy be destroyed, with a certificate of destruction?
Will all project tokens and integration users be revoked?
What happens to the old CRM? How long it stays read-only, who can still access it, and how the final archive is stored.
Will you receive an access log for the engagement, for your records?

Put it in the contract

The answers only protect you if they’re binding. Your agreement with a migration partner should include the data processing agreement, the named access list with end dates, a rule against file exports without written approval, disclosure of subcontractors and tools, a short breach notification deadline and closeout obligations with proof. Have your counsel review it.

For where migrations leak in the first place, see how CRM migrations expose customer data.

Sources and further reading

Require approvals for exports, HubSpot Knowledge Base
GDPR Article 28: Processor, GDPR text
CCPA laws and regulations, California Privacy Protection Agency

Platform features and policies change. Check the vendor’s current documentation before acting on any detail in this article. This article is general information, not legal advice.