Sample report: Northwind Advisory is a made-up company and every number here is invented. It shows what a real report looks like.

Jon Martin
Field report
Portal Audit
Portal 1000001
Status: complete

Northwind Advisory (sample data)HubSpot portal 1000001

An audit of how the HubSpot account Northwind Advisory (sample data) is configured: data model, data quality, people and seats, automation and marketing assets and security activity. Prepared by Portal Audit.

AccountNorthwind Advisory (sample data)
Portal ID1000001
DateOctober 1, 2026
Prepared byPortal Audit
AuthorshipDrafted with AI and checked against your audit data by software.
Account typeStandard
Filed underHubSpot portal audit

The short version

Everything after this page is the detail behind these answers.

Overall score81 / 100Grade B
AI readiness (our estimate)59 / 100Estimate, not HubSpot’s score

Do these first

  1. Super admins within 2 or 10% of users
    Super admins can export all data, install apps, change security settings and delete objects; every extra one widens the blast radius.
  2. Every record has an owner
    Unowned records fall out of every queue, task list and owner-based report; nobody follows up.
  3. Idle users are removed and seats reclaimed
    Accounts nobody uses are an attack surface and paid seats nobody uses are wasted spend.

Seats

3 of 14 users have not logged in during the review window, and 2 of them hold a paid seat. Check whether those seats still need to be paid for.

Your next step

Start with “Super admins within 2 or 10% of users”. The full 30, 60 and 90 day plan is in the improvement plan, and everything behind these answers follows as the appendix.

Scorecard

81 / 100
Grade · B

Overall configuration score across 5 assessed categories, 20 rules evaluated. Lowest: Governance and security (50).

CategoryScoreCriticalHighMediumLow
Data model100 / 100····
Data quality76 / 100··21
Governance and security50 / 100·13·
Automation88 / 100···3
Integrations100 / 100····
Limitsnot assessed····

Top findings

high1
medium5
low4
info2
01
highGovernance and securityGOV-003

Too many super admins

Evidence
  • 5 of 14 users (35.7%) are super admins. Allowed for 14 users: 2.
Recommendation

Keep super admins to 2 or 10% of users, whichever is higher; give others a permission set. Super admins can export all data, install apps and change security settings.

02
mediumData qualityDQ-001

Low fill rates on key deals fields

Evidence
  • deals (610 records):closedate 50% (target 90%, 305 missing);hubspot_owner_id 75% (target 80%, 152 missing)
Recommendation

Backfill the missing deals values (import, workflow defaults, or owner assignment rules), then prevent new gaps with required fields on forms, pipeline stage requirements, or rotation/assignment workflows.

03
mediumData qualityDQ-001

Low fill rates on key tickets fields

Evidence
  • tickets (1240 records):hubspot_owner_id 30% (target 80%, 868 missing)
Recommendation

Backfill the missing tickets values (import, workflow defaults, or owner assignment rules), then prevent new gaps with required fields on forms, pipeline stage requirements, or rotation/assignment workflows.

04
mediumGovernance and securityGOV-002

No permission sets (roles) in use

Evidence
  • 0 permission sets; 9 non-admin user(s) have individually configured permissions
Recommendation

Create permission sets per job function and assign them, so access is consistent, least-privilege and auditable. Review exports, bulk delete and settings access in particular.

05
mediumGovernance and securityGOV-005

Failed logins in the review window

Evidence
  • 35 of 940 login attempts failed in the last 90 days (3.7%)
  • Failed logins by country: US: 28, RO: 7
Recommendation

Review failed logins with the affected users, require 2FA (or SSO) for everyone, and check for logins from unexpected countries.

06
mediumGovernance and securityGOV-006

Users with no login in the review window

Evidence
  • 3 of 14 users have no login in the last 90 days
  • 2 on paid seats
Recommendation

Deactivate users who no longer need access and reclaim their paid seats; reassign their records first.

