Connect Baton to HubSpot
Baton produces a read-only footprint report for a departing HubSpot user: what they own and where they are referenced, before you deactivate them.
What Baton asks HubSpot for
Always requested (read-only):
crm.objects.owners.readsettings.users.readsettings.users.teams.readcrm.objects.contacts.readcrm.objects.companies.readcrm.objects.deals.readcrm.objects.tickets.readcrm.lists.read
Optional: HubSpot only offers these if your subscription includes the feature, and you can untick them:
crm.schemas.custom.readFind your custom objects (Enterprise).crm.objects.custom.readCount custom-object records the leaver owns (Enterprise).automation.sequences.readFind sequences the leaver owns and enrollments they send (Sales/Service Pro+).scheduler.meetings.meeting-link.readFind meeting links and round-robin pages that include the leaver.reporting.full.readFind reports and dashboards the leaver owns (HubSpot beta API).conversations.readFind open inbox conversations assigned to the leaver.automationFind workflows that reference the leaver (Pro+). HubSpot only offers this as a read-and-write scope. Baton never uses it to change anything: our HubSpot client blocks every non-read request before it is sent.
About the workflows permission (“automation”). HubSpot has no read-only permission for workflows, so to find workflows that reference the leaver Baton must request a permission that HubSpot describes as able to create and edit workflows. Baton never changes workflows. Every request our HubSpot client makes is checked against a list of allowed operations, workflow edits are never on it, and anything else is refused before it leaves our servers. If you'd rather not grant it, untick it on HubSpot's consent screen: workflows will then appear in your report as a manual checklist item.
Handovers are a separate step
Connecting gives Baton read-only access for the footprint report. If you later want Baton to reassign a leaver's records, you grant write permission separately with “Enable handovers” on your account page.
What Baton stores
HubSpot IDs and counts only. Contact names, emails and notes are shown live from HubSpot and never copied into our database. Your HubSpot access is stored encrypted.