Security and data handling

knovaly requests read scopes only. The application has no capability to create, edit, delete or merge any record in your HubSpot portal — no deals, contacts, companies, notes, tasks, properties or workflows are ever written. Every finding in a knovaly report is produced by reading and analysing data that already exists in your CRM.

The objects knovaly reads are the ones required to produce the report: deals, companies, contacts, owners, line items, quotes and the associated engagement timestamps used to determine recent activity.

Connections are established through HubSpot's standard OAuth 2.0 authorization flow. You approve the requested scopes inside HubSpot, as a signed-in HubSpot user with the right to install applications. knovaly never asks for, receives or stores your HubSpot password, and the authorization request is bound to a single-use, expiring state value so a connection link cannot be replayed.

If HubSpot does not grant every scope the report depends on, the connection reports the shortfall instead of silently running with partial data.

All traffic between your browser, knovaly and HubSpot travels over TLS. HubSpot access and refresh tokens are encrypted at rest with AES-256-GCM using a key held only in server-side secret storage; encrypted tokens are decrypted in memory on the server for the duration of a request and are never exposed to the browser, to logs, or to any client-side code.

Application data is stored in a managed PostgreSQL database with encryption at rest, and access to customer rows is enforced per workspace by row-level security policies.

knovaly stores only what is required to produce and re-open your reports:

• Your account email and workspace record.
• Encrypted HubSpot OAuth tokens and the connected portal identifier.
• Scan results: the findings, the CRM record references and property values that justify each finding, owner names, amounts and dates.
• Scan run metadata — scope, timing, coverage and errors — used for transparency.
• Billing state (plan, status, period) and Stripe customer and subscription IDs.

knovaly does not store HubSpot passwords, payment card details, or CRM objects that are not needed for the report.

Your CRM data is yours. knovaly processes it on your instruction, to produce reports for your workspace only. We do not sell customer data, and we do not share one customer's CRM data with another. Workspace isolation is enforced at the database level, so a report can only be read by members of the workspace that created it.

You can request export or deletion of your data at any time through the Data Deletion Request page.

You can disconnect at any time, from either side. Inside knovaly, use Account → HubSpot connection → Disconnect: the stored tokens for that portal are deleted and no further CRM reads are possible. Inside HubSpot, a super admin can uninstall the knovaly app from Settings → Integrations → Connected Apps, which revokes the tokens immediately.

Disconnecting stops all future access. Reports already generated remain in your workspace until you delete them or request account deletion.

Payments are processed by Stripe. Card details are entered on Stripe-hosted Checkout and are never transmitted to, processed by, or stored on knovaly systems. Subscription changes reach us through Stripe webhooks whose signatures are cryptographically verified before they are accepted, and each event is processed once.

Invoices, payment methods and cancellations are managed in the Stripe-hosted billing portal, reachable from your account. Stripe is a PCI Service Provider Level 1; see Stripe's own documentation for the details of their compliance programme.

If you believe you have found a security issue, email security@knovaly.com with the steps to reproduce. We will acknowledge your report and keep you updated while we investigate. Please do not publicly disclose an issue before we have had a reasonable opportunity to address it.

This page describes controls that are implemented in the product today. It is not an independent audit, and knovaly does not claim SOC 2, ISO 27001, HIPAA or PCI certification. If your procurement process requires a security review, contact us and we will work through your questionnaire.