07
lowAutomationAUTO-001

Inactive workflows

Evidence
  • 7 of 24 workflows are off (29.2%)
  • Off: "Old webinar follow-up", "Q2 2024 promo", "Lead rotation (test)", "Renewal reminder v1", "Onboarding nurture (copy)", "Newsletter welcome" (+1 more)
Recommendation

Delete or archive workflows that are off and no longer needed (export their logic first if it documents a process); turn back on, with a review, any that should run. A clean workflow list makes troubleshooting and the 2026-27 API migration review faster.

08
lowAutomationAUTO-003

Stale lists (segments)

Evidence
  • 1 of 4 lists have had no update or membership change in undefined+ days
  • 1 of those are not used by any workflow, email or other asset
Recommendation

Delete stale lists that nothing references; move the rest into folders by owner/purpose. Fewer lists make segmentation and list-limit planning easier.

09
lowAutomationAUTO-004

Empty lists

Evidence
  • 1 of 4 lists have 0 members
Recommendation

Fix the filters or delete empty lists; check whether any workflow or email depends on them first.

10
lowData qualityDQ-002

Unused custom properties

Evidence
  • 5 of 10 checked custom properties have no value on any record (50%)
  • contacts: 5 (a, b, c, d, e)
Recommendation

Confirm with owners and integrations whether each empty property is still needed; archive the ones that are not (archived properties can be restored for 90 days). Unused fields clutter forms, views and the property limit.

2 more findings in the findings register at the end of this report.

Cleanup list: what to review

These are the specific items behind the risks above. Review each one and keep, fix, or remove it. We only list setting names, never your contact, company or deal records.

Empty custom properties

No record has a value. Unused fields clutter forms and reports.

ObjectLabelInternal nameSuggested action
contactsaaDelete or hide if no longer needed.
DQ-002 Q-01
contactsbbDelete or hide if no longer needed.
DQ-002 Q-02
contactsccDelete or hide if no longer needed.
DQ-002 Q-03
contactsddDelete or hide if no longer needed.
DQ-002 Q-04
contactseeDelete or hide if no longer needed.
DQ-002 Q-05

Disabled workflows

Turned off but still in the account.

WorkflowSuggested action
Old webinar follow-upDelete if retired, or turn back on.
AUTO-001 Q-06
Q2 2024 promoDelete if retired, or turn back on.
AUTO-001 Q-07
Lead rotation (test)Delete if retired, or turn back on.
AUTO-001 Q-08
Renewal reminder v1Delete if retired, or turn back on.
AUTO-001
Onboarding nurture (copy)Delete if retired, or turn back on.
AUTO-001
Newsletter welcomeDelete if retired, or turn back on.
AUTO-001
Trial expiry alertDelete if retired, or turn back on.
AUTO-001

Super admins

Full access to everything.

Allowed for 14 users: 2

RoleCountSuggested action
Super admin5Keep super admins to 2 or 10% of users, whichever is higher; give others a permission set.
GOV-003

Questions for you

The audit cannot decide these from configuration and counts. 8 still need an answer.

Custom properties

  • Q-01Is the contacts property "a" (a) still needed, or should it be archived? Options: Keep it / Archive it / Delete it / Not sure yet.
  • Q-02Is the contacts property "b" (b) still needed, or should it be archived? Options: Keep it / Archive it / Delete it / Not sure yet.
  • Q-03Is the contacts property "c" (c) still needed, or should it be archived? Options: Keep it / Archive it / Delete it / Not sure yet.
  • Q-04Is the contacts property "d" (d) still needed, or should it be archived? Options: Keep it / Archive it / Delete it / Not sure yet.
  • Q-05Is the contacts property "e" (e) still needed, or should it be archived? Options: Keep it / Archive it / Delete it / Not sure yet.

Workflows that are off

  • Q-06Should the workflow "Old webinar follow-up" be turned on or deleted? Options: Turn it on / Keep it / Delete it / Not sure yet.
  • Q-07Should the workflow "Q2 2024 promo" be turned on or deleted? Options: Turn it on / Keep it / Delete it / Not sure yet.
  • Q-08Should the workflow "Lead rotation (test)" be turned on or deleted? Options: Turn it on / Keep it / Delete it / Not sure yet.

Improvement plan

12 actions in three phases, ordered by impact and effort.

