Pipelines and process
5 findings · ~10h if fixed separately
Sample audit report
C
77/100
Read the full verdict
This wholly synthetic HubSpot fixture found deterministic data-model, access, pipeline, automation, forms, marketing and CMS issues across the eight feature areas. The published overall result is grade C (77/100). The report contains no real customer records, traffic, backlink, revenue or conversion claims.
Start here
The 3 things to fix first
- High
Domains without SSL enabled
Enable SSL on every connected domain.
- Medium
Open deals stuck for over 180 days
Run a stuck-deal clean-up.
- Medium
High super admin count
Review whether each Super Admin still needs full portal control.
Feature areas
How each part of the portal is set up
The overall 77/100 (grade C) is the weighted mean of the 8 assessed areas. How the overall figure is worked out
Compare all areas in one table
| Area | Score | Maturity | Status | Findings |
|---|---|---|---|---|
| Data model and data quality | B 81/100 | Level 3, Established | Assessed | 7 |
| Users, permissions and security | C 66/100 | Level 2, Developing | Assessed | 2 |
| Pipelines and process | C 72/100 | Level 2, Developing | Assessed | 5 |
| Automation | B 89/100 | Level 3, Established | Assessed | 1 |
| Forms and segmentation | A 93/100 | Level 3, Established | Assessed | 1 |
| Marketing assets | C 69/100 | Level 2, Developing | Assessed | 1 |
| Service | A 100/100 | Level 4, Advanced | Assessed | 0 |
| CMS and website | E 40/100 | Level 1, Foundational | Assessed | 1 |
Data model and data quality
22% of the overall figure · Level 3, Established
B81/100Assessed7 findings
Data model and data quality
22% of the overall figure · Level 3, Established
Maturity: Level 3, Established. Set by: Area score of at least 75 (observed 81). No failed high-importance check (observed 0).
To reach Advanced: Area score of at least 90 (observed 81).
- What is configured 1 of 1 scored checks pass
- How it is used 2 of 6 scored checks pass
- What is broken or risky 1 of 1 scored checks pass
Checks behind this area (12)
What is configured
- Empty property groupsPass · 0 of 5 affected
- Property validation coverage reviewReview only
How it is used
- Association relationship completenessPass
- Primary company association coveragePartial · 20 of 40 affected
- Stale-record sharePartial · 20,000 of 50,000 affected
- Cold-record sharePass · 30,000 of 50,000 within tolerance
- Record owner coveragePartial · 15,000 of 50,000 affected
- Unused custom propertiesPartial · 4 of 13 affected
- Referenced custom properties with little or no dataReview only
- Association label adoptionReview only
What is broken or risky
- Custom property limit pressurePass
- Sensitive property reviewReview only
Findings (7)
- Low
- Low
- Low
- Low
- Low
Items affected (4)
- Synthetic legacy scoreProperty on contacts Check before archiving
- Synthetic webinar topicProperty on contacts Check before archiving
- Synthetic parent segmentProperty on companies Check before archiving
- Synthetic old forecast bucketProperty on deals Check before archiving
No known reference was found, but these could still use the items and were not assessed: List definitions (not collected); Reports and dashboards (not collected); Installed apps (not collected); Webhook subscriptions (not collected); Private apps (not collected); Sequences, templates and snippets (not collected); Pipeline stage required properties (not exposed by the HubSpot API).
- Info
Item affected
- Synthetic partner referralProperty on contacts Referenced by form: Synthetic form 1
- Info
Users, permissions and security
16% of the overall figure · Level 2, Developing
C66/100Assessed2 findings
Users, permissions and security
16% of the overall figure · Level 2, Developing
Maturity: Level 2, Developing. Set by: Area score of at least 50 (observed 66).
To reach Established: Area score of at least 75 (observed 66).
- What is configured 2 of 3 scored checks pass
- How it is used 1 of 1 scored checks pass
- What is broken or risky 0 of 1 scored checks pass
Checks behind this area (11)
What is configured
- Primary team coveragePartial · 4 of 12 affected
- Custom role coveragePass
- Team configurationPass
- Account governance evidenceReview only
How it is used
- Deactivated owners holding recordsPass · 0 of 50 affected
What is broken or risky
- Super Admin sharePartial · 7 of 12 affected
- Failed login anomalyDoes not apply, not scored
- Export download reviewDoes not apply, not scored
- Integration install reviewDoes not apply, not scored
- Private-app token view reviewDoes not apply, not scored
- Privileged user change reviewDoes not apply, not scored
Findings (2)
- Medium
- Low
Pipelines and process
16% of the overall figure · Level 2, Developing
C72/100Assessed5 findings
Pipelines and process
16% of the overall figure · Level 2, Developing
Maturity: Level 2, Developing. Set by: Area score of at least 50 (observed 72).
To reach Established: Area score of at least 75 (observed 72).
- What is configured 4 of 6 scored checks pass
- How it is used 1 of 3 scored checks pass
- What is broken or risky 2 of 2 scored checks pass
Checks behind this area (17)
What is configured
- Pipeline inventory sizePass
- Pipeline stage countFail · 1 of 1 affected
- Duplicate stage labelsPass · 0 of 1 affected
- Empty stage labelsPass · 0 of 1 affected
- Invalid stage orderFail · 1 of 1 affected
- Archived stage clutterPass · 0 of 1 affected
- Required-stage enforcement reviewReview only
How it is used
- Stuck-deal samplePartial · 3 of 10 affected
- Empty stage sampleFail · 1 of 1 affected
- Deal pipelines with no dealsPass · 0 of 1 affected
- Observed sales cohort healthReview only
- Deal amount currency basisReview only
- Goal coverageDoes not apply, not scored
- Lead healthDoes not apply, not scored
- Commerce configuration evidenceDoes not apply, not scored
What is broken or risky
- Terminal stage probabilityPass · 0 of 1 affected
- Open-stage probability monotonicityPass · 0 of 1 affected
Findings (5)
- Medium
Item affected
- Synthetic deal pipelinePipeline on deals
- Medium
- Low
Item affected
- Synthetic deal pipelinePipeline on deals
- Low
Items affected (7)
- Synthetic deal pipelinePipeline on deals
- Synthetic stage 11Stage on deals Check before archiving
- Synthetic stage 12Stage on deals Check before archiving
- Synthetic stage 13Stage on deals Check before archiving
- Synthetic stage 14Stage on deals Check before archiving
- Synthetic stage 15Stage on deals Check before archiving
- Synthetic stage 16Stage on deals Check before archiving
No known reference was found, but these could still use the items and were not assessed: List definitions (not collected); Reports and dashboards (not collected); Installed apps (not collected); Webhook subscriptions (not collected); Private apps (not collected).
- Info
Automation
14% of the overall figure · Level 3, Established
B89/100Assessed1 finding
Automation
14% of the overall figure · Level 3, Established
Maturity: Level 3, Established. Set by: Area score of at least 75 (observed 89). No failed high-importance check (observed 0).
To reach Advanced: Area score of at least 90 (observed 89). Usage evidence was not assessed, so Advanced cannot be confirmed.
