HubSpot Sync

HubSpot customer-profile sync, mapping, webhook, and batch paths exist locally. No customer-facing CRM setup or Settings → CRM Sync journey is offered in this release. Provider activation is unavailable in this release.

Current Source Boundary

• Connector status and metadata reads require connector-view authority locally.
• Connect, mapping, test, and batch-dispatch routes require connector-edit authority.
• Outbound sync reads one exact tenant/customer/connector context and repeats tenant scope on profile and sync-log writes locally.
• The inbound webhook updates an already-linked tenant profile locally. Workspace, strict PII schema, audit/privacy custody, configured provider behavior, and product proof remain open.
• HubSpot signature-v3 verification and scoped replay receipts have local coverage; configured delivery, concurrency, and recovery remain unverified.
• The batch worker selects at most 100 existing tenant profiles per invocation. This is not proof of complete-customer coverage, provider rate limiting, or delivery.
• No new-ticket producer currently creates a durable profile or dispatches sync.

Authentication and product boundary

The CRM endpoints are dashboard routes authenticated by the interactive Clerk session. They are not part of the keva_live_ public API-key surface. The local route and authority contracts do not establish an available customer procedure.

There is no current customer-profile page or customer-level Sync Now journey. HubSpot connection, webhook, token, mapping, conflict, troubleshooting, and recovery behavior remain local source status only and are not offered as customer-facing activation instructions in this release.