What the store reviewer checks
These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.
Live links
All URLs in the listing must lead to live, publicly available and working pages.
A support contact
The listing must include at least one support contact method.
Scopes you use
For certification, an app must use all the scopes it requests for installation. Unused scopes are a problem.
What to account for
Partner terms accepted
To list an app you must review and agree to HubSpot's Technology Partner Program Agreement.
A security questionnaire
Certification adds a security questionnaire about encryption, access controls and token lifecycle management.
A verified domain
Certification asks that the app is associated with a verified domain.
Common mistakes to check
Asking for scopes you never use
Each scope gives access to a set of HubSpot API endpoints. Extra scopes widen the data your policy must describe.
A dead link in the listing
A privacy or support link that returns an error breaks the live-URL rule.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
List the HubSpot data you read
Write down each scope, the contact or deal data it opens, where you store it and for how long.
Scan your public site and draft
Scan the site that hosts the policy. Review the suggested vendors, answer the business questions, then add the HubSpot data flows by hand.
Open every listing link
Open the privacy, terms and support links in a private window. Fix any that fail.
Example
Fictional app: Harbor Leads
Assume an app that copies new contacts into a spreadsheet and keeps the copy for 90 days. The scan sees analytics on the marketing site; the owner confirms what the app stores.
A useful next action
Add the 90-day retention and the deletion contact to the draft, then link the published page in the listing.
Questions before publishing
Do I need certification to list?
No. Certification is a separate, stricter step with extra checks such as the security questionnaire and a minimum number of installs.
Can the scan see my HubSpot data?
No. The scan reads your public website only. It cannot see tokens, scopes or what your backend stores. You confirm those facts yourself.
Is the draft reviewed by a lawyer?
No. A lawyer has not reviewed our templates. The draft is a starting point that you check and adapt against HubSpot's current rules.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.