HubSpot scopes and what they do
When you connect a HubSpot portal to Brave Tools, you approve a set of permissions (called "scopes"). These control what Brave Tools can access in your HubSpot account. Brave Tools only ever asks for the permissions the tools you actually use need — nothing more. This page explains how that works, what each permission does, and how your data stays safe.
You only grant what you use
Connecting a portal requires just one thing: basic account information (so we can identify your portal). Every other permission is optional and tied to a specific tool.
- At connection, you choose which tools you plan to use. Brave Tools then asks HubSpot only for those tools' permissions. If you pick nothing, you connect with basic access only.
- When you open a tool you haven't granted access to, it shows a "Grant access" prompt. One click reconnects and asks HubSpot only for that tool's permissions — HubSpot shows just the new ones to approve. The tool unlocks as soon as you approve.
- A tool stays locked until its permissions are granted, so you never end up half-using a tool that can't reach your data.
This means a user who only wants the HubDB Editor never has to grant access to contacts, deals, or other CRM data.
How security works
Brave Tools does not have independent access to your HubSpot data. When you connect your portal, you authorize Brave Tools to act on your behalf — the same way you'd authorize any HubSpot integration. This means:
- Your users control access. Only the person who connects the portal grants permissions. Brave Tools cannot connect to your portal without someone from your organization explicitly approving it.
- Permissions are scoped. Brave Tools can only access the specific data types you approve. If you don't grant "Contact lists" access, we can't read your lists — even if we wanted to.
- We don't store your HubSpot data. Brave Tools reads and writes data in real-time through the HubSpot API. We don't copy or store your CRM records, contacts, or deal information on our servers.
- You can change or revoke access at any time. Use Manage permissions in Brave Tools (see below), or revoke everything from HubSpot under Settings → Integrations → Connected Apps.
- OAuth 2.0 standard. We use HubSpot's official OAuth 2.0 flow. Your credentials are never shared with us — authentication happens directly with HubSpot.
Permission reference
Each permission below is optional and requested only when you use a tool that needs it.
| Permission | What it does | Tools that use it |
|---|---|---|
| Basic account information | Identify your portal (domain, account id). Always required to connect. | All |
| HubDB access | Read and write HubDB tables and rows | HubDB Editor |
| File Manager | Upload, read, and manage files in File Manager | HubDB Editor, File Manager |
| Blog & Email content | Read blog posts, emails and other content for visualization | Content Visualizer |
| Marketing events | Read marketing events for content planning | Content Visualizer |
| Marketing campaigns | Read campaign data for content planning and SMS attribution | Content Visualizer, SMS Campaigns |
| Contact properties (read/write) | Read and create custom contact properties | Property Pack Builder |
| Company properties (read/write) | Read and create custom company properties | Property Pack Builder |
| Deal properties (read/write) | Read and create custom deal properties | Property Pack Builder |
| Ticket properties | Read and create custom ticket properties | Property Pack Builder |
| Contact records (read/write) | Read contacts (e.g. phone numbers) to send SMS; map contacts by location | SMS Campaigns, Map Segmenter |
| Company records (read) | Read company records and their addresses to build routes | Route Planner |
| Contact lists (read/write) | Read lists/segments to select recipients or stops | SMS Campaigns, Route Planner, Map Segmenter, Workflow Extensions |
| Workflows | Read workflow names for the activity log; power workflow actions | SMS Campaigns, Workflow Extensions |
What about write access?
Some permissions include "write" access (e.g. Contact properties write). This is needed because tools like Property Pack Builder create new properties in your HubSpot portal. Brave Tools does not modify existing property values, contacts, deals, or other records — it only creates the property definitions you configure.
SMS Campaigns needs "Contact lists" and "Contact records" read to know which contacts are on your selected list and read their phone numbers. It does not modify your contact records.
Adding access to a tool
If a tool is locked, it means its permissions haven't been granted on your portal yet. To unlock it:
- Open the tool. You'll see a "Grant access" prompt explaining what it needs.
- Click Grant access. You're sent to HubSpot, which shows only the new permissions to approve.
- Approve. You're returned to Brave Tools, and the tool unlocks immediately.
Your existing connection and data are preserved — adding a tool only adds the new permissions, it doesn't remove or reset anything.
Managing permissions per portal
You can review and change exactly which tools a portal has access to at any time:
- Go to Connections in Brave Tools.
- Click Permissions on the portal you want to manage.
- Tick the tools to enable, or untick tools to remove access.
- Click Apply & reconnect and confirm in HubSpot.
Adding tools asks HubSpot only for the new permissions. Removing tools reconnects the portal with a smaller permission set, so the access you removed is actually revoked — not just hidden.
Can I remove specific permissions later?
Yes. Use Connections → Permissions (above) and untick the tools you no longer want, then Apply & reconnect. Brave Tools revokes the old access and reconnects with only the permissions you kept.
You can also remove everything at once: disconnect the portal in Brave Tools, or go to Settings → Integrations → Connected Apps → Brave Tools → Uninstall in HubSpot.