What We Actually Check in a HubSpot Portal Audit

The portals we get asked to audit break in the same four places. Lead routing that stopped working when somebody changed a team. Duplicate records that make every report slightly wrong. A chain of workflows built by a contractor who left and documented nothing. And seats: current staff, former staff, an agency, two integrations, and nobody quite sure who can export the contact database.

That is what an audit finds in a business that went from 20 people to 150 and never stopped to check. Below is the order we work in, and why the order matters more than the checklist.

1. Users, seats and permissions

We start here because it is the check with a legal edge, and because it tells you who has been touching everything else.

Open the user list and read it as a list of people rather than a list of licences. Who has left. Who changed roles and kept their old access. Which agency or contractor still has a seat. Who can export contacts, and whether that matches anything you would sign off today. HubSpot's user permissions guide is the reference for what each toggle actually controls.

Then the part people skip. Under the OAIC's Notifiable Data Breaches scheme, a data breach is personal information "lost or subjected to unauthorised access or disclosure", and you have to notify both the affected individuals and the OAIC when a breach is "likely to result in serious harm to an individual". The notice to individuals has to include recommendations about the steps they should take.

An ex-employee's still-active seat, sitting on a database of customer names, phone numbers and notes, is unauthorised access waiting to be described that way. Whether it reaches the serious harm test is a judgement you would rather not be making after the fact, with a lawyer, about an account you could have closed. Same for the agency seat nobody cancelled when the contract ended.

2. Integrations and connected apps

Every connected app is another door into the same database, usually opened by somebody who has since moved on.

List what is connected. For each one: who set it up, what it reads, what it writes back, and whether the tool at the other end is still in use. A sync that has been failing for months is a data problem. A sync that still works perfectly, into a tool nobody opens, on a login shared by four people, is the other kind of problem.

If a contractor built custom work, code in a workflow, a template, an integration, read the contract while you are in here. IP Australia is blunt about the default: "IP created by a contractor is the property of the contractor unless otherwise stated in the contract". Plenty of portals run on custom work the business does not own.

If your automation is spread across HubSpot and a pile of other tools, our guide to integrating marketing automation tools covers how to think about the joins.

3. The contact and company database

This is the asset the rest of the portal exists to serve.

Duplicates first: find them, merge them, then work out what created them, because a merge without that is a chore you will repeat next quarter. Usually it is a form writing to a property that does not match, an import run twice, or two teams entering the same customer under different names.

Then associations. A contact with no company, a company with no owner, a deal attached to neither: each one is a record that drops out of a report without telling you.

Then email validity. HubSpot already blocks hard bounced contacts from future sends to protect your sender reputation, so the work here is understanding the pattern rather than chasing individual addresses. If a list bounces heavily, ask where it came from. HubSpot's explanation of the difference between a hard bounce and a soft bounce is worth reading before you delete anything.

Keep a static list of bounced contacts if you want the history, and an active list if you want the current state. Both, ideally.

4. Properties

We have opened portals holding anywhere from 200 to 1,000 custom properties. Almost none of them ever get removed, because nobody is sure what reads them.

The audit question for each property is who writes it, who reads it, and when either last happened. A property nothing writes to is a form field somebody deleted. A property nothing reads is a question you are still asking customers for no reason.

Two things to know before you start tidying:

• An archived property is stored for 90 days, then permanently deleted.
• A property can only be archived if it is not used elsewhere in your portal, which doubles as a way of finding out what depends on it.

Group whatever survives. HubSpot's guide to organising and exporting properties has the mechanics.

The habit that causes the sprawl is worth naming out loud. Somebody builds a form, needs a field, and creates a new custom property instead of checking for the one that already exists. Now two properties hold the same answer, workflows read one of them, and two reports disagree. Check your existing properties before you make a new one. Progressive fields help as well, since they ask for what you do not have yet instead of asking for everything again.

5. Lifecycle stages, ownership and routing

This is where "the leads are not getting to anyone" usually resolves.

Check what sets Lifecycle stage, and whether more than one thing sets it. Check the default lifecycle stage for newly created records. Check whether stages move backwards anywhere, because something normally does.

