everywhere else it is called exfiltration

Open your CRM. If it is HubSpot, go to Settings, then Data Management, then Import and Export, then Exports.

If you hold super admin, you are looking at every export anybody at your company has run. File name, source object, record count, who ran it, and when. A separate download history covers who downloaded the file afterwards. Without super admin you see only your own, according to HubSpot’s documentation.

The log is on every plan and has been running since the day you signed up. The files themselves expire after thirty days; the record of the export stays.

Scroll down until the dates stop looking familiar.

the button that is a breach everywhere else

A CRM differs from every other system in these guides in one way.

In your code host, taking everything is an attack. In your file storage, taking everything is an attack. In your mail, taking everything is an attack. All three would be called exfiltration in an incident report, and all three would take some effort.

In your CRM, taking everything is a supported feature with a button, documented by the vendor, granted by default, and finished before you have got up to make coffee. It produces a spreadsheet of every person you have ever spoken to, what you talked about, what they pay, and when they are up for renewal.

The population holding that button is your sales team, which is the group most likely to move to a competitor and the one with the most direct personal use for a copy.

And unlike almost everything else here, the export did not accumulate. Nobody drifted into it. The permission was granted deliberately, on day one, to people who genuinely need to pull a list for a campaign or a board deck. The gap is that the grant was sized to the routine case, and the button cannot tell the routine case from the other one.

None of that is a criticism of salespeople. It is a description of where a control is missing.

the permission nobody reviews

Access reviews, when companies do them, ask who can log in. That question is answerable, and it is the wrong one.

The question that decides your exposure is who can leave with the database, and that is a separate permission. In HubSpot it is three distinct toggles: whether somebody can export at all, whether they can export without approval, and whether they can approve somebody else’s export. They sit inside the CRM tools permissions, next to the object-level scoping that decides whether somebody sees everything, their team’s records, or only their own.

In Salesforce the same decision is spread across more surfaces, because it can be granted through a profile or through a permission set, so checking one of those tells you nothing. The upside is that it resolves to a single named permission you can query.

Neither vendor publishes anything about how customers actually configure this. No percentage on defaults, no distribution of admin seats. If somebody tells you what the typical configuration is, ask them where the number came from.

approvals are behind a wall, and the log is not

Two facts sit next to each other, and they are the practical shape of this guide.

Export approvals, where an admin has to authorise a large export before it completes, are an Enterprise-tier feature in HubSpot. So the preventive control is one you probably do not have.

The export log is on every plan, including yours.

So you cannot stop it, you can see it, and almost nobody looks. That is a worse position than not being able to see it, because it turns an unknown into a thing you decided not to check.

two questions about the same person

can they log in?

what access reviews ask

• One answer per user
• Reviewed, sometimes

can they leave with the database?

what decides your exposure

• Export, export without approval, approve others
• Granted on day one, reviewed never
• Logged on every plan, read by nobody

what it looks like when it goes wrong

Two employees at RAC, the British roadside assistance company, copied and sold around thirty thousand lines of personal data. They pleaded guilty in October 2024 and received suspended sentences. In separate proceedings the UK Information Commissioner’s Office secured confiscation orders totalling £118,852.32.

That is the criminal end. The ordinary end is an earlier UK prosecution, described by the law firm Osborne Clarke, in which an employee emailed 957 client records to a personal address on the way to a competitor. Nine hundred and fifty-seven records, one email, a criminal conviction under data protection law.

Neither case needed a vulnerability. Both needed a permission somebody had and nobody had reviewed.

the integrations are the other half

Your CRM has connected applications, and this is the Salesforce connected apps guide arriving in a different console.

The HubSpot marketplace lists thousands of applications. Each install is a third party holding scopes against your customer data, granted by whoever wanted the tool, usually without an admin in the loop.

The version of that going wrong is documented. When the Drift sales chat product was compromised in August 2025, the stolen material was OAuth tokens, and the attackers used them to query Salesforce tenants belonging to more than seven hundred organisations, according to AppOmni’s analysis. The tokens were revoked on 20 August. AppOmni’s observation is the line worth keeping: many of these applications request full data access and get approved without review.

Your CRM integration list is a list of companies that can read your customer database at machine speed, assembled by people optimising for getting their work done.

the part your lawyer cares about

One thing is easy to miss, and it changes the cost of the missing log.

Under European data protection rules, an employee taking a copy of customer data without authorisation is a personal data breach, and a breach that is likely to put people at risk starts a seventy-two hour clock on notifying your regulator. The European Data Protection Board’s breach-example guidelines include this exact situation as a worked case: an employee exfiltrating business data.

Now consider what you need in order to comply. You have to describe the scope: which records, how many, which categories of people. Without an export log you cannot establish scope, so you cannot make the notification properly, and the accountability principle turns the missing record into a failure of its own.

So the export log does something more useful than catching somebody. It lets you answer the question you will be legally required to answer, on a deadline, under pressure.

thirty minutes, this week

Open the export log. Filter to the last ninety days. Write down every export over a thousand records, who ran it, and when. Treat it as a baseline. Without one, if you ever need to say whether a particular month was unusual, you will have nothing to compare it against.

Count your super admins. Then count everybody with export enabled. Those are two different numbers, and the second is usually much larger than anyone expects.

Open the connected applications list. For each one: what is it, who installed it, what scopes does it hold, and do you still use it. Anything failing one of those comes out, the same rule the GitHub guide applies to your code host. Expect the list to be longer than anybody at your company would name from memory, because marketplace installs are frictionless by design and nothing prompts a review.

If you run Salesforce, query for the export-report permission directly, because checking profiles alone misses everybody who got it through a permission set.

A reasonable end state at your size: fewer than three super admins, export granted only to named individuals, and no application on that list that nobody can explain.

the thing to take away

Most of these guides are about access that accumulated by accident. This one is about access somebody granted on purpose.

Somebody made a deliberate decision to ship a bulk export feature, because customers need it, and it is the right decision. The gap is that the permission governing it sits in a different place from the permission everybody reviews, and the log recording it sits in a place nobody has opened.

Go and open it. It takes a minute and you will learn something about your own company.