30 days4First 30 days: quick, high-impact fixes
60 days8Days 31-60: process and data improvements
90 days0Days 61-90: larger or lower-priority work

First 30 days: quick, high-impact fixes

4 items
ActionImpact / effort
Super admins within 2 or 10% of users PLAN-01
Super admins can export all data, install apps, change security settings and delete objects; every extra one widens the blast radius.
Ref: GOV-003 BP-GOV-01
H / S
Every record has an owner PLAN-02
Unowned records fall out of every queue, task list and owner-based report; nobody follows up.
Ref: DQ-001 BP-DQ-02
H / S
Idle users are removed and seats reclaimed PLAN-03
Accounts nobody uses are an attack surface and paid seats nobody uses are wasted spend.
Ref: GOV-006 BP-GOV-05 GAP-04
M / S
Service tickets are owned and moved through a pipeline PLAN-04
Unowned tickets are not worked; pipeline stages make SLAs and backlog visible.
Ref: DQ-001 BP-SP-04
M / S

Days 31-60: process and data improvements

8 items
ActionImpact / effort
Non-admin users get access through permission sets PLAN-05
Permission sets make access consistent, least-privilege and reviewable; hand-configured users drift.
Ref: GOV-002 BP-GOV-02
H / M
Custom objects hold real data PLAN-06
Custom objects add schema, associations and limits to maintain; one with almost no records is usually an abandoned design or an unfinished integration.
Ref: DM-006 BP-DM-04 GAP-02
M / M
Unused custom properties are archived PLAN-07
Empty fields clutter forms and record pages, confuse users and count against the property limit.
Ref: DQ-002 BP-DQ-05 GAP-03
M / M
Teams mirror the organisation PLAN-08
Teams drive team-only record access, team reporting and round-robin assignment.
Ref: BP-GOV-03
M / S
Connected apps are reviewed PLAN-09
Every installed app holds scoped access to CRM data; unreviewed installs accumulate.
Ref: INT-004 BP-GOV-07
M / S
Workflows that are off are cleaned up PLAN-10
A long tail of off workflows hides which automation is live and slows troubleshooting and API-migration reviews.
Ref: AUTO-001 BP-AUTO-01
M / S
Deals carry amount, close date, company and contact PLAN-11
Forecasts, win-rate and attribution reports are only as good as these four fields.
Ref: DQ-001 BP-DQ-03
H / M
Lists (segments) are maintained PLAN-12
Stale and empty lists clutter segmentation and count toward list limits.
Ref: AUTO-003 AUTO-004 BP-AUTO-03 GAP-01
L / S

priority = impact (H3/M2/L1) × status weight (fail 1.0, gap 0.8, partial 0.6) × 1.3 if a related finding is critical/high, ÷ effort (S1/M1.6/L2.5). 30 days: priority ≥ 2.0 and effort S/M (max 6 items); 60 days: priority ≥ 1.0 (max 8); 90 days: the rest and all L-effort items.

Usage gaps

4 places where the portal has a capability that is not being used.

Hub tiers are inferred from user seat names. Partner seats are partner or agency access, not a paid hub seat.

Not assessed: Product library use on quotes and line items (quotes or line item counts are not in this report); Marketing contacts (limits module not available); Form submission counts for captured (non-HubSpot) forms are not assessed. The forms API returns the form name, type, and dates, not a submission total (https://developers.hubspot.com/docs/api-reference/2026-09-beta/marketing/forms/get-form). The submissions endpoint returns each submission's fields, which this audit does not read (https://developers.hubspot.com/docs/api-reference/legacy/marketing/forms/v1/get-form-integrations-v1-submissions-forms-form_guid). An older analytics report can return a submissions total (https://developers.hubspot.com/docs/api-reference/legacy/reporting/reports/get-analytics-v2-reports-object_type-time_period), but it is not the forms permission, and the published schema does not say the rows are captured forms.; Hub subscriptions without assigned seats (no subscription API for apps; tiers inferred from seat names only); Seat-based gaps (no hub seat names found on users)