- What is configured 0 of 1 scored checks pass
- How it is used No scored check
- What is broken or risky 4 of 4 scored checks pass
Checks behind this area (9)
What is configured
- Enabled workflow countReview only
- Stale enabled workflowsFail · 6 of 6 affected
- Unsupported workflow actionsReview only
What is broken or risky
- Broad workflow enrolmentPass · 0 of 6 affected
- Dead-end workflow pathsPass · 0 of 6 affected
- Overlapping property writesPass · 0 of 6 affected
- Lifecycle write overlapPass · 0 of 6 affected
- Lead routing action gapsDoes not apply
- Custom-coded workflow actionsReview only
Findings (1)
- Medium
Items affected (6)
- Synthetic workflow 1Workflow
- Synthetic workflow 2Workflow
- Synthetic workflow 3Workflow
- Synthetic workflow 4Workflow
- Synthetic workflow 5Workflow
- Synthetic workflow 6Workflow
Forms and segmentation
10% of the overall figure · Level 3, Established
A93/100Assessed1 finding
Forms and segmentation
10% of the overall figure · Level 3, Established
Maturity: Level 3, Established. Set by: Area score of at least 75 (observed 93). No failed high-importance check (observed 0).
To reach Advanced: Usage evidence was not assessed, so Advanced cannot be confirmed.
- What is configured 1 of 2 scored checks pass
- How it is used No scored check
- What is broken or risky 1 of 1 scored checks pass
Checks behind this area (5)
What is configured
- Form field hygienePartial · 1 of 6 affected
- Subscription typesPass
- List definitionsNot available
- Marketing forms coverageReview only
What is broken or risky
- Form field property mappingPass · 0 of 5 affected
Findings (1)
- Low
Item affected
- Synthetic form 6Form
Marketing assets
10% of the overall figure · Level 2, Developing
C69/100Assessed1 finding
Marketing assets
10% of the overall figure · Level 2, Developing
Maturity: Level 2, Developing. Set by: Area score of at least 50 (observed 69).
To reach Established: Area score of at least 75 (observed 69).
- What is configured 1 of 2 scored checks pass
- How it is used No scored check
- What is broken or risky No scored check
Checks behind this area (5)
What is configured
- Campaign configuration ownershipPartial · 2 of 6 affected
- Marketing email draftsPass · 1 of 5 within tolerance
How it is used
- Behavioural event aggregate journeysDoes not apply, not scored
- HubSpot-native acquisition analyticsDoes not apply, not scored
- Marketing-event attendance countersDoes not apply, not scored
Findings (1)
- Low
Items affected (2)
- Synthetic campaign 1Campaign
- Synthetic campaign 2Campaign
Service
6% of the overall figure · Level 4, Advanced
A100/100AssessedNo findings
Service
6% of the overall figure · Level 4, Advanced
Maturity: Level 4, Advanced. Set by: Area score of at least 90 (observed 100). Every high-importance check passes (observed 0 not passing). No failed medium-importance check (observed 0). Usage evidence was assessed.
- What is configured No scored check
- How it is used 1 of 1 scored checks pass
- What is broken or risky No scored check
Checks behind this area (5)
What is configured
- Ticket pipeline closed stateDoes not apply
How it is used
- Ticket owner coveragePass · 0 of 300 affected
- Stale open ticketsDoes not apply
- Service performanceReview only
- Customer feedback performanceDoes not apply, not scored
No findings in this area.
CMS and website
6% of the overall figure · Level 1, Foundational
E40/100Assessed1 finding
CMS and website
6% of the overall figure · Level 1, Foundational
Maturity: Level 1, Foundational. Set by: The area was assessed.
To reach Developing: Area score of at least 50 (observed 40).
- What is configured 2 of 2 scored checks pass
- How it is used No scored check
- What is broken or risky 0 of 1 scored checks pass
Checks behind this area (6)
What is configured
- Pattern redirect shareDoes not apply
- Site-page metadata coveragePass · 0 of 5 affected
- Landing-page draft sharePass · 2 of 5 within tolerance
- CMS governance and redirectsReview only
What is broken or risky
- CMS transport securityFail · 1 of 1 affected
- Public file shareDoes not apply
Findings (1)
- High
Item affected
- halcyon.example.invalidDomain
This week
6 fixes you can start without a project plan
This week
Fixes you can land this week
High-leverage changes you can start without a project plan. Effort figures are indicative.
High~1h
Domains without SSL enabled
1 connected domain reported SSL as disabled. Modern browsers warn visitors on plain HTTP.
Web/CMS · DIY
Medium~1h
Invalid or ambiguous pipeline stage order
deals pipeline "Synthetic deal pipeline" has missing or duplicated displayOrder values among active stages.
RevOps · Specialist
Also in: Pipelines and process (5 findings)
Low~1h
Many marketing forms have no fields
1 of 6 forms have no fields (17%).
Marketing Ops · DIY
Low~1h
Campaign configuration ownership is incomplete
2 of 6 campaigns had no observed owner. Campaign metrics remain associative and are not causal ROI proof.
Marketing Ops · DIY
Low~1h
Unused custom properties
4 custom properties of 13 measured hold no data, or almost none, and have no reference from any detailed workflow, form or pipeline SpotCheck read. Each is classified for clean-up below; lists, reports and installed apps were not assessed, so a property is called safe to archive only when every reference type was.
CRM Admin · DIY
Also in: Data model and data quality (7 findings)
Low~1h
Many users have no primary team
4 of 12 users (33%) do not have a primary team.
CRM Admin · DIY
Also in: Users, permissions and security (2 findings)
The next 90 days
11 items in three phases: 30, 60 and 90 days
90 days
Next 90 days
Prioritised by severity, impact, effort, confidence and simple dependency order. Owner suggestions are heuristic; adjust to your team. Effort figures are indicative.
Next 30 days
3Critical and high-impact items first
Mostly IT/Security work
7 of 12 users (58%) are Super Admins. SpotCheck tolerates two Super Admins, or up to 15% of users, so a team keeps a backup administrator without spreading full control.
Why now: medium severity with roughly 5h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the medium risk described by "High super admin count", protecting an impact score of 7/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
1 connected domain reported SSL as disabled. Modern browsers warn visitors on plain HTTP.
Why now: high severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the high risk described by "Domains without SSL enabled", protecting an impact score of 9/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
deals pipeline "Synthetic deal pipeline" has missing or duplicated displayOrder values among active stages.
Why now: medium severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the medium risk described by "Invalid or ambiguous pipeline stage order", protecting an impact score of 5/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
~7h indicative in this horizon
Days 31–60
2Medium-impact follow-ups
Mostly Sales Manager work
30% of sampled deals with an explicit open or closed state have not changed in over 180 days. This is operating evidence from the bounded deal sample, not a pipeline configuration defect.
Why now: medium severity with roughly 4h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the medium risk described by "Open deals stuck for over 180 days", protecting an impact score of 8/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
6 of 6 enabled workflows (100%) have not been edited in over 12 months. Last-edit age is only a review proxy because HubSpot's API does not expose workflow execution or enrolment history.
Why now: medium severity with roughly 3h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the medium risk described by "Active but stale workflows", protecting an impact score of 6/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
~7h indicative in this horizon
Days 61–90
6Cleanup and longer-running work
Mostly CRM Admin work
1 of 6 forms have no fields (17%).
Why now: low severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Many marketing forms have no fields", protecting an impact score of 6/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
2 of 6 campaigns had no observed owner. Campaign metrics remain associative and are not causal ROI proof.
Why now: low severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Campaign configuration ownership is incomplete", protecting an impact score of 6/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
Dependencies:
4 custom properties of 13 measured hold no data, or almost none, and have no reference from any detailed workflow, form or pipeline SpotCheck read. Each is classified for clean-up below; lists, reports and installed apps were not assessed, so a property is called safe to archive only when every reference type was.
Why now: low severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Unused custom properties", protecting an impact score of 4/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
4 of 12 users (33%) do not have a primary team.