Then ownership. Turning on your sync ownership settings and the "Assign company owner to contact by default" checkbox makes contact owner follow company owner, which keeps notifications, reports and personalised sends pointed at the right person. Then read the routing itself: who gets a new lead, what happens when they are on leave, what happens at 6pm on a Friday.

Scoring gets audited last in this section, and with one question: does anybody do anything differently because of the score. If not, the score is decoration, and the fix is either a routing rule that uses it or removing it. A score built on behaviour from three years ago, when the product and the market were different, is worse than no score, because people trust it.

6. Workflows and the rest of the automation

Print the list of active workflows and find the ones nobody can explain. There are always some.

For each active workflow: what enrols a record, what happens if it re-enrols, does every branch still have somewhere to go, and does any step point at a property, page or link that no longer exists. The internal notification steps are worth a second look, since those are the ones people mute and then stop noticing.

The chains built by somebody who has left are the slow part. Do not switch them off on sight. Turn nothing off until you can name what enrols records into it and what breaks downstream, then unwind from the far end.

If your problem is that the automation exists and nobody uses it, that is a different job: auditing whether your team is actually using the automation you have built.

7. Marketing email and consent

Deliverability is the visible half of this check. Consent is the half that matters more.

Under the Spam Act 2003, express consent means the person knows and accepts that they will get marketing from you. Inferred consent is narrower than most lists assume: it applies where somebody knowingly and directly gave you the address and it is reasonable to believe they would expect marketing, usually a provable ongoing relationship with the marketing directly related to it. Every commercial message needs an unsubscribe option that does not require extra personal information, a login or an account. The message has to identify the business that authorised it, by correct legal name, or name and ABN, even when somebody else sends it. And the burden of proving consent sits with the sender.

So the audit question for every marketing list is where the addresses came from, and whether you can show it. An imported spreadsheet of unknown origin is the finding, whatever its bounce rate looks like.

8. Forms, pages and the website side

Test the forms yourself, on a phone, as a stranger would. Submit them. Watch where the record arrives in the CRM and which properties fill in. That finds more than reading the form editor does.

For each live form: does it write to properties that exist and are used, does the follow-up still fire, and does the thank you page still exist. A form pointed at a deleted property fails silently, which is the worst way for a form to fail.

Landing pages are easy to set and forget. A page built for a campaign three years ago is often still collecting submissions into a workflow nobody owns.

So read each one as a stranger. Does the headline still describe what you sell. Is the hero image still true. Is the offer still available. Then pull page views, click through rate, conversion rate and bounce rate for the set and compare them against your own previous period rather than a benchmark you found online.

9. Conversations and chatflows

Read the last fortnight of chat transcripts. That is the audit. You will find the questions your bot cannot answer, the point where people give up, and whether anything reaches a human.

Then check that the responses sound like your business, that the bot works on a phone and in whatever browsers your customers actually use, and that there is a path to a person for anything complicated. If you are not running one yet, HubSpot has a guide to setting up a bot from scratch.

10. Reporting, last

Reporting goes last because every report sits on top of the nine checks above. Fix a report while the data underneath it is wrong and all you have done is hide the problem.

Then ask: which dashboards does anybody open, which reports get rebuilt by hand in a spreadsheet every month, and does the pipeline number in HubSpot match the number your leadership team uses. If it does not, that gap is the most valuable finding in the whole audit. Forecast data has its own method, covered in auditing your data for forecast accuracy.

What to do with the findings

An audit produces more work than anybody can do at once, so sort it before you start.

Anything with a privacy or consent exposure goes first: seats, integrations, list provenance. Then anything losing leads right now, which is routing and forms. Then data quality, because that one is slow and ongoing. Then reporting, once the numbers underneath it are true.

Work in that order and the second pass is much shorter. Work in the opposite order and you will rebuild the same reports twice.

The longer walkthrough, with each check written out step by step, is in our full guide to conducting a portal audit. If you would rather somebody else opened the drawers, Neighbourhood runs a free portal audit that goes through each Hub and what to do about it, and the rest of our RevOps and HubSpot work is here.