GapImpactRecommendation
Lists built but stale or empty GAP-01
Has: 4 lists
Uses: 1 stale, 1 empty, 2 unreferenced
LDelete unreferenced stale or empty lists, and fix filters on active lists that should have members.
Custom objects defined but barely used GAP-02
Has: 1 custom object(s) defined
Uses: widgets: 2 records
LConfirm which process or integration should populate each object. Finish it, or retire the object.
Custom fields built but never filled GAP-03
Has: 10 custom properties checked
Uses: 5 have no value on any record (50%)
MArchive fields nobody fills. For the ones that matter, add them to forms, record layouts, or the integration that should write them.
Paid seats with no logins GAP-04
Has: 2 user(s) on paid seats
Uses: no login in 90 days
MReassign or remove paid seats from users who are not logging in.

GAP-01 Lists built but stale or empty

What we measured: Stale lists plus empty lists, divided by all lists. Fires when that share is at least 30%.

Where to check in HubSpot: Segments (lists). https://knowledge.hubspot.com/segments/create-active-or-static-lists

Improvement plan: PLAN-12.

GAP-02 Custom objects defined but barely used

What we measured: Records on each custom object. Fires when any defined object has fewer than 10 records.

Examples: widgets.

Where to check in HubSpot: Custom objects. https://knowledge.hubspot.com/object-settings/create-custom-objects

Improvement plan: PLAN-06.

GAP-03 Custom fields built but never filled

What we measured: Custom properties with no value on any record, divided by custom properties checked. Fires when that share is at least 25%.

Examples: a; b; c; d; e.

Where to check in HubSpot: Property settings. https://knowledge.hubspot.com/properties/create-and-edit-properties

Improvement plan: PLAN-07. Question: Q-01, Q-02, Q-03, Q-04, Q-05.

GAP-04 Paid seats with no logins

What we measured: Users on a paid hub seat whose id is absent from logins in the last 90 days. Names and email addresses are not listed.

Examples: service-professional; sales-enterprise.

Where to check in HubSpot: Account name, then Account & Billing, then Seats. Login history is in account activity: https://knowledge.hubspot.com/account-management/view-and-export-account-activity-history https://knowledge.hubspot.com/account/manage-your-hubspot-subscription

Improvement plan: PLAN-03.

Best practices

37 HubSpot best practices checked against this portal. Each one cites the HubSpot page it comes from, or is marked as opinion.

