Customization | Entry 19
Yes. Nonprofits can configure different levels of HubSpot access based on each person's responsibilities, including tools, objects, records, properties, reports, marketing assets, and administrative capabilities.
Not every person needs to see or change every piece of CRM information. HubSpot seats influence which subscription tools a user can access, while permissions govern what that user can view or do within the account.
A team-specific layout can make records easier to use, but removing a property from that layout does not necessarily prevent someone from accessing it through the complete property list, saved views, reports, dashboards, segments, workflows, exports, connected applications, or other tools.
Use record customization to improve relevance and usability. Use permissions to control access.
A volunteer may need an event assignment without seeing giving history. A program coordinator may need participant records without marketing publishing access. An executive may need an attribution dashboard without permission to modify its campaigns or reports.
These are starting points, not universal templates. Access must reflect the nonprofit's processes, data sensitivity, subscription, privacy obligations, and segregation-of-duties requirements.
Permissions can limit access to marketing email, social publishing, ads, forms, pages, campaigns, segments, workflows, reports, imports, exports, data-quality tools, CRM configuration, user management, apps, billing, and account settings.
This helps prevent someone who only needs constituent information from accidentally publishing a social post, changing a form, or modifying a workflow. In other words, a login does not have to come with an honorary degree in communications.
Viewing, editing, approving, publishing, exporting, deleting, merging, and administering are different responsibilities. Review each capability separately.
A user may need one CRM object without needing another. Program staff may require program enrollments but not donation transactions, while Development may need donor and household records but not confidential service records.
For supported objects, access can be configured around all records, team-owned records, owned records, or no records. This can help regional teams, relationship managers, and volunteer coordinators work within the records assigned to them.
Ownership-based access depends on reliable assignment. Missing, outdated, or inconsistent ownership can lock out authorized users or leave unintended access in place.
For supported properties and account configurations, selected users and teams can generally receive one of three access levels:
| Property access | What it allows |
|---|---|
| View and edit | See and change the property's value |
| View only | See the value without changing it |
| No access | Neither see nor edit the value |
Tighter controls may be appropriate for gift amounts, wealth-screening results, eligibility details, assistance amounts, background-check status, internal conduct notes, compensation information, banking details, and legal or compliance notes.
First determine whether HubSpot is an appropriate system for the information. Access restrictions do not automatically make every category of regulated or highly sensitive data appropriate to store. HubSpot's separate Sensitive Data requirements and tool limitations should be reviewed.
A user without access to a property may also be unable to use it in saved views, reports, dashboards, workflows, segments, imports, exports, and other supported tools. A sensible restriction can therefore break a required operational workspace if dependencies are not tested.
Dashboard visibility, reporting permissions, and access to the underlying records and properties work together. Review who can open, edit, export, email, or externally share each dashboard, and whether users can drill into sensitive records.
Tool permission may allow someone to work with a category such as marketing email, while asset access can determine which specific emails, pages, posts, forms, campaigns, calls to action, or files that person can edit. Available controls vary by asset and subscription, and restricting individual marketing assets generally requires Marketing Hub Enterprise.
Enterprise accounts can use permission sets to package repeatable role configurations such as Development Officer, Gift Processing, Program Coordinator, Executive Viewer, or Temporary Contractor. Other accounts can still configure permissions individually or make supported bulk changes.
Super Admins can administer or bypass many restrictions. Do not grant that access merely because someone is a department head, needs one setting changed, encountered an access error, or may occasionally troubleshoot the account.
Give each user the minimum access required to complete their current responsibilities safely. Review access when someone joins, changes roles or teams, begins a temporary project, receives a new seat, takes extended leave, completes a contract, or leaves the organization.
When access ends, review more than team membership. Check the person's user status, seat, permissions, record and asset ownership, connected applications, workflows, dashboards, and administrative responsibilities.
Available controls depend on HubSpot products, subscription, seats, object and property types, Sensitive Data configuration, team structure, ownership, permission sets, marketing assets, reports, connected applications, custom objects, interface, and beta enrollment.
Before promising an access model, verify the required features and permissions, confirm that ownership is dependable, test affected views and automations, review integration behavior, and sign in as a representative user. HubSpot's seats, permission labels, sensitive-data capabilities, and asset-access settings continue to evolve, so current account behavior should be confirmed during implementation.