Managing Audit Trails in HubSpot: Best Practices

An audit trail is a chronological record of who changed what, when, and why. In a CRM with multiple users, integrations, and automated processes all modifying data simultaneously, audit trails are the difference between being able to investigate a problem and shrugging your shoulders when something goes wrong.

HubSpot provides some audit trail functionality out of the box, but it has gaps -- especially for bulk operations and cross-object changes. This guide covers what HubSpot tracks, what it does not, and how to build a more complete audit trail for your CRM data.

What HubSpot tracks automatically

Property change history

Every CRM record in HubSpot maintains a history of property changes. When you open a contact, company, deal, or ticket record and look at the left sidebar, you can see the current property values. For each property, you can click to view the history: who changed it, when, and what the old and new values were.

This is the most granular audit trail HubSpot provides. It is useful for investigating individual records, but it has limitations:

• You can only view the history for one record at a time.
• There is no way to search across property histories (e.g., "show me all records where the owner changed in the last week").
• The history is displayed in the HubSpot UI but is not easily exportable for compliance documentation.

Activity timeline

Each record has an activity timeline that shows emails, calls, meetings, notes, tasks, and other activities. This provides context for the record's history but is separate from property change tracking.

Account activity log

Under Settings > Account Defaults > Activity Log (or Account > Audit Logs on Enterprise), HubSpot logs administrative actions: user logins, permission changes, integration installations, workflow activations, and similar account-level events. This is an account administration audit trail, not a CRM data change trail.

On Enterprise plans, the Security Activity Report provides more detailed security-related audit information, including login history, session details, and permission changes.

Workflow history

Each workflow maintains a log of enrollments and actions taken. You can see which records were enrolled, when, and what actions were executed. This is useful for troubleshooting workflow behavior but is scoped to individual workflows -- there is no unified view of "all changes made by all workflows."

Import history

HubSpot's import tool logs each import operation: when it ran, how many records were created or updated, and which file was imported. However, it does not log what the old values were before the import overwrote them.

What HubSpot does not track well

Bulk edit changes

When you use HubSpot's native bulk edit feature (selecting records and clicking "Edit"), the property changes are recorded on individual record histories, but there is no consolidated record of the bulk operation itself. If you bulk-edit 200 records, there is no single audit entry that says "User X changed Property Y from A to B on 200 records at 2:30 PM." You would need to check 200 individual records to reconstruct what happened.

Cross-object change correlation

When a workflow or integration makes changes across multiple object types (updating a contact and its associated deals), there is no way to see these as a related set of changes. Each record shows its own change history independently. Correlating changes across objects requires manual investigation.

Integration-driven changes

When a third-party integration updates records via the API, HubSpot tracks the change but attributes it to the integration (the app name appears in the property history). The specific API call, its parameters, or the logic behind the change are not logged in HubSpot.

Custom object audit trails

Custom objects have property change history, just like standard objects. However, the audit trail functionality is the same -- per-record only, not aggregatable or searchable.

Deleted record history

When a record is deleted from HubSpot (non-GDPR delete), it goes to the recycle bin for 90 days. During that window, you can restore it. After 90 days, it is permanently deleted, and its history is gone. There is no long-term archive of deleted records or their property change histories.

Building a more complete audit trail

Given HubSpot's native limitations, here are strategies for maintaining a comprehensive audit trail.

Strategy 1: Export change logs regularly

You can use the HubSpot API to pull property change history for records and store it externally. The CRM properties API allows you to fetch property history for individual records, which you can then aggregate into a database or spreadsheet.

The /crm/v3/objects/{objectType}/{objectId} endpoint with propertiesWithHistory parameter returns the change history for specified properties. You could build a scheduled job that fetches recent changes and appends them to an external log.

This works but requires development effort and ongoing maintenance.

Strategy 2: Use webhook subscriptions for real-time tracking

HubSpot's webhook subscriptions API lets you register for notifications when specific events occur -- property changes, record creation, record deletion. Each webhook payload includes the property name, old value, new value, timestamp, and the source of the change.

