Who Can See the Files in Your HubSpot Portal? Most Admins Don't Know

A file you upload to HubSpot's File Manager is public by default. Not restricted to your team, not private until you say otherwise: public, indexable by Google, reachable by anyone with the link, unless you go in and change it.

That default is harmless for a logo. It stops being harmless the day someone drags a signed contract, a completed health form, or a client's ID into the same folder and nobody thinks to check the visibility setting first. This guide covers everything the File Manager actually does, but the reason to read it properly rather than skim it is the part above: knowing who can see what you've uploaded, and being able to prove you checked.

What HubSpot's File Manager actually is

The File Manager is HubSpot's central place for the files, images and documents you use across the platform: emails, landing pages, blog posts, deal and ticket attachments. Upload once and it's available anywhere in HubSpot that accepts a file.

Every file is served through HubSpot's own content delivery network, so it loads quickly wherever your audience is. What the File Manager does not do is sync with an external drive: there's no direct connection to SharePoint or Google Drive, so anything living there has to be uploaded manually, or moved through the Files API if you're automating it.

Why this is a Privacy Act question as well as a tidiness one

Files attached to a deal or a support ticket are routinely personal information: a contract with someone's name and address on it, a form with health details, a scanned licence. Under the Privacy Act 1988 (Cth), specifically Australian Privacy Principle 11, you must take reasonable steps to protect the personal information you hold from misuse and unauthorised access. A folder in your File Manager set to public, holding files like that, is a real APP 11 exposure. It is not a hypothetical one, and it is not solved by the fact that nobody has gone looking yet.

If a folder like that is found, the Notifiable Data Breaches scheme is what happens next: you notify the affected individuals and the OAIC once the exposure is likely to result in serious harm, and that notification has to tell people what to do about it. Checking your file visibility settings is a smaller job than any of that.

The three visibility settings, and what they actually mean

Every file in HubSpot carries one of three settings, editable individually or in bulk from the File Details Panel.

Setting	Who can see it	Indexed by search engines	Use it for
Public	Anyone with the link	Yes	Logos, brochures, anything meant to be found
Public, no index	Anyone with the link	No	Files you link to directly but don't want turning up in a search
Private	Signed-in users on your HubSpot account, or an external person you send a temporary 24-hour share link to	No	Contracts, IDs, health forms, anything that's personal information

The technical name for the first setting is PUBLIC_INDEXABLE, which is a fair description: it makes a file available to anyone with the URL and lets search engines list it. Controlling that setting is the same job as controlling what an AI crawler can read on your public site, which we've written about separately in does your business need an llms.txt file.

Where to check and change it

Go to Marketing > Files and Templates > Files. Select one or more files with the checkboxes, open the visibility dropdown in the right-hand panel, and choose Public, Public - no index, or Private. Bulk selection means you can fix a whole folder in one pass rather than file by file.

If you've connected your own domain, you can also change where files are served from: under Content > Pages, the File URL by domain dropdown lets you point new uploads at your domain instead of HubSpot's default CDN address. Existing files keep their old links either way, so changing this setting doesn't break anything already published.

Auditing what's already public

The useful exercise, and the one most portals have never done, is going through what's already there rather than only fixing new uploads. Pull up your largest folders and ask two questions of each file: does this contain a real person's information, and is it set to Public or Public - no index. Anything that answers yes to the first and Public to the second gets moved to Private on the spot.

Deal and ticket attachments are the highest-risk category, since they're the ones most likely to hold a contract, an ID, or a form filled in by a client. If a workflow is the thing setting a property or a file's visibility automatically and you need to unwind a change it made, see how to undo a mistake in a HubSpot workflow. And if this audit is your first real look at your portal's data hygiene, the CRM side of the same problem is covered in keeping your operations pipeline data clean.

Organising files so the audit doesn't take a day

A clear structure makes the audit above quick instead of painful. A few habits worth keeping:

• Name files so a human can tell what they are. Something like blogpost-title-date-image1.jpg beats a phone's default filename, and it helps your public-facing pages too, since descriptive names carry more weight for search than a string of numbers.
• Tag and categorise by what the file is for, campaign, content type, or department, so a team member can find it without asking around.
• Replace files rather than re-uploading them where you can. HubSpot keeps the same URL when you replace a file, so existing links don't break. The one thing to know: a replaced file can take up to two hours to update everywhere it's cached, so don't panic if the old version is still showing up minutes after you've swapped it.
• Move files between folders freely. It doesn't change the file's URL, so reorganising a messy folder structure later doesn't create broken links.

Automation, analytics, and mobile access

The Files API lets you upload and manage files programmatically, useful for anything repetitive, like a rebrand that touches hundreds of assets at once. Third-party tools including CloudFiles, alongside HubSpot Documents and DocSend, add file-level analytics, who opened what and when, which the native File Manager doesn't track on its own.

The File Manager is also available from the HubSpot mobile app, under the Marketing menu, drawing on the same CDN as the desktop version. The visibility settings carry across both, so a file made Private on desktop stays Private on a phone.

The bottom line

HubSpot's File Manager is a genuinely capable tool: a fast CDN, a documented API, bulk visibility controls, and a straightforward way to keep files organised across a growing team. None of that is the risk.

The risk is the default. Every file starts public, and most people never go back and check. Run the audit above once, set a habit of checking visibility on anything that touches a client, and you've closed the gap between what HubSpot ships and what your business actually needs.

Want a second pair of eyes on how your portal's data and files are actually set up? Our RevOps and HubSpot team can take a look. Get in touch.