Why now: low severity with roughly 1h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Many users have no primary team", protecting an impact score of 4/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
30% of contacts (15,000 of 50,000 records) have no owner. The check scores the worst object; every assessed object's figure is listed below. Ticket ownership is assessed in the Service area.
Why now: low severity with roughly 4h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Records without an owner", protecting an impact score of 8/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
20 of 40 sampled contacts had no primary company association. Any-company and primary-company evidence are reported separately.
Why now: low severity with roughly 4h indicative effort; prioritised before lower-confidence or lower-impact work.
Outcome: Reduce or remove the low risk described by "Contacts lack a primary company association in the sample", protecting an impact score of 7/10.
Verify: Re-run SpotCheck and confirm this finding is resolved or materially reduced.
~12h indicative in this horizon
plus 7 further items, prioritised in the findings table
Licence fit
Whether you are using the HubSpot you pay for, and platform limits
Licence
Are you using the HubSpot you pay for?
STANDARD
Reported tier: STANDARD. Licence fit could not be concluded because HubSpot did not report a recognised subscription tier. 2 relevant inventories were unavailable, so absence was not treated as non-use.
Platform limits and headroom
- Custom properties42% used
- Custom objectsNot availableThis limit could not be read for this portal.
- Association labelsNot availableThis limit could not be read for this portal.
See hub-by-hub tiers
Your HubSpot subscriptions
Add the tier you hold for each Hub and this report will show your licence at a glance. We only ever show what you confirm, never a guess.
Root causes
Where the issues concentrate
Root causes
Where issues concentrate
These areas account for many of the high-impact findings.
Users, permissions and security
2 findings · ~6h if fixed separately
Data model and data quality
7 findings · ~22h if fixed separately
Explore everything
All 18 findings, categories, comparisons and the evidence behind the score
View as
Showing all findings across every owner. Pick a tab above to retell the same audit through one role's lens.
Findings
18 of 18 findings shown
Search, filter, sort and expand findings. Results update without leaving this report.
18 findings shown after filtering and sorting.
Severity
Category
Owner
Fix type
Data model and data quality
- Low DIY
- Low DIY
- Low DIY
- Low DIY
- Low DIY
- Info DIY
- Info DIY
Users, permissions and security
- Medium Specialist
- Low DIY
Pipelines and process
- Medium Specialist
- Medium DIY
- Low Specialist
- Low DIY
- Info Specialist
Automation
- Medium DIY
Forms and segmentation
- Low DIY
Marketing assets
- Low DIY
CMS and website
- High DIY
Category breakdown
How the grade is made up
Each category is scored out of 100 and contributes to the overall grade by its weight. The rationale explains what moved each score.
| Category | Grade | Score | Weight | Confidence | Why |
|---|---|---|---|---|---|
| Data model and data quality | B | 81 | 22% | High | Maturity: Established. 4 of 8 scored checks passed, 4 partial. associations.batch.deals.line_items was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. associations.batch.deals.quotes was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. associations.batch.deals.invoices was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. |
| Users, permissions and security | C | 66 | 16% | High | Maturity: Developing. 3 of 5 scored checks passed, 2 partial. security.loginActivity was not available for the portal's product access; this was recorded as a coverage limitation, not a deterministic result. security.securityActivity was not available for the portal's product access; this was recorded as a coverage limitation, not a deterministic result. |
| Pipelines and process | C | 72 | 16% | High | Maturity: Developing. 7 of 11 scored checks passed, 1 partial, 3 failed. crm.sample.leads was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.searchCount.leads was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.unowned.leads was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.goal_targets was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.products was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.line_items was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.quotes was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.orders was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.invoices was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.commercepayments was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. crm.sample.subscriptions was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. |
| Automation | B | 89 | 14% | High | Maturity: Established. 4 of 5 scored checks passed, 1 failed. |
| Forms and segmentation | A | 93 | 10% | High | Maturity: Established. 2 of 3 scored checks passed, 1 partial. |
| Marketing assets | C | 69 | 10% | High | Maturity: Developing. 1 of 2 scored checks passed, 1 partial. behaviour.eventTypes was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. marketing.events was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.sources.30d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.sources.previous30d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.sources.90d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.sources.previous90d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.sources.365d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.pages.90d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. analytics.forms.90d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. |
| Service | A | 100 | 6% | High | Maturity: Advanced. 1 of 1 scored check passed. crm.sample.feedback_submissions was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. conversations.threads.90d was not assessable because its optional audit grant was not approved; this was recorded as a coverage limitation, not a deterministic result. |
| CMS and website | E | 40 | 6% | High | Maturity: Foundational. 2 of 3 scored checks passed, 1 failed. |
Severity heatmap
Where issues cluster
Categories down, severities across. Cell intensity scales with finding count.
| Critical | High | Medium | Low | Info | Total | |
|---|---|---|---|---|---|---|
| Data model and data quality | 0 | 0 | 0 | 5 | 2 | 7 |
| Users, permissions and security | 0 | 0 | 1 | 1 | 0 | 2 |
| Pipelines and process | 0 | 0 | 2 | 2 | 1 | 5 |
| Automation | 0 | 0 | 1 | 0 | 0 | 1 |
| Forms and segmentation | 0 | 0 | 0 | 1 | 0 | 1 |
| Marketing assets | 0 | 0 | 0 | 1 | 0 | 1 |
| Service | 0 | 0 | 0 | 0 | 0 | 0 |
| CMS and website | 0 | 1 | 0 | 0 | 0 | 1 |
Shape versus peers
Category radar
Where this portal stands
Higher is better. The shaded shape is this portal; the dashed line is the portfolio median for similarly-tiered HubSpot portals SpotCheck has audited.
Strongest category: Service at 100/100. Lowest category: CMS and website at 40/100. A reliable compatible benchmark is not available for this chart.
This portal
View category radar data
| Category | This portal |
|---|---|
| Data model and data quality | 81/100 |
| Users, permissions and security | 66/100 |
| Pipelines and process | 72/100 |
| Automation | 89/100 |
| Forms and segmentation | 93/100 |
| Marketing assets | 69/100 |
| Service | 100/100 |
| CMS and website | 40/100 |
Benchmark values appear only for compatible cohorts with enough retained audits to be reliable.
Impact × Effort
Where to focus
Each dot is a finding. Top-left means quick wins and top-right means strategic projects. Use the chart or the finding controls below to jump to a finding.
11 plotted findings look like quick wins. Highest plotted impact: Domains without SSL enabled, 9/10 impact and about 1 hours. 2 findings lacked impact or effort estimates and are listed in the findings table instead.
