When a user has their account deactivated from HubSpot, they will still be shown as active in Vanta and will fail the hubspot-account-access-removed-on-termination test. To have the account be detected as offboarded, and have the test pass, the user needs to be deactivated and then deleted in Hubspot. This is when the account status becomes detected as deactivated and off-boarding is triggered in Vanta.
If an administrator for whatever reason does not want to delete the Hubspot accounts, they have the option to Deactivate monitoring for the flagged account on the test page. Administrators can reach out directly to their auditor or account manager if they desire to provide the optional evidence, as they can confirm what this would entail.
Another potential option available would be to go to the Access page, filter by hubspot and mark the account as not a person or assign them to external person:
If you're unsure which option makes the most sense for you and your team, we recommend checking with your CSM or directly with your auditor, as auditor requirements tend to vary.
- Administrator access on Vanta
- Super admin access on Hubspot
- Please follow the steps in this article by Hubspot, Remove a user or your user account, to remove a user from your Hubspot account
- Once this is done, the changes should reflect in Vanta within an hour