Pass8
Partial4
Fail8
Not applicable / not assessed1 / 16
PracticeStatusImpactSource
Lists (segments) are maintained BP-AUTO-03
4 lists: 1 stale, 1 empty, 2 unreferenced
failLCreate active or static lists (segments)
Custom objects hold real data BP-DM-04
widgets: 2 records
failMCreate custom objects
Every record has an owner BP-DQ-02
contacts.hubspot_owner_id: 100% of 18400 (target 80%); deals.hubspot_owner_id: 75% of 610 (target 80%)
failHopinion
Unused custom properties are archived BP-DQ-05
5 of 10 custom properties are empty on every record (50%)
failMCreate and edit properties
Super admins within 2 or 10% of users BP-GOV-01
5 of 14 users are super admins (35.7%). Allowed for 14 users: 2.
failHHubSpot user permissions guide: Super Admin
Non-admin users get access through permission sets BP-GOV-02
0 permission sets; 9 non-admin users
failHHubSpot user permissions guide
Idle users are removed and seats reclaimed BP-GOV-05
3 of 14 users with no login in 90 days (2 on paid seats)
failMopinion
Service tickets are owned and moved through a pipeline BP-SP-04
tickets.hubspot_owner_id: 30% of 1240 (target 80%); tickets.hs_pipeline_stage: 100% of 1240 (target 99%)
failMopinion
Workflows that are off are cleaned up BP-AUTO-01
7 of 24 workflows are off (29.2%)
partialMOrganize your workflows
Deals carry amount, close date, company and contact BP-DQ-03
deals.amount: 95% of 610 (target 80%); deals.closedate: 50% of 610 (target 90%)
partialHSet up pipeline rules
Teams mirror the organisation BP-GOV-03
2 teams; 9 of 14 users without a team
partialMTeams API
Connected apps are reviewed BP-GOV-07
2 install and 0 uninstall events in the window: review needed
partialMManage your connected apps
Custom properties live in named custom groups BP-DM-02
0 of 10 custom properties on core objects sit in default groups
passLCreate and edit properties
Contacts have email, name and lifecycle stage BP-DQ-01
contacts.email: 98% of 18400 (target 90%); contacts.lifecyclestage: 100% of 18400 (target 90%)
passHSet validation rules for properties
Login and security activity is reviewed BP-GOV-04
35 of 940 logins failed in 90 days (3.7%)
passMView and export account activity history
Records of deactivated users are reassigned BP-GOV-06
0 active owners linked to deactivated users
passMopinion
New integrations use service keys or project apps, not legacy keys BP-INT-04
0 legacy credential creation event(s) and 0 other legacy credential event(s) in the window
passHAccount service keys
Lead capture uses HubSpot forms that are maintained BP-MA-01
1 HubSpot form(s), 1 forms in total; 0 not updated in 365 days
passMCreate forms
Marketing emails nurture contacts BP-MA-02
1 batch/automated marketing email(s) of 1 emails; 0 draft(s) and 1 published across all types (0 are ticket emails)
passMCreate automated emails to use in workflows
Lifecycle stage is set on every contact BP-MA-03
lifecycle stage set on 100% of 18400 contacts
passMopinion
Sensitive data is marked and protected BP-GOV-08
not a regulated industry (per confirmed profile)
not applicableHStore sensitive data
No empty or unfinished workflows BP-AUTO-02
workflow details not available
not assessedLCreate workflows
Ownership is assigned automatically BP-AUTO-04
workflow details not available
not assessedMChoose your workflow actions
Every custom property has a description BP-DM-01
properties module not available
not assessedMCreate and edit properties
No duplicate property labels BP-DM-03
properties module not available
not assessedLCreate and edit properties
Association labels describe key relationships BP-DM-05
association labels not available
not assessedLCreate and use association labels
Companies have a domain and industry BP-DQ-04
fill rates not available
not assessedMopinion
Validation rules guard key properties BP-DQ-06
property validation rules are not collected by this audit version (manual check)
not assessedMSet validation rules for properties
No legacy private apps in use BP-INT-01
private app usage not available
not assessedHLegacy private app creation sunset
Custom code uses date-versioned APIs and current credentials BP-INT-02
workflow details not available
not assessedHCustom code actions
Workflow webhook receivers are known and verified BP-INT-03
workflow details not available
not assessedMUse webhooks with HubSpot workflows
Integrations checked against the 2026-27 API retirements BP-INT-05
which endpoints integrations call is not visible through the API (manual check, playbook 03)
not assessedHLegacy APIs and legacy apps: what's going unsupported and when
Headroom on record and property limits BP-LIM-01
limits not available
not assessedMLimits tracking API
Headroom on pipelines, custom objects and association labels BP-LIM-02
limits not available
not assessedLLimits tracking API
Pipeline stages reflect the real process BP-SP-01
deal pipelines not available
not assessedMopinion
Pipelines have closed stages and a manageable number of stages BP-SP-02
pipelines not available
not assessedLopinion
Pipeline count fits deal volume BP-SP-03
pipelines or deal count not available
not assessedLopinion

AI readiness (Context Home)

How ready this portal’s data is for HubSpot’s AI (Breeze), scored from the four inputs HubSpot names for high-quality context: actively populated CRM fields, logged activity, connected integrations and configured team settings. Estimate, not HubSpot’s score.

Our estimate59/100Estimate, not HubSpot’s score · developing
HubSpot Context Home score—Not entered (no API); enter it by hand

HubSpot’s own Context Home completeness score has not been entered. Read it in HubSpot (Agents › Agent Hub › Context) and enter it to see the two side by side.

