How we handle your data
Your CRM holds your customers’ personal data, your pricing and your pipeline. These are the rules we work by on every engagement, written so your CISO can check them.
Before we have access
- Contracts firstA signed NDA and data processing agreement are in place before anyone on our team is granted access to either system.
- Named people onlyWe tell you exactly who will have access, to which systems, with which permissions, and until what date.
- Your security reviewWe complete your vendor security questionnaire and answer follow-up questions before work starts.
While we work
- No spreadsheet exportsData moves from your old CRM into HubSpot over encrypted API connections. It is never exported to CSV files, laptops, shared drives or email.
- Least privilege, time-boxedIntegration users and admin accounts get the minimum permissions the task needs, with an expiry date agreed in advance.
- Rehearsals in a test portalTest runs happen in a separate HubSpot test portal, with sensitive fields masked wherever the test doesn’t need real values.
- Consent carried acrossSubscription status, opt-outs, legal basis and deletion history are mapped and verified like any other critical field.
- No secrets in chatAPI keys and credentials are shared through a password manager, never in email, Slack or tickets.
When we finish
The last phase of every engagement is closing the doors we opened. You receive a closeout packet with written proof of each step.
- Access revokedEvery account, integration user and token we used is disabled, with an access log for the engagement.
- Staging copies destroyedAny intermediate copies of your data are deleted, and you receive a certificate of destruction.
- Audit packetThe signed reconciliation, field map, automation inventory and access log, ready for your auditors.
Questions your security team will ask
We’re a specialist firm, and we’re straightforward about what we do and don’t have. If your vendor process requires specific certifications, insurance levels or contract terms, tell us at the start and we’ll tell you honestly whether we can meet them. Ask us for our current security documentation at hello@airtightmigrations.com.
For a deeper look at where migrations leak, read how CRM migrations expose customer data and the CRM migration security checklist.
Frequently asked questions
Who on your team will have access to our CRM?
Only named people, listed in writing before access is granted, each with their own account, multi-factor authentication, the minimum permissions the work needs, and a fixed end date.
What happens to copies of our data after the migration?
Every staging copy is deleted at closeout and you receive a certificate of destruction, along with an access log showing that all of our accounts and tokens were revoked.
Will you sign our data processing agreement?
Yes. A signed data processing agreement and NDA are in place before anyone on our team is granted access to either system.
Find out what your move to HubSpot really involves.
The free Migration Risk Scan looks at your current CRM, counts what needs to move, flags what could break and gives you a fixed price and go-live date. Thirty minutes, no obligation.