Integration architecture
Apps must deliver standalone value directly to end users. The following architectural patterns are not eligible for listing:- Credential and token brokering: apps with a primary commercial offering of storing, managing, or distributing end-user OAuth tokens or API credentials on behalf of third-party developers.
- Developer-only infrastructure: apps that require a third-party developer to build a separate product before an end user can derive value.
- White-label integration infrastructure: apps with a HubSpot integration designed to be embedded invisibly into another party’s product.
Model Context Protocol (MCP) & AI connectors
Apps that let AI agents or assistants interact with HubSpot CRM data are subject to additional requirements. These requirements do not apply to apps with a static, pre-defined data sync that happens to use AI upstream.- Non-deterministic access: apps where an AI interprets natural language and decides which CRM actions to take must enforce user-level permissions, i.e. that the app can only access data the specific HubSpot user has permissions to see. Standard OAuth tokens are not sufficient for this purpose. The underlying token must enforce what the user is permitted to do in HubSpot.
- Build requirements: apps must be built with either the MCP auth app, or the project-based MCP app if also using
isUserLevel: true.
Sales intelligence & data enrichment
Apps that inject, enrich, or provide contact and company data within HubSpot CRM are subject to compliance and data-sourcing review. The following types of apps are prohibited:- Apps that import non-opted-in email addresses into HubSpot, as this violates Developer Policy sections A.2 and C.1.
- Apps that scrape data from LinkedIn profiles, as this violates Developer Policy section A.3 and LinkedIn’s User Agreement section 8.2.
- Apps that support bulk import of prospecting databases into HubSpot for mass emailing.
- Apps that enrich existing HubSpot contacts with firmographic or technographic data from third-party sources.
- Apps that sync contacts who have actively engaged with the customer’s own outreach (e.g., replied to an email the customer sent). These may be acceptable if every synced contact has genuinely engaged, and there is no path for cold contacts to bypass the filter.
- De-anonymized website visitor identification apps.
Restricted industries
Apps primarily serving or positioned within certain industries are not eligible for listing, as stated in HubSpot’s Acceptable Use Policy and Technology Partner Program Policies. Apps that fall within a restricted industry but build functionality unrelated to that industry may be considered on a case-by-case basis. Restricted industries include:- Cryptocurrency.
- Non-fungible tokens (NFTs).
- Escort and dating services.
- Pharmaceutical products.
- Gambling services or products.
- List brokers or list rental services.
- Selling social media likes or followers.
Additional restrictions
The following types of apps are also restricted, as outlined in the HubSpot Marketplace listing requirements:- Apps using legacy CRM cards.
- Apps built on unsupported developer platform versions.
- Apps that redirect to a different public or private app.
- Duplicate apps from the same creator.