View impact and effort chart
Findings in the chart
- 7/10 impact, about 6 hours, RevOps
- 7/10 impact, about 4 hours, CRM Admin
- 8/10 impact, about 6 hours, RevOps
- 8/10 impact, about 4 hours, RevOps
- 4/10 impact, about 1 hours, CRM Admin
- 2/10 impact, about 1 hours, CRM Admin
- 7/10 impact, about 5 hours, IT/Security
- 4/10 impact, about 1 hours, CRM Admin
- 4/10 impact, about 3 hours, RevOps
- 5/10 impact, about 1 hours, RevOps
- 8/10 impact, about 4 hours, Sales Manager
- 4/10 impact, about 2 hours, RevOps
- 6/10 impact, about 3 hours, RevOps
- 6/10 impact, about 1 hours, Marketing Ops
- 6/10 impact, about 1 hours, Marketing Ops
- 9/10 impact, about 1 hours, Web/CMS
View impact and effort data
| Finding | Severity | Impact | Effort | Owner |
|---|---|---|---|---|
| Contacts records have missing companies associations | low | 7/10 | 6 hours | RevOps |
| Contacts lack a primary company association in the sample | low | 7/10 | 4 hours | CRM Admin |
| Stale records on core objects | low | 8/10 | 6 hours | RevOps |
| Records without an owner | low | 8/10 | 4 hours | RevOps |
| Unused custom properties | low | 4/10 | 1 hours | CRM Admin |
| Referenced custom properties with little or no data | info | 2/10 | 1 hours | CRM Admin |
| High super admin count | medium | 7/10 | 5 hours | IT/Security |
| Many users have no primary team | low | 4/10 | 1 hours | CRM Admin |
| Long pipeline stage set | low | 4/10 | 3 hours | RevOps |
| Invalid or ambiguous pipeline stage order | medium | 5/10 | 1 hours | RevOps |
| Open deals stuck for over 180 days | medium | 8/10 | 4 hours | Sales Manager |
| Pipeline stages unused in the deal sample | low | 4/10 | 2 hours | RevOps |
| Active but stale workflows | medium | 6/10 | 3 hours | RevOps |
| Many marketing forms have no fields | low | 6/10 | 1 hours | Marketing Ops |
| Campaign configuration ownership is incomplete | low | 6/10 | 1 hours | Marketing Ops |
| Domains without SSL enabled | high | 9/10 | 1 hours | Web/CMS |
Critical High Medium Low Info
2 findings have no effort/impact estimate and are not plotted here. See the findings table for the full list.
Method
How the overall figure is worked out
Each area is scored from its checks: every scored check has an importance of 1 to 3, and the area score is the importance-weighted share of checks passed, out of 100. The overall figure is the weighted mean of the assessed area scores. An area that is not in use is left out and the other weights are rescaled. If any area in use could not be assessed, no overall figure is published.
The area weights are SpotDev's judgement of how much each area matters to a well-run HubSpot portal. They have not yet been calibrated against audits completed by hand, so treat the overall figure as a guide and the area scores and findings as the detail.
| Area | Weight | In this report |
|---|---|---|
| Data model and data quality | 22% | Assessed |
| Users, permissions and security | 16% | Assessed |
| Pipelines and process | 16% | Assessed |
| Automation | 14% | Assessed |
| Forms and segmentation | 10% | Assessed |
| Marketing assets | 10% | Assessed |
| Service | 6% | Assessed |
| CMS and website | 6% | Assessed |
| Level | What it needs |
|---|---|
| 0, Not in use | There is positive evidence the portal does not use the area. It is left out of the overall figure. |
| 1, Foundational | The area was assessed. |
| 2, Developing | Area score of at least 50. |
| 3, Established | Area score of at least 75 and no failed high-importance check. |
| 4, Advanced | Area score of at least 90, every high-importance check passes, no failed medium-importance check, and usage evidence was assessed. |
Assessment boundaries
What this report measures
Wholly synthetic golden fixture. Wholly synthetic fixture. No customer or anonymised production data is used.
- Configuration and implementation health
- 77/100, grade C, across 8 categories.
- Observed business performance
- Not measured. This report makes no revenue, conversion, traffic or commercial-performance judgement from configuration evidence.
- Evidence coverage
- 121 of 148 sources succeeded; 8 of 8 areas were assessed.
Method and source proof
How this assessment was produced
Each deterministic rule records its outcome and the evidence it used. Checks that could not run are omitted here rather than shown as errors; they never count as a pass and never lower the score. The coverage summary above accounts for those gaps.
Digest facts and recorded outcomes
- Audit type
- HubSpot portal
- Scored at
- 22 Jun 2026, 09:14 UTC
- Methodology
spotcheck-methodology-v2- Rule registry
deterministic-rule-registry-v2- Scorer
hubspot-scorer-v10-feature-areas- Assessment basis
hubspot-score-evidence-v1- Headline result
- 77/100, grade C
- Evidence ledger
deterministic-evidence-ledger-v2- Ledger digest
d535258234a435b2870f20e3ac79f63c11b6ad014ed78a8e554ce10f8b6f4231
Recorded rule outcomes
- 38Passes
- 14Fails
- 1Unavailable
- 17Not applicable
- 0Errors
Category scoring basis
- automation14% weight89/100, grade B
- cms6% weight40/100, grade E
- data model22% weight81/100, grade B
- forms segmentation10% weight93/100, grade A
- marketing10% weight69/100, grade C
- pipelines16% weight72/100, grade C
- service6% weight100/100, grade A
- users permissions16% weight66/100, grade C
Deterministic rule proof
FailSuper Admin share32 point deduction
Measure the share of active users with Super Admin access. Two Super Admins are always tolerated so a small team can keep a backup administrator.
- Rule ID
hubspot.check.users.super-admin-share.v1- Observed result
- 7 of 12 active users were Super Admins; two are always tolerated. Affected share 58% (7 of 12); result partial with pass ratio 0.037.
- Decision boundary
- Pass when no more than two users, or no more than 15% of users, are Super Admins; fail at 60% or more; partial in between.
- Structured proof
- 1 of 1 sources available; 1 finding, 32 point impact
Evidence references
Related findings
FailPrimary team coverage2 point deduction
Measure the share of active users without a primary team.
- Rule ID
hubspot.check.security.primary-team-coverage.v1- Observed result
- 4 of 12 active users lacked a primary team. Affected share 33% (4 of 12); result partial with pass ratio 0.8333.
- Decision boundary
- Pass when the share of users without a primary team is at or below 25%; fail at 75% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 2 point impact
Evidence references
Related findings
PassCustom role coverage
Count custom roles beside the portal user inventory.
- Rule ID
hubspot.check.governance.custom-roles.v1- Observed result
- 4 custom roles observed beside 12 users. Result pass.
- Decision boundary
- Not applicable below ten users. Fail when a portal with at least ten users has two or fewer custom roles; otherwise pass.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
PassTeam configuration
Count teams beside the portal user inventory.
- Rule ID
hubspot.check.governance.teams-configured.v1- Observed result
- 2 teams observed beside 12 users. Result pass.
- Decision boundary
- Not applicable below ten users. Fail when a portal with at least ten users has no teams; otherwise pass.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
PassDeactivated owners holding records
Compare hashed archived-owner references with the owners of the bounded CRM record samples.
- Rule ID
hubspot.check.users.archived-owner-records.v1- Observed result
- 0 of 50 sampled owned records were assigned to 0 archived owners. Affected share 0% (0 of 50); result pass.
- Decision boundary
- Pass when the share of sampled owned records assigned to an archived owner is at or below 2%; fail at 20% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 5 of 5 sources available; 0 findings, 0 point impact
PassAccount governance evidence
Record privacy-safe account and audit-context evidence separately from scored configuration findings.
- Rule ID
hubspot.check.governance.account-evidence.v1- Observed result
- The validated account-evidence source was available; this coverage-only check retains no account identifier or customer value. 1 source was read.
- Decision boundary
- This check is non-scored and reports only the availability of the registered governance evidence.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassCustom property limit pressure
Read the portal-wide custom-property usage percentage from the limits inventory.
- Rule ID
hubspot.check.crm-model.custom-property-limit-pressure.v1- Observed result
- Custom property usage was 42% of the HubSpot limit; result pass.
- Decision boundary
- Pass at or below 80% of the HubSpot limit; fail at 100%; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassAssociation relationship completeness
Average, across sampled association directions with at least 30 source records, the share of source records with no target association.
- Rule ID
hubspot.check.associations.relationship-completeness.v2- Observed result
- 2 association directions with 30 or more sampled records were evaluated; the mean missing-association share was 15%; result pass.