Routing these webhooks to a logging service (a database, a Google Sheet, or a log management platform like Datadog or Splunk) gives you a real-time audit trail that is searchable and aggregatable.

The setup is more involved than periodic exports, but the result is a much more complete and timely audit trail.

Strategy 3: Implement pre-change snapshots for bulk operations

For any bulk data change -- whether through bulk edit, import, workflow, or an external tool -- take a snapshot of the affected records before the change. Export the records with the properties that will be modified, save the export with a timestamp, and store it somewhere accessible.

This is a manual process, but it gives you a reliable rollback point that HubSpot's native tools do not provide.

Strategy 4: Use a tool with built-in audit trails

When you use a search-and-replace tool like SearchReplace for bulk data changes, every operation is automatically logged with:

• The user who ran it
• The timestamp
• The search parameters (what was searched for)
• The replace parameters (what it was changed to)
• The object type and property
• The number of records affected
• A snapshot of the original values (for rollback)

This provides a complete audit trail for bulk edit operations without any additional setup. For organizations that need to demonstrate data governance compliance, this built-in logging is significant.

Strategy 5: Document your data change procedures

Beyond technical logging, maintain documentation of:

• Who is authorized to make bulk data changes
• What approval process is required before a bulk change is executed
• How changes are documented (where logs are stored, what format they use)
• Retention policies for audit trail data
• How audit trail data is reviewed (periodic reviews, triggered investigations, etc.)

This procedural documentation is as important as the technical logging for compliance purposes.

Audit trail requirements by compliance framework

Different regulatory and compliance frameworks have different expectations for audit trails. Here is a quick reference.

GDPR

Requires the ability to demonstrate compliance with data protection principles. You need records of processing activities (Article 30), including what data you process, why, and any changes made. For data subject requests (access, rectification, erasure), you need to document that you responded appropriately and within the required timeframe.

SOC 2

SOC 2 Type II audits examine the effectiveness of controls over a period of time. For CRM data, auditors want to see that changes to customer data are logged, that access controls are enforced, and that bulk changes are authorized and documented.

HIPAA

If your HubSpot portal contains protected health information (PHI) -- which is uncommon but possible for healthcare companies using HubSpot -- HIPAA requires audit controls that record and examine activity in systems containing PHI. This includes who accessed or modified records.

SOX

For publicly traded companies, Sarbanes-Oxley requires internal controls over financial reporting. If your CRM data feeds into financial reports (pipeline values, revenue figures), changes to that data need to be tracked and auditable.

Best practices for CRM audit trail management

1. Decide what matters most. You probably do not need to track every single property change on every record. Focus on properties that are compliance-sensitive (personal data, financial data) and changes that are high-impact (bulk edits, owner reassignments, lifecycle stage changes).

2. Centralize your logs. Audit data scattered across HubSpot's per-record histories, workflow logs, and import histories is hard to use. Aggregate it into a single, searchable system.

3. Set retention policies. Decide how long you need to keep audit trail data. GDPR does not specify a retention period for audit logs, but you should have a documented policy. Common practice is 1-3 years for general CRM changes and longer for compliance-sensitive data.

4. Review your audit trail regularly. An audit trail you never review is useless. Schedule periodic reviews -- monthly or quarterly -- to look for anomalies: unexpected bulk changes, changes by unauthorized users, or patterns that suggest process breakdowns.

5. Test your rollback capability. If you store snapshots for rollback, periodically verify that you can actually use them. A backup you cannot restore from is not a backup.

6. Include audit trail management in your CRM governance documentation. When new team members join, they should understand how changes are tracked and what their responsibilities are for documentation.

---

HubSpot provides a foundation for change tracking, but organizations with real compliance requirements need to build on it. Whether through API-based logging, webhook integrations, or tools with built-in audit trails, investing in a complete audit trail pays dividends every time you need to answer the question: "What happened to this data, and who changed it?"