Access and data
How we handle access to your CRM.
You grant one token, scoped to the job. We use it, and it’s revoked and deleted when the job is done. Here’s exactly what that means.
Preflight is read-only, twice over
The token can’t write. Preflight asks only for the least-privilege read scopes it needs:
- Attio: record:read, record_permission:read, object_configuration:read, list_entry:read, task:read, user_management:read.
- HubSpot: crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read, crm.objects.owners.read, and the three crm.schemas.*.read scopes.
With those, the token can’t change anything even if someone tried.
The scanner won’t ask. It carries a fixed list of read-only requests and refuses anything else before it’s sent. Its HubSpot client has no way to send an edit or a delete at all. Preflight never writes to your CRM.
What the scan reads, and what it doesn’t
- Reads: contacts, companies and deals, their field definitions, your deal pipeline stages, and your list of users or owners.
- Doesn’t read: emails, notes, call recordings, custom objects, billing, or anything outside your CRM.
What the scan keeps, and for how long
The report holds scores and counts, up to five record IDs per finding so you can check them, field names, and, for the job-title check, the conflicting spellings. It isn’t a copy of your data.
The report goes into one Google Drive folder you share with us, restricted to our account.
Scan data is deleted within 30 days unless you hire us. That covers the scan output and our working copy. If you do hire us, it becomes the “before” half of your handover pack.
How you hand us the token
Through a one-time secret link from a password manager, or pasted live on a screen-share. Never in Slack, never in email, never in the shared folder.
Where it lives. In the studio machine’s system keychain, one entry per client. It’s never written to a file, printed or logged. The HubSpot scanner refuses to run on a token passed in any other way.
Build access (Overhaul)
- Read-write, on only what the build needs. Attio: records, object and field setup, lists, tasks, webhooks. HubSpot: contacts, companies, deals, and their field definitions.
- Never: billing, adding or removing your users, installing apps, or deleting your workspace.
- Snapshot first. Before any bulk change, we export a snapshot. Everything we add is tagged, so it can be found and removed.
Slack (automations, when they launch)
A webhook that can post to one channel, or a bot that can post and look up users by email. Neither can read your messages, DMs or files.
Revoking access
Access keys are revoked and deleted at handover. Preflight access goes as soon as you have the report, whether or not you buy anything. Nothing is left live “just in case”. You can also revoke it yourself at any time:
- Attio: Workspace settings → Developers → find the token → Delete.
- HubSpot: Settings → Integrations → Private Apps → the app → Actions → Delete.
- Slack: remove the webhook from the channel, or uninstall the app.
- Google Drive: remove our account from the folder.
Each takes effect immediately.
What we never do
- Send email, messages or anything else to the outside world on your behalf.
- Ask for admin, billing or user-management rights.
- Write to your CRM during a Preflight.
- Read your Slack messages.
- Leave access live after the work is done.
Read-only means read-only.
Grant one token, get a report, delete the token. That’s the whole Preflight.