- Decision boundary
- Pass when the mean share of sampled records missing the association is at or below 20%; fail at 70% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 7 of 10 sources available; 1 finding, 0 point impact
Evidence references
Related findings
FailPrimary company association coverage5 point deduction
Measure sampled contacts with no primary company association, separately from any-company evidence.
- Rule ID
hubspot.check.associations.primary-company-coverage.v2- Observed result
- 20 of 40 sampled contacts had no primary company association. Affected share 50% (20 of 40); result partial with pass ratio 0.4.
- Decision boundary
- Pass when the share of sampled contacts without a primary company is at or below 20%; fail at 70% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 5 point impact
Evidence references
Related findings
FailStale-record share3 point deduction
Measure, for each core object with more than 100 records, the share of records not modified for three years, and score the worst object. Every object's figure is listed.
- Rule ID
hubspot.check.data-quality.stale-share.v2- Observed result
- Records not modified for three years, per core object: contacts 20000 of 50000; companies 0 of 1000; deals 0 of 800; tickets 0 of 300. Worst object contacts at 40%; result partial with pass ratio 0.8.
- Decision boundary
- Pass when the worst object's stale-record share is at or below 30%; fail at 80% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 8 of 8 sources available; 1 finding, 3 point impact
Evidence references
Related findings
PassCold-record share
Measure, for each core object with more than 200 records, the share of records not modified in the previous twelve months, and score the worst object. An object whose newest sample contradicts the count is excluded as a coverage limitation.
- Rule ID
hubspot.check.data-quality.recent-activity-share.v2- Observed result
- Records not modified in twelve months, per core object: contacts 30000 of 50000; companies 0 of 1000; deals 0 of 800; tickets 0 of 300. Worst object contacts at 60%; result pass.
- Decision boundary
- Pass when the worst object's cold-record share is at or below 80%; fail at 98% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 8 of 8 sources available; 0 findings, 0 point impact
FailRecord owner coverage3 point deduction
Measure, for contacts, companies and deals with records, the share of records with no owner, and score the worst object. Ticket ownership is assessed in the Service area.
- Rule ID
hubspot.check.data-quality.owner-coverage.v2- Observed result
- Records with no owner, per object: contacts 15000 of 50000; companies 0 of 1000; deals 0 of 800. Worst object contacts at 30%; result partial with pass ratio 0.8.
- Decision boundary
- Pass when the worst object's unowned-record share is at or below 20%; fail at 70% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 6 of 6 sources available; 1 finding, 3 point impact
Evidence references
Related findings
PassEmpty property groups
Join custom property groups to the property definitions of the same object and count groups that hold no property.
- Rule ID
hubspot.check.data-model.empty-property-groups.v1- Observed result
- 0 of 5 active property groups on the core objects held no property. Affected share 0% (0 of 5); result pass.
- Decision boundary
- Pass when the share of custom property groups that hold no property is at or below 10%; fail at 60% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 8 of 8 sources available; 0 findings, 0 point impact
FailUnused custom properties8 point deduction
Count, with CRM Search HAS_PROPERTY queries, how many records hold a value for each custom property on the core objects and on custom objects whose schema was collected, then join the result to the dependency graph. A property is unused when no record holds a value, or fewer than 0.5% of records and fewer than 5 do, and no known reference exists. Properties that were not measured (query caps, missing scope or provider limits) are excluded, never counted as zero.
- Rule ID
hubspot.check.data-model.unused-custom-properties.v1- Observed result
- 13 measured custom properties on contacts, companies, deals, tickets were joined to the dependency graph; 4 were unused (at most 4 records and under 0.5% of records hold a value, and no known reference). Affected share 31% (4 of 13); result partial with pass ratio 0.4808.
- Decision boundary
- Pass when the share of measured custom properties that are unused is at or below 10%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 8 of 8 sources available; 1 finding, 8 point impact
Evidence references
Related findings
PassReferenced custom properties with little or no data
List measured custom properties that meet the unused fill threshold but have a known reference from a detailed workflow, form or pipeline stage.
- Rule ID
hubspot.check.data-model.referenced-low-fill-properties.v1- Observed result
- 13 measured custom properties were checked; 1 holds little or no data but is referenced.
- Decision boundary
- This check is non-scored. A referenced property is never called unused, whatever its fill; the listing is a review signal for the referencing item.
- Structured proof
- 8 of 8 sources available; 1 finding, 0 point impact
Evidence references
Related findings
PassSensitive property review
Record aggregate sensitive and highly-sensitive property-definition counts without retaining property values or names.
- Rule ID
hubspot.check.crm-model.sensitive-property-review.v1- Observed result
- 12 of 12 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; one or more classified definitions produce a manual policy-review signal.
- Structured proof
- 12 of 12 sources available; 0 findings, 0 point impact
Evidence references
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
- CRM property configuration
PassProperty validation coverage review
Record aggregate property-validation coverage without inferring the business requirement for a property.
- Rule ID
hubspot.check.crm-model.validation-coverage-review.v1- Observed result
- 8 of 8 registered sources were available; 1 non-scored review signal was recorded with 0 score impact.
- Decision boundary
- This check is non-scored; one or more candidates without an observed validation produce a manual business-review signal.
- Structured proof
- 8 of 8 sources available; 1 finding, 0 point impact
Evidence references
Related findings
PassAssociation label adoption
Compare configured association-label schema evidence with bounded association usage evidence.
- Rule ID
hubspot.check.associations.label-adoption.v1- Observed result
- 10 of 10 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; unused-label review signals require both schema and usage evidence.
- Structured proof
- 10 of 10 sources available; 0 findings, 0 point impact
Evidence references
- Association labels (Companies tickets)
- Association labels (Contacts companies)
- Association sample (companies to deals)
- Association sample (contacts to companies)
- Association labels (Contacts deals)
- Association sample (contacts to deals)
- Association sample (tickets to contacts)
- Association labels (Companies deals)
- Association labels (Contacts tickets)
- Association sample (tickets to companies)
PassPipeline inventory size
Count deal and ticket pipeline definitions per object and name the pipelines.
- Rule ID
hubspot.check.pipelines.inventory-size.v2- Observed result
- Deal pipelines 1, ticket pipelines 0; the fixed limit is 15 per object. Result pass.
- Decision boundary
- Fail when one object has more than 15 pipelines; otherwise pass. The limit is fixed so portal size does not change the verdict.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
FailPipeline stage count6 point deduction
Measure the share of deal and ticket pipelines with more than 15 stages (SpotDev guidance, not a HubSpot limit).
- Rule ID
hubspot.check.pipelines.stage-count.v2- Observed result
- 1 of 1 pipeline in scope was affected. Affected share 100% (1 of 1); result fail.
- Decision boundary
- Pass when the share of pipelines above 15 stages is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 1 finding, 6 point impact
Evidence references
Related findings
PassTerminal stage probability
Measure the share of deal pipelines whose closed stages do not use probability 1 for won and 0 for lost.
- Rule ID
hubspot.check.pipelines.terminal-probability.v2- Observed result
- 0 of 1 pipeline in scope were affected. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of deal pipelines with terminal-probability defects is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassOpen-stage probability monotonicity
Measure the share of deal pipelines where a later open stage has a lower probability than an earlier one.
- Rule ID
hubspot.check.pipelines.probability-monotonicity.v2- Observed result
- 0 of 1 pipeline in scope were affected. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of deal pipelines with decreasing open-stage probability is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassDuplicate stage labels
Measure the share of pipelines with two or more active stages sharing a label.