Sub-scores and evidence

Input (HubSpot’s wording)Sub-scoreConfidenceEvidence (source)
Actively populated CRM fields
Mean fill rate of the audit’s key fields on contacts, companies, deals and tickets (80%), plus the share of custom properties that hold any value (20%).
75high
  • Mean fill rate across 8 key fields: 81%. audit:dataQuality.fillRates
  • Lowest: tickets hubspot_owner_id 30%; deals closedate 50%; deals hubspot_owner_id 75%. audit:dataQuality.fillRates
  • 5 of 10 custom properties hold a value on at least one record (50%). audit:dataQuality.customProperties
  • Related findings: DQ-001, DQ-002. DQ-001

Limits: Key fields are the audit’s list, not HubSpot’s; HubSpot does not publish which fields its score reads.

Logged activity
Share of contacts, companies and deals with a logged activity (Last activity date) in the last 90 days (70%) and ever (30%).
51medium
  • contacts: 11500 of 18400 (63%) have a logged activity; 5200 (28%) in the last 90 days. audit:dataQuality.activity
  • companies: 1900 of 2650 (72%) have a logged activity; 1100 (42%) in the last 90 days. audit:dataQuality.activity
  • deals: 540 of 610 (89%) have a logged activity; 330 (54%) in the last 90 days. audit:dataQuality.activity

Limits: Uses "Last activity date" (notes_last_updated); activities logged only on tickets or custom objects are not counted. Email/calendar sync status per user is not readable via the API.

Connected integrations
Points for each kind of evidence: integration installs in the security log (25, or 35 for 5+), integrations identified by their property groups (20, +5 per extra app up to 30), private-app/API use (10), workflow actions from apps, webhooks or custom code (5). Capped at 80 because the API cannot list connected apps.
25low
  • 2 integration install and 0 uninstall events in the last 90 days. audit:security.integrationEvents
  • Related findings: INT-004. INT-004

Limits: HubSpot’s API returns install/uninstall events but not the list of connected apps, so app names come only from property groups; install events also count re-installs (including this audit app). Inbox, calendar and Slack connections are not visible to the audit.

Configured team settings
Equal parts: teams exist; active owners on a team; users with a role/permission set; super admins ≤25% of users; no active owners tied to deactivated users.
83medium
  • 2 teams configured. audit:usersAndTeams.users
  • 3 of 8 active owners have no team. audit:owners
  • 0 active owners belong to deactivated users. audit:owners
  • 4 of 14 users have no role (permission set); 0 roles defined. audit:usersAndTeams.users
  • 5 of 14 users are super admins (36%). audit:usersAndTeams.users
  • Related findings: GOV-003, GOV-002. GOV-003

Limits: Per-user Context Home settings (user profile, email personality) are not readable via the API.

Weighted mean of the four inputs HubSpot names for high-quality context (equal weights). Bands: 0-39 low, 40-69 developing, 70-100 strong. HubSpot has no public API for Context Home or its score (developer changelog checked 2026-10-02).

Sources: HubSpot: Context Home product page · HubSpot Fall 2026 Spotlight (Context Home completeness score) · HubSpot KB: Manage your Breeze context (updated Sep 16, 2026) · HubSpot developer changelog (no Context Home API as of 2026-10-02)

Status · ok · 0.0 s

Account

Account typeStandard
Data hosting—
Currency—
Time zoneUS/Eastern
Status · ok · 0.0 s

Record counts

Records counted22,902
Object types5
Largest objectContacts18,400 records · 80% of total
ObjectRecordsShare
Contacts18,40080%
Companies2,65012%
Deals6103%
Tickets1,2405%
Widgets20%
Status · ok · 0.0 s

Data quality

Key fields checked83 objects
Below target338% of fields
Unused custom properties550% of 10 custom
Search calls10 / —No checks skipped

Custom properties

10
ObjectCustomEmptyNo description
Contacts1050

Lowest key-field fill rates

8
ObjectFieldFill rate
Ticketshubspot_owner_id30%
Dealsclosedate50%
Dealshubspot_owner_id75%
Dealsamount95%
Contactsemail98%
Contactshubspot_owner_id100%
Contactslifecyclestage100%
Ticketshs_pipeline_stage100%

Scores use only the key fields. The full list, one row per property, is in properties.csv.

