Security & Data
Where Mixbound runs, what it reads, what it keeps and who to contact.
Where it runs
The Mixbound application and its database are hosted by DreamHost in Ashburn, Virginia, United States. Public traffic reaches it through Cloudflare. Connections between the application and the database are encrypted with TLS 1.3.
Your credential
Mixbound connects to HubSpot* through a private app that you create in your own portal. You control its permissions and can revoke access at any time. The access token is stored encrypted (AES-256-CBC).
Read-only services
The Audit, Audit+ and the Digest identify what needs attention; they do not clean or alter your CRM. The private app they use holds 16 HubSpot* scopes, used only to read. Three of them (automation, forms, sales-email-read) also permit changes; Mixbound never uses them to change anything. No create, update, delete, merge, property change or workflow enrolment. Data Enrichment and Data Enhancement are separate services that write to the CRM, and only where you have configured them.
What is kept
CRM data is read during a run to calculate findings and measures. What is kept is the output: findings, scores, counts, percentages and distributions, the names and identifiers of configuration objects, the identities of HubSpot* users and record owners, and a status-change log that holds record identifiers and status values only. The gateway access log (source IP address, request and browser details) is kept for 90 days as a security record.
No language model
No Mixbound service passes your CRM data to a language model or an AI provider.
Who processes data for Mixbound
DreamHost (hosting of the application and database, Ashburn, Virginia), Cloudflare (network delivery and traffic mediation) and Google Workspace (email delivery of the Digest). HubSpot* is your own CRM and the source system; Mixbound does not appoint it as a subprocessor.
Agreements and transfers
A data processing agreement can be offered on request. HubSpot* portals hosted in the EU/EEA or the UK require the transfer position to be resolved before connection.
Certifications
Mixbound holds no SOC 2 or ISO 27001 certification and has not had a third-party penetration test.
Reporting a security issue
Send security reports to security@mixbound.com. For anything else, use the contact page.