Salesforce vs HubSpot: Security & Compliance Comparison
Summary
- Salesforce holds 27 certifications. HubSpot holds 10 certifications.
- Both are certified for: SOC 2, SOC 3, SOC 1, GDPR, CCPA, UK GDPR, LGPD, EU-US DPF, Swiss-US DPF, HIPAA.
- Salesforce has but HubSpot doesn't: ISO 27001, ISO 27017, ISO 27018, ISO 42001, ISO 9001, CSA STAR, HITRUST, BSI C5, PIPEDA, Global CBPR, Global PRP, PCI DSS, FedRAMP, StateRAMP, DORA, CJIS, IRAP.
Side-by-side: all 32 frameworks
| Framework | Salesforce | HubSpot |
|---|---|---|
| Security & General Standards | ||
| SOC 2 | ✓ | ✓ |
| SOC 3 | ✓ | ✓ |
| SOC 1 | ✓ | ✓First SOC 1 report announced 2026 |
| ISO 27001 | ✓ | ?Not listed on trust.hubspot.com; assurance via SOC reports and EU Cloud CoC |
| ISO 27017 | ✓ | ?Not publicly documented |
| ISO 27018 | ✓ | ?Not publicly documented |
| ISO 27701 | — | ?Not publicly documented |
| ISO 42001 | ✓ | ?Not publicly documented |
| ISO 9001 | ✓ | ?Not publicly documented |
| CSA STAR | ✓ | ?Not publicly documented |
| HITRUST | ✓ | — |
| BSI C5 | ✓ | — |
| Privacy & Data Transfer | ||
| GDPR | ✓ | ✓EU Cloud Code of Conduct Level 2 compliance achieved |
| CCPA | ✓ | ✓ |
| UK GDPR | ✓ | ✓ |
| LGPD | ✓Not publicly documented | ✓Not publicly documented |
| PIPEDA | ✓Not publicly documented | ?Not publicly documented |
| DPDP Act | ?Not publicly documented | ?Not publicly documented |
| PIPL | ?Not publicly documented | ?Not publicly documented |
| EU-US DPF | ✓ | ✓ |
| Swiss-US DPF | ✓ | ✓ |
| Global CBPR | ✓Not publicly documented | — |
| Global PRP | ✓APEC Privacy Recognition for Processors certification | — |
| Industry & Government | ||
| HIPAA | ✓ | ✓HIPAA attestation published 2026; BAA required |
| PCI DSS | ✓ | — |
| FedRAMP | ✓FedRAMP High and Moderate authorized | — |
| StateRAMP | ✓TX-RAMP authorized | — |
| DORA | ✓ | ?Not publicly documented |
| CJIS | ✓ | — |
| FINRA | ?Not publicly documented | — |
| IRAP | ✓ | — |
| Emerging & Strategic | ||
| NIST CSF | ~NIST SP 800-171 documentation published | ?Not publicly documented |
✓ Certified~ Partial / conditional— Not certified? Not publicly documented
Need help choosing?
Join our waitlist for compliance alerts and expert comparisons.
Join the waitlist →