- Rule ID
hubspot.check.pipelines.duplicate-stage-label.v2- Observed result
- 0 of 1 pipeline in scope were affected. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of pipelines with duplicate stage labels is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
PassEmpty stage labels
Measure the share of pipelines with an active stage whose label is empty.
- Rule ID
hubspot.check.pipelines.empty-stage-label.v2- Observed result
- 0 of 1 pipeline in scope were affected. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of pipelines with an empty stage label is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
FailInvalid stage order6 point deduction
Measure the share of pipelines with missing or duplicated display order among active stages.
- Rule ID
hubspot.check.pipelines.invalid-stage-order.v2- Observed result
- 1 of 1 pipeline in scope was affected. Affected share 100% (1 of 1); result fail.
- Decision boundary
- Pass when the share of pipelines with an ambiguous stage order is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 1 finding, 6 point impact
Evidence references
Related findings
PassArchived stage clutter
Measure the share of pipelines that retain three or more archived stages.
- Rule ID
hubspot.check.pipelines.archived-stage-clutter.v2- Observed result
- 0 of 1 pipeline in scope were affected. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of pipelines with archived-stage clutter is at or below 25%; fail at 100% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
FailStuck-deal sample9 point deduction
Measure open deals unchanged for more than 180 days in the bounded deal sample at the immutable audit timestamp.
- Rule ID
hubspot.check.pipelines.stuck-deal-sample.v2- Observed result
- 3 of 10 assessable sampled deals were open and unchanged for more than 180 days. Affected share 30% (3 of 10); result partial with pass ratio 0.5.
- Decision boundary
- Pass when the share of assessable sampled deals that are open and unchanged for 180 days is at or below 10%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 9 point impact
Evidence references
Related findings
FailEmpty stage sample6 point deduction
Join the bounded deal sample to pipeline stages and measure the share of sampled pipelines where a quarter or more of active stages hold no sampled deal.
- Rule ID
hubspot.check.pipelines.empty-stage-sample.v2- Observed result
- 1 of 1 sampled deal pipeline had a quarter or more of active stages empty in the sample. Affected share 100% (1 of 1); result fail.
- Decision boundary
- Pass when the share of sampled deal pipelines with many unused stages is at or below 0%; fail at 100% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 1 finding, 6 point impact
Evidence references
Related findings
PassDeal pipelines with no deals
Measure the share of deal pipelines with no deal in either the newest or the oldest bounded deal sample, and classify each for clean-up.
- Rule ID
hubspot.check.pipelines.empty-pipelines.v1- Observed result
- 0 of 1 deal pipeline had no deal in either bounded deal sample. Affected share 0% (0 of 1); result pass.
- Decision boundary
- Pass when the share of deal pipelines with no sampled deal is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 3 of 3 sources available; 0 findings, 0 point impact
PassRequired-stage enforcement review
Emit a non-scored manual verification card because the public pipeline read contract does not expose conditional required-stage properties.
- Rule ID
hubspot.check.pipelines.required-stage-enforcement.v1- Observed result
- 1 of 1 registered sources were available; 1 non-scored review signal was recorded with 0 score impact.
- Decision boundary
- This check is non-scored and never claims automated verification of required-stage enforcement.
- Structured proof
- 1 of 1 sources available; 1 finding, 0 point impact
Evidence references
Related findings
PassObserved sales cohort health
Calculate 30, 90 and 365 day deal cohorts and direct open-stale counts.
- Rule ID
hubspot.check.sales-performance.cohort-health.v1- Observed result
- 13 of 13 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; observed performance is kept separate from pipeline configuration.
- Structured proof
- 13 of 13 sources available; 0 findings, 0 point impact
Evidence references
- CRM deal cohort won 90d
- CRM deal cohort created 365d
- CRM deal cohort won 365d
- CRM deal cohort lost 30d
- CRM deal cohort open 365d
- CRM deal cohort won 30d
- CRM deal cohort lost 90d
- CRM deal cohort open 30d
- CRM deal cohort created 30d
- CRM deal cohort open 90d
- CRM deal cohort open stale 180d
- CRM deal cohort created 90d
- CRM deal cohort lost 365d
PassDeal amount currency basis
Inspect the bounded deal sample for amount completeness and mixed-currency risk.
- Rule ID
hubspot.check.sales-performance.currency-basis.v1- Observed result
- 1 of 1 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored and never sums mixed currencies without an explicit common-currency basis.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassEnabled workflow count
Count enabled workflows in the bounded workflow inventory and name them.
- Rule ID
hubspot.check.automation.enabled-workflow-count.v3- Observed result
- 6 enabled workflows observed; the review threshold is 400 and size alone is not scored.
- Decision boundary
- This check is non-scored. A large workflow estate is reported for review above 400 enabled workflows, because size alone is not a defect.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
FailStale enabled workflows11 point deduction
Measure the share of enabled workflows whose last edit is more than twelve months before the audit timestamp. This is not execution-history evidence.
- Rule ID
hubspot.check.automation.stale-enabled-workflows.v3- Observed result
- 6 of 6 enabled workflows with an edit timestamp had not been edited for twelve months. Affected share 100% (6 of 6); result fail.
- Decision boundary
- Pass when the share of enabled workflows not edited for twelve months is at or below 25%; fail at 75% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 11 point impact
Evidence references
Related findings
PassBroad workflow enrolment
Measure the share of detailed enabled workflows whose enrolment criteria look broadly inclusive.
- Rule ID
hubspot.check.automation.broad-enrollment.v2- Observed result
- 0 of 6 detailed enabled workflows were affected. Affected share 0% (0 of 6); result pass.
- Decision boundary
- Pass when the share of detailed workflows with broad enrolment is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassDead-end workflow paths
Measure the share of detailed enabled workflows with a branch or action edge that does not resolve to a known next action.
- Rule ID
hubspot.check.automation.dead-end-branch.v2- Observed result
- 0 of 6 detailed enabled workflows were affected. Affected share 0% (0 of 6); result pass.
- Decision boundary
- Pass when the share of detailed workflows with a dead-end path is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassOverlapping property writes
Measure the share of detailed enabled workflows that write a non-lifecycle property another detailed workflow also writes.
- Rule ID
hubspot.check.automation.overlapping-property-writes.v2- Observed result
- 0 of 6 detailed enabled workflows were affected. Affected share 0% (0 of 6); result pass.
- Decision boundary
- Pass when the share of detailed workflows involved in overlapping writes is at or below 10%; fail at 60% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassLifecycle write overlap
Measure the share of detailed enabled workflows that write a lifecycle or stage property another detailed workflow also writes.
- Rule ID
hubspot.check.automation.lifecycle-regression-risk.v2- Observed result
- 0 of 6 detailed enabled workflows were affected. Affected share 0% (0 of 6); result pass.
- Decision boundary
- Pass when the share of detailed workflows involved in lifecycle write overlap is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassUnsupported workflow actions
Classify unsupported or custom action types as manual verification rather than failures.
- Rule ID
hubspot.check.automation.unsupported-action.v1- Observed result
- 1 of 1 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; unsupported actions cause abstention.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassCustom-coded workflow actions
List detailed workflows with custom-coded actions, with the runtime, the number of secrets referenced by name and the external hosts called. The code body is never read.
- Rule ID
hubspot.check.automation.custom-code-review.v1- Observed result
- 0 custom-coded actions were found in the detailed workflows.
- Decision boundary
- This check is non-scored; custom code is reported for developer review because its behaviour cannot be verified from configuration.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
FailForm field hygiene7 point deduction
Measure the share of forms with no configured fields.
