Box Connector for HubSpot
Trust Center
Box Connector for HubSpot brings Box content, Box Sign and Box AI into HubSpot while your files stay in Box, under Box’s permissions, security and governance. Here’s how SparkGrid protects your data.
SOC 2
TYPE 2
SOC 2 Type 2
Audit completed
AUDIT DETAILS
Audited by Modern Assurance, LLC · Period: April 1 – June 30, 2026 · Trust Services Criteria: Security
Box Commercial Partner of the Year 2026
Box Ecosystem Partner of the Year 2025 · Box New Partner of the Year 2024
HIPAA
Supported by Box and HubSpot
Business Associate Agreement
Available
SECURITY CONTROLS
Controls we have in place
Controls tested by our independent auditor as part of our SOC 2 Type 2 audit (April 1 – June 30, 2026).
Infrastructure security
Cloud resources restricted from public access
Annual review of key infrastructure and encryption configurations
Centralized logging and monitoring to detect security threats
Automated alerting on potential security events
Separate development, test, staging and production environments
Product security
Data encrypted in transit over public networks
Continuous vulnerability scanning of code
Critical and high vulnerabilities remediated within 14 days
All code changes tested before release
Independent peer review required before production changes
Version-controlled code repository for secure deployment
Access control
Multi-factor authentication required for in-scope systems
Strong password requirements
Unique user accounts, no shared accounts
Quarterly user access reviews
Production system access is logged
Access control policy reviewed annually
Organizational security
Annual security awareness training for all personnel
Information security policy reviewed annually
Annual device security attestations (disk encryption, anti-virus, strong passwords)
Security steering committee meets quarterly
Security roles and responsibilities defined
Cybersecurity insurance in place
Internal security procedures
Documented incident response plan, reviewed annually
Incident response plan tested annually
Annual risk assessment
Risk register maintained
Business continuity policy reviewed annually
Annual review of vendor security and compliance reports
Security requirements in vendor agreements
Public channel for reporting security concerns
PRODUCT PROTECTIONS
Built into Box Connector
Data security
Connection tokens encrypted at rest (AES-256)
Data encrypted in transit (TLS 1.2+)
Databases encrypted at rest by our hosting providers
Files stay in your Box account
Event-driven actions, no bulk two-way copy of files or records
Access & authentication
Standard OAuth sign-in for Box and HubSpot
SparkGrid never asks for your Box or HubSpot password
Each user connects their own Box account
Dedicated Box integration user for workflows
Admin portal sign-in with an emailed 6-digit verification code
Access management
Paid seats assigned to specific HubSpot users
Admin portal roles and permissions
User invite, deactivate and reinstate
Email alerts when a Box connection needs attention
Compliance & governance
SOC 2 Type 2 audit completed
Business Associate Agreement available
Box classifications, retention and metadata via HubSpot workflows (Enterprise plan)
Box and HubSpot support HIPAA
RESOURCES
Documents for your security review
PLATFORM SECURITY
box
Box
Your content stays in Box. Box publishes its certifications in the Box Trust Center.
box.com/trust
HS
Note: FedRAMP, ITAR, ISO and HIPAA certifications listed there are Box’s and HubSpot’s, not SparkGrid’s.
SUBPROCESSORS
Third parties that help us deliver Box Connector
These providers host or process data to run Box Connector. Box and HubSpot are the platforms you already use; your files stay in Box.
Has SparkGrid completed a SOC 2 audit?
Yes. SparkGrid Software has completed a SOC 2 Type 2 audit. The report is available under NDA; request it from the Resources section.
Who performed the audit and what did it cover?
Does Box Connector support HIPAA workflows?
Will SparkGrid sign a BAA?
Does SparkGrid store my files?
Does Box Connector keep Box and HubSpot in two-way sync?
Whose permissions do workflows use?
Are FedRAMP, ITAR or ISO certifications SparkGrid's?