t · ok · 0.0 st · ok · 0.0 s

People and seats

Users14
Super admins536% of users. Allowed for 14 users: 2
Active owners81 archived
Teams · roles2 · 0
MeasureValue
Active owners without a team3
Active owners linked to a deactivated user0
Users without a team9
Non-admin users without a role4
Empty teams0

Owners

9
OwnerTypeUser activeTeamsStatus
Avery Quinlan——active
Morgan Okafor——active
Riley Stavros——active
Jordan Pell——active
Sam Whitlock——active
Taylor Brandt——active
Casey Ng——active
Devon Marsh——active
Riley Stavros——archived
Status · ok · 0.0 s

Custom objects

Custom objects1
Properties on custom objects0
Association types0
ObjectType IDPrimary displayRequiredPropertiesAssociationsCreated
Widgets
widgets
2-1—————
Status · ok · 0.0 s

Workflows

Workflows24
On17
Off7
Webhook actions0
Custom code actions0

Workflow register

24
WorkflowStatusObjectEnrollmentActionsUpdated
Live workflow 1on——
Live workflow 2on——
Live workflow 3on——
Live workflow 4on——
Live workflow 5on——
Live workflow 6on——
Live workflow 7on——
Live workflow 8on——
Live workflow 9on——
Live workflow 10on——
Live workflow 11on——
Live workflow 12on——
Live workflow 13on——
Live workflow 14on——
Live workflow 15on——
Live workflow 16on——
Live workflow 17on——
Old webinar follow-upoff——
Q2 2024 promooff——
Lead rotation (test)off——
Renewal reminder v1off——
Onboarding nurture (copy)off——
Newsletter welcomeoff——
Trial expiry alertoff——
Status · ok · 0.0 s

Lists (segments)

Lists4
Empty1
Not referenced2by workflows, emails or other assets
Stale (—+ days)11 also unreferenced
Status · ok · 0.0 s

Forms

Forms1
Archived—
Not updated in 365 days0
Form typeCountShare
Hubspot1100%

Captured forms

No captured (non-HubSpot) forms in this report.

Newest captured form was has no created date. Newest HubSpot form was is not in this report.

Form submission counts for captured (non-HubSpot) forms are not assessed. The forms API returns the form name, type, and dates, not a submission total (https://developers.hubspot.com/docs/api-reference/2026-09-beta/marketing/forms/get-form). The submissions endpoint returns each submission's fields, which this audit does not read (https://developers.hubspot.com/docs/api-reference/legacy/marketing/forms/v1/get-form-integrations-v1-submissions-forms-form_guid). An older analytics report can return a submissions total (https://developers.hubspot.com/docs/api-reference/legacy/reporting/reports/get-analytics-v2-reports-object_type-time_period), but it is not the forms permission, and the published schema does not say the rows are captured forms.

Status · ok · 0.0 s

Marketing emails

Emails1
Published1
Drafts0
Transactional—
A/B tests—
TypeCountShare
Batch email1100%

Status · ok · 0.0 s

Security and account activity

Activity over the last 90 days. Counts only: no IP addresses or user details are shown.

Logins94011 users
Failed logins354% of attempts
Security events5
Integration installs20 uninstalls
Critical actions—
Failed logins by countryCountShare
US2880%
RO720%

Security activity by type

0 types

Gaps and limits

  • 01Left out of your score, not assessed: Custom properties without descriptions (couldn't be checked this time) DM-001. What unlocks it: Nothing to do. It is retried on the next audit. Duplicate custom property labels (couldn't be checked this time) DM-002. What unlocks it: Nothing to do. It is retried on the next audit. Default or template deal stage names (couldn't be checked this time) DM-004. What unlocks it: Nothing to do. It is retried on the next audit. Pipelines without a closed stage or with many stages (couldn't be checked this time) DM-005. What unlocks it: Nothing to do. It is retried on the next audit. Workflows with no actions (couldn't be checked this time) AUTO-002. What unlocks it: Nothing to do. It is retried on the next audit. Legacy private apps are making API calls (couldn't be checked this time) INT-001. What unlocks it: Nothing to do. It is retried on the next audit. Workflow custom code actions (couldn't be checked this time) INT-002. What unlocks it: Nothing to do. It is retried on the next audit. Workflow webhook actions (couldn't be checked this time) INT-003. What unlocks it: Nothing to do. It is retried on the next audit. Approaching account limits (couldn't be checked this time) LIM-001. What unlocks it: Nothing to do. It is retried on the next audit. These checks do not count for or against your score.