- Rule ID
hubspot.check.forms.field-hygiene.v2- Observed result
- 1 of 6 forms had no configured fields. Affected share 17% (1 of 6); result partial with pass ratio 0.8333.
- Decision boundary
- Pass when the share of forms with no fields is at or below 10%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 7 point impact
Evidence references
Related findings
PassForm field property mapping
Compare each contact and company form field with the property definitions of its object, and measure the share of forms with a field that maps to no known property.
- Rule ID
hubspot.check.forms.property-mapping.v1- Observed result
- 0 of 5 forms with contact or company fields had a field mapped to no known property. Affected share 0% (0 of 5); result pass.
- Decision boundary
- Pass when the share of forms with an unmapped field is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 7 of 7 sources available; 0 findings, 0 point impact
PassSubscription types
Count active communication subscription definitions.
- Rule ID
hubspot.check.forms.subscription-types.v1- Observed result
- 3 active subscription types observed. Result pass.
- Decision boundary
- Fail when one or no active subscription type exists, because contacts can then only opt out of everything; otherwise pass.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassMarketing forms coverage
Record validated marketing form capability coverage without inferring campaign performance.
- Rule ID
hubspot.check.marketing.forms-coverage.v1- Observed result
- 1 of 1 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored and is unavailable when the product or approved grant does not expose the source.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
FailCampaign configuration ownership31 point deduction
Measure the share of campaigns with no owner. Attribution counters remain non-scored associative evidence.
- Rule ID
hubspot.check.marketing.campaign-ownership.v2- Observed result
- 2 of 6 campaigns had no owner. Affected share 33% (2 of 6); result partial with pass ratio 0.5333.
- Decision boundary
- Pass when the share of campaigns with no owner is at or below 10%; fail at 60% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 31 of 31 sources available; 1 finding, 31 point impact
Evidence references
- Marketing campaign metrics synthetic-campaign-4
- Marketing campaign metrics synthetic-campaign-3
- Marketing campaign assets synthetic-campaign-3 site page
- Marketing campaign assets synthetic-campaign-3 form
- Marketing campaign assets synthetic-campaign-5 marketing email
- Marketing campaign metrics synthetic-campaign-5
- Marketing campaign assets synthetic-campaign-5 site page
- Marketing campaign assets synthetic-campaign-1 form
- Marketing campaign metrics synthetic-campaign-2
- Marketing campaign assets synthetic-campaign-4 form
- Marketing campaign metrics synthetic-campaign-6
- Marketing campaign assets synthetic-campaign-5 landing page
- Marketing campaign assets synthetic-campaign-1 marketing email
- Marketing campaign assets synthetic-campaign-6 landing page
- Marketing campaign assets synthetic-campaign-6 site page
- Marketing campaign assets synthetic-campaign-6 form
- Marketing campaign assets synthetic-campaign-1 site page
- Marketing campaign assets synthetic-campaign-2 marketing email
- Marketing campaign metrics synthetic-campaign-1
- Marketing campaign assets synthetic-campaign-6 marketing email
- Marketing campaign assets synthetic-campaign-3 marketing email
- Marketing campaign assets synthetic-campaign-3 landing page
- Marketing campaigns
- Marketing campaign assets synthetic-campaign-1 landing page
- Marketing campaign assets synthetic-campaign-4 marketing email
- Marketing campaign assets synthetic-campaign-2 form
- Marketing campaign assets synthetic-campaign-5 form
- Marketing campaign assets synthetic-campaign-2 landing page
- Marketing campaign assets synthetic-campaign-4 site page
- Marketing campaign assets synthetic-campaign-2 site page
- Marketing campaign assets synthetic-campaign-4 landing page
Related findings
PassMarketing email drafts
Measure the share of marketing emails left in the draft state.
- Rule ID
hubspot.check.marketing.email-drafts.v1- Observed result
- 1 of 5 marketing emails were drafts. Affected share 20% (1 of 5); result pass.
- Decision boundary
- Pass when the share of marketing emails in draft is at or below 40%; fail at 90% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassTicket owner coverage
Compare the complete ticket count with the complete unowned-ticket count.
- Rule ID
hubspot.check.service.ticket-ownership.v1- Observed result
- 0 of 300 tickets had no owner. Affected share 0% (0 of 300); result pass.
- Decision boundary
- Pass when the share of tickets with no owner is at or below 20%; fail at 70% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 2 of 2 sources available; 0 findings, 0 point impact
Evidence references
PassService performance
Measure bounded conversation-thread metadata and ticket backlog evidence without message bodies.
- Rule ID
hubspot.check.service.performance.v1- Observed result
- 3 of 4 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; unused or unavailable service features are treated as not applicable.
- Structured proof
- 3 of 4 sources available; 0 findings, 0 point impact
FailCMS transport security60 point deduction
Measure the share of connected domains whose configuration reports HTTPS disabled.
- Rule ID
hubspot.check.cms.transport-security.v2- Observed result
- 1 of 1 connected domains reported HTTPS disabled. Affected share 100% (1 of 1); result fail.
- Decision boundary
- Pass when the share of connected domains without HTTPS is at or below 0%; fail at 50% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 1 finding, 60 point impact
Evidence references
Related findings
PassSite-page metadata coverage
Measure the share of sampled site pages without a meta description.
- Rule ID
hubspot.check.cms.site-page-metadata.v2- Observed result
- 0 of 5 sampled site pages matched the condition. Affected share 0% (0 of 5); result pass.
- Decision boundary
- Pass when the share of site pages without a meta description is at or below 10%; fail at 60% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassLanding-page draft share
Measure the share of sampled landing pages in the draft state.
- Rule ID
hubspot.check.cms.landing-page-draft-share.v2- Observed result
- 2 of 5 sampled landing pages matched the condition. Affected share 40% (2 of 5); result pass.
- Decision boundary
- Pass when the share of landing pages in draft is at or below 40%; fail at 90% or more; partial in between, with the pass ratio falling linearly.
- Structured proof
- 1 of 1 sources available; 0 findings, 0 point impact
Evidence references
PassCMS governance and redirects
Separate published, draft, scheduled and archived content, aggregate CMS change history by pseudonymous actor and analyse redirect chains and loops.
- Rule ID
hubspot.check.cms.governance-redirects.v1- Observed result
- 5 of 5 registered sources were available; 0 non-scored review signals were recorded with 0 score impact.
- Decision boundary
- This check is non-scored; body content and author identity are not retained.
- Structured proof
- 5 of 5 sources available; 0 findings, 0 point impact
Source proof
These records identify the bounded source used by each completed check. They contain labels and non-identifying page roles, not raw customer payloads. Sources that could not be collected are omitted.
