Parent Company
HubSpot, Inc. (US)
CLOUD Act Status
✗ Exposed
Canadian Data Residency
✓ Montreal (AWS)
Encryption
⚠ Vendor-Managed
TIA / PIA Required
Recommended
Canadian Alternative
✓ Available

Is HubSpot CLOUD Act compliant for Canadian organizations?

Not fully. HubSpot is a US-incorporated company (Delaware) and is subject to the CLOUD Act. Under this law, US authorities can compel HubSpot to produce any data in its possession — including data hosted in the Montreal data centre. Canadian data residency does not remove CLOUD Act jurisdiction.

However, HubSpot's case is more nuanced than tools like Dropbox or Slack. Since February 2025, HubSpot has offered a Montreal data centre, giving Canadian organizations the option to keep CRM data physically within Canada. This satisfies some regulatory expectations around data residency — but it does not change who controls the data or which laws apply to the company holding it.

The core tension: your data is in Canada, but the company holding the keys is American. For many organizations, this is an acceptable trade-off with proper documentation. For others — particularly those in healthcare, legal, or government — it may not be.

Regulatory Analysis

▾

CLOUD Act exposure

The Clarifying Lawful Overseas Use of Data Act (2018) requires US companies to produce data in response to valid US legal process, regardless of where that data is physically stored. HubSpot, as a Delaware-incorporated company headquartered in Cambridge, Massachusetts, is squarely within scope. The Montreal data centre does not change this — Canadian residency addresses where data sits, not who can be compelled to produce it.

🍁
Your Canadian CRM Data
Contacts, deals, emails
under PIPEDA / Law 25
🏢
HubSpot, Inc.
Delaware, USA
Montreal DC · Vendor keys
⚖️
US Legal Process
CLOUD Act · Subpoena
Data access possible

Quebec Law 25

For organizations hosting HubSpot data in the Montreal data centre, CRM data may remain within Quebec, potentially reducing the scope of Transfer Impact Assessment requirements for intra-Quebec processing. However, a TIA is still recommended because HubSpot's US parent remains subject to the CLOUD Act, and some processing may occur outside Canada for backup, disaster recovery, and AI features. Penalties for non-compliance can reach $25 million or 4% of worldwide turnover. Upper Harbour provides compliance-ready TIA documentation starting at $99.

BC FIPPA

BC public bodies using HubSpot should complete a Privacy Impact Assessment. The availability of Canadian data residency reduces residency risk under the FIPPA framework, but jurisdictional risk remains due to the US parent company. Full FIPPA SaaS compliance guide →

PIPEDA

PIPEDA does not explicitly prohibit cross-border transfers, but organizations remain accountable for personal information transferred to foreign service providers — regardless of contractual arrangements. The Montreal data centre helps address residency concerns but does not eliminate accountability obligations. See also: PIPEDA vs Law 25 comparison →

HubSpot is one of 753 tools in the Upper Harbour Sovereignty Index. Most Canadian organizations use 15–30 SaaS products, and the majority are US-incorporated. If your compliance obligations extend to HubSpot, they extend to every tool in your stack that processes personal information. Canadian data residency is a meaningful step — but it addresses one dimension of a multi-dimensional sovereignty problem.

Map your entire SaaS stack to parent jurisdictions and CLOUD Act exposure in 10 minutes.
Map Your Stack →

Alternatives & Comparison

▾

For organizations that need CRM capabilities with reduced jurisdictional exposure, several alternatives offer different sovereignty profiles.

ToolOwnershipCLOUD ActCDN ResidencyCustomer Keys
HubSpotUSExposedMontreal (2025)No
SalesforceUSExposedAvailableShield add-on
Zoho CRMIndiaNot exposedAvailableAvailable
KlueCanadianNot exposedYesContact vendor

Based on Upper Harbour Sovereignty Index data.

🔔 Get notified when HubSpot's compliance status changes

We monitor vendor ownership, data residency options, and regulatory changes. Enter your email to receive an alert if HubSpot's sovereignty profile changes.

Technical Architecture

▾

Data hosting

HubSpot's infrastructure runs on Amazon Web Services (AWS) and Google Cloud Platform (GCP). As of February 2025, HubSpot offers data centres in the United States (East and West), European Union (Frankfurt), Australia (Sydney), and Canada (Montreal). Canadian customers can opt into the Montreal data centre for primary data storage. Existing customers can migrate using HubSpot's automated migration tool — most migrations complete within 8–24 hours.

Encryption

HubSpot encrypts data at rest using AES-256 and in transit using TLS 1.2/1.3. However, HubSpot manages all encryption keys. HubSpot has explicitly stated it is "unable to use customer supplied encryption keys at this time." This means HubSpot — and any authority with a valid legal order — can access data in readable form.

What data is stored

HubSpot stores CRM contacts, company records, deals, email communications, marketing analytics, support tickets, and custom objects. For many organizations, this includes names, email addresses, phone numbers, purchase history, and communication records — all of which constitute personal information under Canadian privacy law.

Data processing outside the primary region

Even with the Montreal data centre selected, some data processing may occur outside Canada. HubSpot uses subprocessors and third-party integrations that may process data in other regions. Backup and disaster recovery systems replicate data within the same regional hosting location, but organizations should review HubSpot's subprocessor list for cross-border processing.

Mitigation Options

▾

HubSpot offers more sovereignty controls than many US-based SaaS tools, though significant gaps remain. Available mitigations:

  • Montreal data centre: Migrate to Canadian data residency. This is the single most impactful step and should be done immediately if not already configured. It addresses residency requirements under Law 25 and FIPPA.
  • Data minimization: Limit what personal information is stored in HubSpot. Avoid storing sensitive categories (health data, financial details, government IDs) in CRM fields.
  • DPA and subprocessor review: Execute HubSpot's Data Processing Agreement and review the subprocessor list for cross-border processing that may affect your compliance position.
  • Access controls: Use HubSpot's role-based access controls and SSO integration to limit who can access personal information within your organization.

What you cannot mitigate: CLOUD Act jurisdiction. As long as HubSpot is US-incorporated and holds the encryption keys, US authorities can compel data production. No contractual arrangement changes this.

Frequently Asked Questions

▾

Does HubSpot offer Canadian data residency?

Yes. Since February 2025, HubSpot offers a Montreal data centre on AWS. New customers can select it at signup; existing customers can migrate using HubSpot's automated migration tool.

Does the Montreal data centre remove CLOUD Act exposure?

No. HubSpot is a US-incorporated company. The CLOUD Act applies to the company, not the data centre location. US authorities can compel data production regardless of where the data is physically stored.

Does HubSpot offer customer-managed encryption?

No. HubSpot encrypts data at rest (AES-256) and in transit (TLS 1.2/1.3), but HubSpot manages all encryption keys. Customer-managed encryption keys are not available.

Do I need a TIA for HubSpot under Law 25?

Recommended. If your data is in the Montreal data centre, primary storage may be within Quebec. However, a TIA is still advisable because HubSpot's US parent is subject to the CLOUD Act and some processing may occur outside Canada.

What are the Canadian alternatives to HubSpot?

Klue (Vancouver) offers competitive intelligence CRM capabilities. Jobber (Edmonton) serves field service businesses. For full-featured CRM, Zoho is headquartered in India and not subject to the CLOUD Act. HubSpot with the Montreal data centre is itself a reasonable choice for many organizations when properly documented.

Methodology: This assessment is based on HubSpot's corporate filings (SEC), published security documentation, data centre announcements, subprocessor disclosures, and the Upper Harbour classification methodology. Data verified March 2026. Updated quarterly. Part of the Canadian Technology Sovereignty Index.