You're handing us OAuth access to your revenue database.
Here's exactly what we do with it.
Riisp is a small company without a compliance badge wall — so this page doesn't hide behind one. It answers, specifically and honestly, the questions you should ask any vendor before granting CRM access: what we request, what we store, who can see it, and how you take it all back.
Six commitments, enforced in code
Each of these is an architecture decision in the product, not a policy document — the rest of this page explains the mechanics behind each one.
Read-only by default
A first connection requests read scopes only. Write scopes are a separate, optional grant you approve later on HubSpot's own consent screen — and even then, every change is previewed and explicitly approved before it runs.
We store the diagnosis, not the data
Scans read your CRM through the API, analyze it in memory, and discard the raw records when the scan completes. What persists is the report: scores, findings, counts, and exposure estimates — never a copy of your CRM.
Credentials encrypted at rest
OAuth tokens are stored encrypted with AES-256-GCM and used for exactly one thing: calling HubSpot on your organization's behalf. All traffic runs over TLS.
Hard tenant isolation
Every retained row is scoped to your organization in a row-level-secured Postgres database, and the application layer fails closed: an account that can't be resolved to an organization is denied, not defaulted.
Revocation is instant and real
Disconnect doesn't just forget your tokens — it revokes the grant server-side at HubSpot, so Riisp's access is dead at the source, then deletes the tokens from our database.
Deletion is self-serve
Delete your scan data yourself, instantly, from the account page — no support ticket. Anything left behind after a disconnect is purged automatically within 30 days.
Every scope we request, and why
Riisp requests the narrowest scope set the scan requires. The five read scopes below are the entire footprint of a default installation; two optional custom-object read scopes are granted only on accounts whose tier includes custom objects, and the two write scopes are requested only if you choose to enable one-click fixes, which HubSpot asks you to approve separately.
| Scope | Why Riisp needs it |
|---|---|
crm.objects.deals.read | Deal integrity checks — unowned deals, deals with no associated contact, closed-won deals missing finance fields. |
crm.objects.contacts.read | Funnel, routing, and attribution checks — lifecycle regressions, unrouted leads, never-contacted leads, original-source overwrites. |
crm.objects.owners.read | The owner directory, so ownership findings name real owners and fix suggestions can propose valid assignment targets. |
automation | Read workflow definitions for the Workflow Stability checks (e.g. a workflow whose trigger property is written by its own actions). |
oauth | The OAuth handshake itself — required by HubSpot for any app install. |
| Optional read — granted only on accounts whose HubSpot tier includes custom objects | |
crm.objects.custom.read | Read custom-object records (for example an Agreements object that carries expected and actual revenue) so exposure can be anchored to real contract values. Read-only — Riisp never writes to custom objects. |
crm.schemas.custom.read | Read the definitions of those custom objects (property names, stages, associations) so the scan can discover them without configuration. |
crm.objects.companies.read | Read company records and their contacts. Used only by the Deals Without Contact Association fix to find the contact on a deal's agreement company. Companies are never written. |
| Optional — requested only when you enable write access | |
crm.objects.deals.write | Applying deal fixes you preview and approve (e.g. assigning owners to unowned deals). Finance-critical fields — deal amount, close date — are never written automatically under any scope. |
crm.objects.contacts.write | Applying contact fixes you preview and approve (e.g. assigning lead owners, creating follow-up tasks for un-contacted leads). |
What we store — and what we never do
During a scan, your CRM records are read through the HubSpot API and analyzed in memory. When the scan completes, the raw records are discarded. What Riisp keeps is the scan report — retained on purpose, because change-versus-prior-scan deltas and the applied-fix log depend on history.
- Integrity scores and per-category breakdowns.
- Per-rule findings: affected-record counts, percentages, exposure estimates, and fix playbooks.
- The report narrative and portal-level aggregates (e.g. total record counts).
- Up to 25 CRM record IDs per finding — IDs only — so affected records can be re-located in HubSpot later. (One narrow exception: the workflow-loop check also records the names of flagged workflows.)
- OAuth tokens, encrypted at rest with AES-256-GCM.
- Store CRM record contents — no names, emails, phone numbers, deal amounts, or notes are persisted with findings.
- Mirror, copy, or warehouse your CRM database.
- Store chat conversations — in-app scan chat and this site's assistant.
- Sell data, or use your data for anything besides your own reports.
- Send raw CRM exports to the AI layer. Report narratives are written by Anthropic's Claude API from scan findings and aggregates only, and under Anthropic's commercial terms that data is not used to train models.
Taking it all back is a button, not a ticket
- Disconnect — instant revocation. One click on your account page revokes the OAuth grant server-side at HubSpot (not just locally) and deletes the stored tokens. From that moment Riisp cannot read your CRM. You can equally revoke from HubSpot's own connected-apps settings — the effect is the same.
- Delete scan data — instant, self-serve. A separate control on the account page permanently deletes your scan reports, findings, and connection records, immediately. No email, no support queue.
- The 30-day backstop. If you disconnect and simply walk away, your scan history is deleted automatically 30 days later — an automated job enforces this, so it doesn't depend on anyone remembering.
- Full account removal. Want the account itself gone — login, organization record, usage history? Contact us below and it's removed.
Our deletion commitment in one line: disconnect kills Riisp's access instantly, your scan data is gone within 30 days automatically — or within minutes if you press the button yourself.
Don't want to connect production first?
Fair. Connect a HubSpot sandbox or demo portal instead — the OAuth flow lets you pick which portal to install into, and Riisp runs the identical scan against it. See the full report on non-production data, then connect the real portal when you're ready. And if you'd rather have a human walk you through the connection live, ask — a guided scan on a call is something we're glad to do.
Where your data lives
Riisp runs on a small, boring, deliberately short list of infrastructure providers. This is the complete list of services that touch customer data, and what each one sees.
| Provider | Purpose | What it processes |
|---|---|---|
| Vercel | Application hosting and compute | Scan processing in memory; request traffic over TLS. |
| Supabase | Postgres database | Scan reports, findings, encrypted OAuth tokens — row-level-secured per organization. |
| Anthropic | AI narrative & chat (Claude API) | Scan findings and aggregates only — never raw CRM exports. Not used for model training. |
| Resend | Transactional email | Your email address, for welcome and account emails. |
| Twilio | Phone verification at signup | Your phone number, for the one-time verification code. |
| Slack | Internal operational alerts | Scan failure notifications to the Riisp team — portal identifiers only, no CRM record contents. |
Where we are on SOC 2, honestly
Riisp is not yet SOC 2 certified. We'd rather tell you that plainly than imply otherwise — the controls described on this page are how we operate today, and we believe a specific, verifiable account of them is worth more than a badge from a company you've never heard of.
If your security review needs more: we'll complete your security questionnaire (or provide standardized CAIQ-style answers), and a data processing agreement is available to countersign on request. When customer procurement genuinely requires SOC 2, pursuing Type I is the plan — we're sequencing it against real demand rather than buying the badge first.
Ask us anything — you'll reach a founder
Security questions, questionnaires, DPA requests, vulnerability reports, or a guided walkthrough of everything on this page — call or email directly. No form, no queue.