Access and data
How we handle access to your CRM.
You grant one token, scoped to the job. We use it, then it’s revoked and deleted when the job is done. Here’s exactly what that means.
Preflight is read-only, twice over
The token can’t write. Preflight requests only the least-privilege read scopes it needs:
- Attio: record_permission:read, object_configuration:read, list_configuration:read, list_entry:read, task:read, user_management:read.
- HubSpot: crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read, crm.objects.owners.read, and the three crm.schemas.*.read scopes.
With that scope list, the token couldn’t write a change even if it tried.
The scanner won’t ask, either. It carries a fixed list of read-only requests and blocks anything else before it goes out. The HubSpot client has no method for sending an edit or a delete. Preflight never writes to your CRM.
What the scan reads, and what it doesn’t
- Reads: contacts, companies and deals, their field definitions, your deal pipeline stages, and your list of users or owners.
- Doesn’t read: emails, notes, call recordings, custom objects, billing, or anything outside your CRM.
What the scan keeps, and for how long
The report holds scores, counts, up to five record IDs per finding so you can check our work, field names, and, for the job-title check, the conflicting spellings we found. It isn’t a copy of your data.
The report goes into one Google Drive folder you share with us, restricted to our account.
Scan data is deleted within 30 days unless you hire us. That covers both the scan output and our working copy of it. If you hire us, that same data becomes the “before” half of your handover pack.
How you hand us the token
It comes to us through a one-time secret link from a password manager, or gets pasted live on a screen-share. Never in Slack, never in email, never in the shared folder.
Where it lives. In the studio machine’s system keychain, one entry per client. It’s never written to a file, printed or logged. The HubSpot scanner refuses to run at all if the token arrives any other way.
Build access (Overhaul)
- Read-write, and only on what the build actually touches. Attio: records, object and field setup, lists, tasks, webhooks. HubSpot: contacts, companies, deals, and their field definitions.
- Never: billing, adding or removing your users, installing apps, or deleting your workspace.
- Snapshot first. We export a snapshot before any bulk change. Everything we add gets tagged, so it can be found and pulled back out.
Slack (automations, when they launch)
A webhook that can post to one channel, or a bot that can post and look up users by email. Neither can read your messages, DMs or files.
Revoking access
Access keys are revoked and deleted at handover. Preflight access is gone the moment you have the report, whether you buy anything after or not. Nothing sits live “just in case”. You can revoke it yourself, any time, too:
- Attio: Workspace settings → Developers → find the token → Delete.
- HubSpot: Settings → Integrations → Private Apps → the app → Actions → Delete.
- Slack: remove the webhook from the channel, or uninstall the app.
- Google Drive: remove our account from the folder.
Each takes effect immediately.
What we never do
- Send email, messages or anything else to the outside world on your behalf.
- Ask for admin, billing or user-management rights.
- Write to your CRM during a Preflight.
- Read your Slack messages.
- Leave access live after the work is done.
Nothing stays live after the job’s done.
Grant one token, get a report, then delete the token. That’s the whole of Preflight.