Account foundations

Every setting in this article ripples through the rest of HubSpot. If your time zone is wrong, workflow delays fire at the wrong hour. If your currency is off, every deal amount in your pipeline is misleading. If permissions aren't locked down, someone will eventually delete something they shouldn't.

You wouldn't build a house on a shaky foundation and then wonder why the walls crack. This is the same principle. Thirty minutes of setup here saves you from chasing phantom issues for months. Get this right first, and everything downstream (imports, integrations, automations) works cleanly.

Invite your team and set up permissions

The first step is bringing your colleagues into HubSpot. Go to Settings > Users and Teams > Create User. You can invite people one by one via email or bulk-upload via CSV.

Before you send invites, understand how HubSpot handles access. There are two permission models:

1. Granular permissions. Fine-grained controls per object. Can this person delete all contacts, only their team's contacts, only their own, or none at all? Every CRM object (contacts, companies, deals, tickets) has its own set of these controls.
2. Toggle-based permissions. Simple on/off switches for entire tools. Can this person access the forms tool? Yes or no. Can they use the workflow editor? Yes or no.

Every permission in HubSpot falls into one of these two categories. Once you understand that, the permissions panel stops being overwhelming.

Create teams and permission sets

Before inviting users, set up teams (Settings > Users and Teams > Teams tab). Teams let you control data visibility: a sales rep sees only their team's deals, not the entire pipeline. They also make reporting easier: filter any dashboard by team to compare performance.

Then create permission sets (Settings > Users and Teams > Permission sets tab). A permission set is a reusable template: "Sales rep", "Marketing manager", "Contractor". Define what each role can view, edit, and delete across every object. Set delete permission to "None" for all non-admin roles. Once built, you assign a permission set to every new user in one click instead of configuring forty toggles from scratch.

HubSpot also provides built-in role templates (sales rep, marketing manager, service agent) that cover the basics. Start with a template, adjust the handful of permissions that don't fit, and you get 90% of the work done immediately.

Super admins: keep the circle small

A super admin has near-total access: they can change settings, delete records, modify integrations, and access every tool. Most small teams make everyone a super admin because it's easy and nobody wants to deal with access requests. That's a risk that compounds the longer you leave it.

Keep super admin access to one or two people: the HubSpot champion and possibly the founder or operations lead. Everyone else gets a permission set.

One nuance that catches almost everyone: super admin status doesn't grant tool access automatically. A super admin still needs a Sales Hub seat to use sequences, and a Service Hub seat to use ticket tools. Permissions control what you can do. Seats control which tools you can access. Two separate systems.

The one permission you always restrict

The ability to delete contacts. I restrict this on every single implementation. A well-intentioned team member runs a bulk selection, clicks delete, and wipes out hundreds of records. HubSpot's support team will not revert deletions. That data is gone.

Restrict contact deletion to super admins only. This one rule prevents the most common catastrophic mistake in HubSpot.

Security: learn from the breaches

The Odido breach in the Netherlands showed what happens when access controls aren't taken seriously: customer data exposed, reputational damage, regulatory scrutiny. Your HubSpot account holds customer data too. Treat it accordingly.

Enable two-factor authentication for all users from day one. Set a session timeout so inactive users get logged out (Settings > Security > Settings and Activity). Check the security centre to see how many super admins you have (should be one or two) and how many users have 2FA enabled (should be 100%).

Account defaults

Under Settings > Account Setup > Account Defaults, configure the settings that apply globally:

1. Time zone and fiscal year. Every deal close date, workflow delay, and report filter uses this. If your team operates from Amsterdam but the account is set to US Pacific, your "send email at 9am" workflow fires at midnight.
2. Currency. Add all currencies you operate in, with exchange rates. This affects deal amounts, quotes, and revenue reporting.
3. Data hosting region. HubSpot offers hosting in the US, EU, and Australia. Confirm your data hosting matches your geography (Settings > Account Management > Account Defaults).
4. Notification profiles. Under Account Defaults > Notification profiles, create profiles for each team. Sales reps get instant alerts for new form submissions. Marketing gets a weekly digest. Service agents get Slack notifications for new tickets. Set these once so notifications are useful, not overwhelming.

The settings shortcut

No matter where you are in HubSpot, clicking the gear icon takes you to the settings for that specific area. In the email tool, the gear opens email settings. In the deals view, it opens deal pipeline settings. Faster than navigating through the full settings menu every time.

Setting up users the right way

When you invite a user to HubSpot, you have three options for assigning permissions:

The first option is to start with a role-based template. HubSpot provides templates for sales reps, marketing managers, service agents, and more. Each template pre-configures permissions to match the role. This is the fastest and safest approach for most teams.

The second option is to use a custom permission set. If you've created reusable permission configurations for your specific team structure, you can assign those during the invite. This is ideal for teams with non-standard roles.

The third option is to start from scratch. You manually toggle every permission for every object and tool. This gives maximum control but takes the longest and has the highest risk of misconfiguration.

My recommendation: start with a role-based template, then adjust the handful of permissions that don't fit. You get 90% of the work done in one click.

The permission you should always restrict

The single most dangerous permission in HubSpot is the ability to delete contacts. I've seen it go wrong too many times: a well-intentioned team member bulk-selects and deletes hundreds of records. HubSpot support will not revert your deletions for you.

Restrict contact deletion to super admins only. If someone needs a contact removed, they ask the admin. This one rule prevents the most common catastrophic mistake in HubSpot.

Data hosting region

HubSpot offers data hosting in four regions: US East, US West, EU, and Australia. This is set when your account is created and determines where your CRM data is physically stored. If your business operates in the EU or Australia, check that your data hosting matches your region. You can verify this under Settings > Account Management > Account Defaults. This is rarely something you change after setup, but it's worth confirming it's correct.

Notification profiles

Different teams need different notification settings. A sales rep wants instant alerts when a lead submits a form. A marketing manager wants a weekly digest of campaign performance. A service agent wants Slack notifications for new tickets.

Under Settings > Account Defaults > Notification profiles, you can create profiles for each team. Some receive text messages, some get Slack notifications, some get email digests. Set these up once and assign them to users so notifications are useful rather than overwhelming.

The settings shortcut

One navigation tip that saves time: no matter where you are in HubSpot, clicking the gear icon takes you to the settings for that specific area, not the general account settings. If you're in the email tool and click the gear, you land in email settings. If you're in the deals view and click the gear, you land in deal pipeline settings. This is faster than navigating through the full settings menu.

Tracking code: one small script, massive impact

The HubSpot tracking code is a piece of JavaScript that enables website analytics inside HubSpot: page views, traffic sources, time on page, session data. If you build your website in HubSpot, the tracking code is already installed. If your site runs on WordPress, Webflow, Shopify, or any other platform, you need to install it manually.

The tracking code also powers two critical features: it lets HubSpot forms work on your external website, and it enables live chat and chatbots on your pages.

After installing the tracking code, go to Settings, Tracking and Analytics, Advanced Tracking, and exclude your internal IP addresses. This prevents your team's browsing from inflating your analytics. If you work from a static IP (typical for office environments), paste it in the exclusion list. Dynamic IPs (common with home Wi-Fi) require your provider to assign a static one.

Account foundations is not glamorous work. Nobody gets excited about permission sets and session timeouts. But every team I've worked with that skipped this step paid for it later: wrong data, accidental deletions, security gaps, and confused users who can't find the tools they need.

Spend thirty minutes getting this right before you touch anything else in HubSpot. Your future self will thank you.