Where Mixbound runs, what it reads, what it keeps and who to contact.
The Mixbound application and its database are hosted by DreamHost in Ashburn, Virginia, United States. Public traffic reaches it through Cloudflare. Connections between the application and the database are encrypted with TLS 1.3.
Mixbound connects to HubSpot through a private app that you create in your own portal. You control its permissions and can revoke access at any time. The access token is stored encrypted (AES-256-CBC).
The Audit, Audit+ and the Digest identify what needs attention; they do not clean or alter your CRM. The private app they use holds 16 HubSpot scopes, used only to read. Three of them (automation, forms, sales-email-read) also permit changes; Mixbound never uses them to change anything. No create, update, delete, merge, property change or workflow enrolment. Data Enrichment and Data Enhancement are separate services that write to the CRM, and only where you have configured them.
CRM data is read during a run to calculate findings and measures. What is kept is the output: findings, scores, counts, percentages and distributions, the names and identifiers of configuration objects, the identities of HubSpot users and record owners, and a status-change log that holds record identifiers and status values only. The gateway access log (source IP address, request and browser details) is kept for 90 days as a security record.
No Mixbound service passes your CRM data to a language model or an AI provider.
DreamHost (hosting of the application and database, Ashburn, Virginia), Cloudflare (network delivery and traffic mediation) and Google Workspace (email delivery of the Digest). HubSpot is your own CRM and the source system; Mixbound does not appoint it as a subprocessor.
A data processing agreement can be offered on request. HubSpot portals hosted in the EU/EEA or the UK require the transfer position to be resolved before connection.
Mixbound holds no SOC 2 or ISO 27001 certification and has not had a third-party penetration test.
Send security reports to [email protected]. For anything else, use the contact page.