Findings register

#SeverityCategoryFindingRecommendation
01highGovernance and securityToo many super admins GOV-003Keep super admins to 2 or 10% of users, whichever is higher; give others a permission set. Super admins can export all data, install apps and change security settings.
02mediumData qualityLow fill rates on key deals fields DQ-001Backfill the missing deals values (import, workflow defaults, or owner assignment rules), then prevent new gaps with required fields on forms, pipeline stage requirements, or rotation/assignment workflows.
03mediumData qualityLow fill rates on key tickets fields DQ-001Backfill the missing tickets values (import, workflow defaults, or owner assignment rules), then prevent new gaps with required fields on forms, pipeline stage requirements, or rotation/assignment workflows.
04mediumGovernance and securityNo permission sets (roles) in use GOV-002Create permission sets per job function and assign them, so access is consistent, least-privilege and auditable. Review exports, bulk delete and settings access in particular.
05mediumGovernance and securityFailed logins in the review window GOV-005Review failed logins with the affected users, require 2FA (or SSO) for everyone, and check for logins from unexpected countries.
06mediumGovernance and securityUsers with no login in the review window GOV-006Deactivate users who no longer need access and reclaim their paid seats; reassign their records first.
07lowAutomationInactive workflows AUTO-001Delete or archive workflows that are off and no longer needed (export their logic first if it documents a process); turn back on, with a review, any that should run. A clean workflow list makes troubleshooting and the 2026-27 API migration review faster.
08lowAutomationStale lists (segments) AUTO-003Delete stale lists that nothing references; move the rest into folders by owner/purpose. Fewer lists make segmentation and list-limit planning easier.
09lowAutomationEmpty lists AUTO-004Fix the filters or delete empty lists; check whether any workflow or email depends on them first.
10lowData qualityUnused custom properties DQ-002Confirm with owners and integrations whether each empty property is still needed; archive the ones that are not (archived properties can be restored for 90 days). Unused fields clutter forms, views and the property limit.
11infoData modelCustom objects in use DM-006Document the purpose, owner and integrations for each custom object, and confirm its associations and required properties match how records are created.
12infoIntegrationsIntegrations installed in the review window INT-004Confirm each newly installed app is approved, has an owner, and requests only the scopes it needs (Settings → Connected apps).

How this audit was created

This audit read the portal through the Portal Audit app installed in this HubSpot account. Nothing in the portal was changed: the app only sends read requests, and its HubSpot client blocks anything else.

What was checked

Data model, data quality, people and seats, automation and marketing assets and security activity. Only configuration and aggregate counts are kept: no contact details, email addresses or IP addresses are stored in this report.

Time windows

  • Configuration and counts as of October 1, 2026 at 9:00 AM EDT.
  • Logins and security activity: the last 90 days.
  • Logged activity on records: the last 90 days.
  • Stale lists: not updated in 180 days. Forms: not updated in 365 days. Draft marketing emails: not edited in 180 days.

How the scores are calculated

Each category starts at 100 and loses points for every finding in it: 40 for critical, 20 for high, 10 for medium, 4 for low, 0 for information. The overall score is the weighted average of the categories that could be assessed (Data model ×1, Data quality ×1.25, Governance and security ×1.25, Automation ×1, Integrations ×1, Limits ×0.75). Any critical finding caps the overall score at 59. Reaching a pipeline limit is rated medium at most: it stops you adding another pipeline but doesn't break anything already set up, so it doesn't trigger the cap. Grades: A from 90, B from 80, C from 70, D from 60, F below 60 (so a capped score is F). Data quality scores use key fields only. Every property that was checked is listed in properties.csv.

Run details

FieldValue
GeneratedOctober 1, 2026 at 9:00 AM EDT
HubSpot API version2026-09 (platform 2026.09)
HubSpot requests0 read requests
CRM searches0 of 250 allowed
Permissions granted0