AI tools and client data

Is Breeze Assistant safe for client data?

Short answer: Whether Breeze Assistant is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free, Starter and Professional (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data on), HubSpot says it does not train its models on eligible account data, by default. Every fact on this page is HubSpot's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in HubSpot’s own words

HubSpot's conversational assistant drafts content, summarizes CRM records and helps complete account tasks.

What you are askingFree, Starter and Professional (Sensitive Data off)Enterprise (Sensitive Data off)Enterprise (Sensitive Data on)
Trains the vendor's models by defaultYes, unless a Super Admin turns AI Model Training off. This row covers accounts with Sensitive Data off.“Toggle the AI Model Training switch on or off. By default, this setting will be toggled on.” source, read Yes, unless a Super Admin turns AI Model Training off. This row covers accounts with Sensitive Data off.“Toggle the AI Model Training switch on or off. By default, this setting will be toggled on.” source, read No when Sensitive Data is enabled. HubSpot says these accounts cannot opt in to model training.“Accounts with Sensitive Data turned on are automatically opted out of AI model training by default and cannot opt in.” source, read
How to turn training offYes, unless a Super Admin turns AI Model Training off. This row covers accounts with Sensitive Data off.“Toggle the AI Model Training switch on or off. By default, this setting will be toggled on.” source, read Yes, unless a Super Admin turns AI Model Training off. This row covers accounts with Sensitive Data off.“Toggle the AI Model Training switch on or off. By default, this setting will be toggled on.” source, read Not found in the pages we read.
How long data is keptNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.
What an admin can see or controlBreeze Assistant actions depend on the signed-in user's permissions.“User permissions determine which actions can be performed with Breeze Assistant.” source, read Breeze Assistant actions depend on the signed-in user's permissions.“User permissions determine which actions can be performed with Breeze Assistant.” source, read Breeze Assistant actions depend on the signed-in user's permissions.“User permissions determine which actions can be performed with Breeze Assistant.” source, read
Single sign-onNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.
Business Associate AgreementNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.
Where the data is processedNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the HubSpot pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask HubSpot before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask HubSpot before any patient data goes in. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From HubSpot’s own documentation. Each one is a change somebody can make this afternoon.

  • Have a Super Admin review the account's AI Model Training switch separately from access to Breeze Assistant.“Toggle the AI Model Training switch on or off. By default, this setting will be toggled on.” source, read

Worth knowing

  • The Sensitive Data setting is available on the Enterprise subscriptions listed by HubSpot; it is an account configuration, not a separate Breeze plan.“Store Sensitive Data in HubSpot” source, read
  • The plan rows refer to HubSpot subscriptions, not a separate Breeze subscription.“Marketing Hub Professional” source, read

Questions we get asked

Is Breeze Assistant safe for client data?

Whether Breeze Assistant is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Free, Starter and Professional (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data on), HubSpot says it does not train its models on eligible account data, by default.

Every fact on this page is HubSpot's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does HubSpot train its models on what we put into Breeze Assistant?

On Free, Starter and Professional (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data off), HubSpot may use eligible account data to train its models unless somebody turns that off; on Enterprise (Sensitive Data on), HubSpot says it does not train its models on eligible account data, by default.

On Free, Starter and Professional (Sensitive Data off), Enterprise (Sensitive Data off): Yes, unless a Super Admin turns AI Model Training off. This row covers accounts with Sensitive Data off.

HubSpot's own words: "Toggle the AI Model Training switch on or off. By default, this setting will be toggled on." (read 2026-11-05). On Enterprise (Sensitive Data on): No when Sensitive Data is enabled.

HubSpot says these accounts cannot opt in to model training. HubSpot's own words: "Accounts with Sensitive Data turned on are automatically opted out of AI model training by default and cannot opt in." (read 2026-11-05).

How long does HubSpot keep what we put into Breeze Assistant?

On Free, Starter and Professional (Sensitive Data off), Enterprise (Sensitive Data off), Enterprise (Sensitive Data on): Not found in the pages we read.

Can an administrator read what we put into Breeze Assistant?

On Free, Starter and Professional (Sensitive Data off), Enterprise (Sensitive Data off), Enterprise (Sensitive Data on): Breeze Assistant actions depend on the signed-in user's permissions.

HubSpot's own words: "User permissions determine which actions can be performed with Breeze Assistant." (read 2026-11-05).

Will HubSpot sign a Business Associate Agreement for Breeze Assistant?

We didn't find a BAA statement in the pages listed below; ask HubSpot before any patient data goes in.

How do we find out which version of Breeze Assistant our staff are using?

HubSpot sells this to practices rather than to individuals, so there is no personal account to find.

What decides the answers above is which plan your practice is on and what your own administrator has switched on, both of which are in your subscription and your admin console rather than on anybody's laptop.

Obsidian Ridge's free 30-day AI security assessment covers the tools nobody approved, which is the other half of the picture.

Sources

HubSpot’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 47 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.