- Account governance detailsAvailable
- Association sample (companies to deals)Available
- Association sample (contacts to companies)Available
- Association sample (contacts to deals)Available
- Association sample (deals to companies)Available
- Association sample (deals to contacts)Available
- Association sample (tickets to companies)Available
- Association sample (tickets to contacts)Available
- Association labels (Companies deals)Available
- Association labels (Companies tickets)Available
- Association labels (Contacts companies)Available
- Association labels (Contacts deals)Available
- Association labels (Contacts tickets)Available
- Automation workflow detailsAvailable
- Workflow automationAvailable
- CMS configurationAvailable
- CMS configurationAvailable
- CMS configurationAvailable
- CMS configurationAvailable
- CMS configurationAvailable
- CMS configurationAvailable
- Communication subscription typesAvailable
- CRM deal cohort created 30dAvailable
- CRM deal cohort created 365dAvailable
- CRM deal cohort created 90dAvailable
- CRM deal cohort lost 30dAvailable
- CRM deal cohort lost 365dAvailable
- CRM deal cohort lost 90dAvailable
- CRM deal cohort open 30dAvailable
- CRM deal cohort open 365dAvailable
- CRM deal cohort open 90dAvailable
- CRM deal cohort open stale 180dAvailable
- CRM deal cohort won 30dAvailable
- CRM deal cohort won 365dAvailable
- CRM deal cohort won 90dAvailable
- CRM owner records (Archived)Available
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property configurationAvailable
- CRM property fill counts (Companies)Available
- CRM property fill counts (Contacts)Available
- CRM property fill counts (Deals)Available
- CRM property fill counts (Tickets)Available
- CRM property groupsAvailable
- CRM property groupsAvailable
- CRM property groupsAvailable
- CRM property groupsAvailable
- CRM recent-activity share (Companies)Available
- CRM recent-activity share (Contacts)Available
- CRM recent-activity share (Deals)Available
- CRM recent-activity share (Tickets)Available
- CRM record sample (Companies)Available
- CRM record sample (Contacts)Available
- CRM record sample (Deals)Available
- CRM record sample (Tickets)Available
- CRM oldest-records sample (Deals)Available
- CRM record counts (Companies)Available
- CRM record counts (Contacts)Available
- CRM record counts (Deals)Available
- CRM record counts (Tickets)Available
- CRM stale-record share (Companies)Available
- CRM stale-record share (Contacts)Available
- CRM stale-record share (Deals)Available
- CRM stale-record share (Tickets)Available
- CRM record ownership (Companies)Available
- CRM record ownership (Contacts)Available
- CRM record ownership (Deals)Available
- CRM record ownership (Tickets)Available
- CRM property validationAvailable
- CRM property validationAvailable
- CRM property validationAvailable
- CRM property validationAvailable
- File manager configurationAvailable
- Custom property limit usageAvailable
- Marketing campaign assets synthetic-campaign-1 formAvailable
- Marketing campaign assets synthetic-campaign-1 landing pageAvailable
- Marketing campaign assets synthetic-campaign-1 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-1 site pageAvailable
- Marketing campaign assets synthetic-campaign-2 formAvailable
- Marketing campaign assets synthetic-campaign-2 landing pageAvailable
- Marketing campaign assets synthetic-campaign-2 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-2 site pageAvailable
- Marketing campaign assets synthetic-campaign-3 formAvailable
- Marketing campaign assets synthetic-campaign-3 landing pageAvailable
- Marketing campaign assets synthetic-campaign-3 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-3 site pageAvailable
- Marketing campaign assets synthetic-campaign-4 formAvailable
- Marketing campaign assets synthetic-campaign-4 landing pageAvailable
- Marketing campaign assets synthetic-campaign-4 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-4 site pageAvailable
- Marketing campaign assets synthetic-campaign-5 formAvailable
- Marketing campaign assets synthetic-campaign-5 landing pageAvailable
- Marketing campaign assets synthetic-campaign-5 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-5 site pageAvailable
- Marketing campaign assets synthetic-campaign-6 formAvailable
- Marketing campaign assets synthetic-campaign-6 landing pageAvailable
- Marketing campaign assets synthetic-campaign-6 marketing emailAvailable
- Marketing campaign assets synthetic-campaign-6 site pageAvailable
- Marketing campaign metrics synthetic-campaign-1Available
- Marketing campaign metrics synthetic-campaign-2Available
- Marketing campaign metrics synthetic-campaign-3Available
- Marketing campaign metrics synthetic-campaign-4Available
- Marketing campaign metrics synthetic-campaign-5Available
- Marketing campaign metrics synthetic-campaign-6Available
- Marketing campaignsAvailable
- Marketing emailsAvailable
- Marketing formsAvailable
- Sales/service pipeline configurationAvailable
- Sales/service pipeline configurationAvailable
- Custom user rolesAvailable
- Team structureAvailable
- User and team settingsAvailable
Coverage
What was checked, what wasn't
An honest read on how complete this run was. Only categories with applicable, validated evidence are assessed. An optional capability without a confirmed grant is excluded, not treated as a pass or a customer defect. Independent checks inside a category still score when their own evidence is valid.
121 of 148 produced a result 27 not applicable 0 could not be run 0 errored
Data model and data quality53/56 checked, 3 not applicable (53 checked, 3 optional scope not granted)
Users, permissions and security5/7 checked, 2 not applicable (5 checked, 2 not available for this product)
Pipelines and process15/26 checked, 11 not applicable (15 checked, 11 optional scope not granted)
Automation2/2 checked (2 checked)
Forms and segmentation2/2 checked (2 checked)
Marketing assets32/41 checked, 9 not applicable (32 checked, 9 optional scope not granted)
Service5/7 checked, 2 not applicable (5 checked, 2 optional scope not granted)
CMS and website7/7 checked (7 checked)
Deepen this audit
13 requested audit grants were not approved, so some checks could not run. Reconnect the portal and approve these grants to widen coverage:
business-intelligenceconversations.readcrm.objects.commercepayments.readcrm.objects.feedback_submissions.readcrm.objects.goals.readcrm.objects.invoices.readcrm.objects.leads.readcrm.objects.line_items.readcrm.objects.marketing_events.readcrm.objects.orders.readcrm.objects.products.readcrm.objects.quotes.readcrm.objects.subscriptions.read
Reconnect HubSpot portal →Governance evidence
Security, ownership and property controls
These are observed, non-scored review facts. Security events are not proof of compromise, and a missing property validation is not a defect until its business requirement is known.
Security activity
- Login activity: not applicable for this portal
- Security activity: not applicable for this portal
Archived ownership
0 sampled records are assigned to 0 archived owners. This is a bounded sample, not a portal-wide count.
Property governance
Contacts6 ordinary, 0 sensitive, 0 highly sensitive; 0/1 validation candidates covered; 1 need business context; 0 unique-value properties
Companies3 ordinary, 0 sensitive, 0 highly sensitive; 0/0 validation candidates covered; 0 need business context; 0 unique-value properties
Deals3 ordinary, 0 sensitive, 0 highly sensitive; 0/0 validation candidates covered; 0 need business context; 0 unique-value properties
Tickets2 ordinary, 0 sensitive, 0 highly sensitive; 0/0 validation candidates covered; 0 need business context; 0 unique-value properties
Validation rules, sensitivity classifications and unique-value settings are separate facts. Uniqueness does not prove access control, encryption or protection.
HubSpot performance evidence
Campaigns, analytics, events, commerce and CMS governance
These are observed, non-scored facts. Attribution is associative, behavioural evidence is aggregate only, and inactive commerce or CMS features are treated as not applicable.
Campaigns6 inventoried; 6 sampled for metrics; owner gaps 33%; 0 sessions and 0 influenced contacts; revenue scope not approved or unavailable
Behavioural events0 allowlisted occurrences across 0 event types; 0 common path hypotheses. Raw contact IDs, unsafe URLs and individual sequences are not persisted.
HubSpot analyticsnot applicable; 90-day visits insufficient evidence; contacts insufficient evidence; legacy Analytics v2 disclosed
Marketing events0 events; 0 registrations; 0 attended; no-show rate insufficient evidence. Participant identities are not retained.
Commercenot applicable; 0 activated object families (none); currency basis unknown; no accounting advice.
CMS governance3 published and 2 draft assets; 0 pseudonymous audit events; 0 redirect chains and 0 loops; page bodies are not collected.
Ask SpotDev for help
SpotDev built SpotCheck. If you would like help with anything in this report, you can book a call or send the team a message. This is optional and does not change your report.