Supporting your website means holding keys to systems your business depends on — including, for HubSpot clients, the CRM that holds your customer data. This page sets out how we handle that responsibility. It exists so the person vetting us before signature has answers in writing, not assurances on a call.
Access management
- We request the minimum access needed for the work — for HubSpot, that means named user access with the narrowest permission set that covers the tasks, never shared logins.
- Every credential handover happens during onboarding through secure channels: a password manager or your platform’s own user-invitation flow. We do not accept or send credentials over email or chat in plain text.
- Who has access to what is documented, and available to you at any time.
- All changes to your website go through your Trello board, so there is a permanent record of what was done, by whom, and when.
Offboarding and revocation
When an engagement ends, our access is removed — by you or by us, whichever you prefer — within one working day of the cancellation taking effect. We confirm removal in writing, return or delete any client materials we hold on request, and hand over any documentation created during the engagement. Nothing about your website is held hostage: you own your portal, your code and your content throughout.
Data protection
- We operate under GDPR-standard data protection practices. Our Privacy Policy covers data we control; for data we access inside your systems, we act as a processor on your instructions.
- A data processing agreement (DPA) is available on request and can be executed before onboarding.
- Client data stays within the toolset disclosed to you (project management, communication and development tools); we don’t copy production data into unmanaged environments.
Safe change management
- Structural and risky changes are tested in staging or sandbox environments where the platform allows it, before going live.
- Backups or restore points are taken before significant changes, so there is always a way back.
- Business-critical issues are started the same working day.
Insurance
Envix holds professional liability insurance appropriate to the services we provide. Certificate details are available on request.
Questions
If your security, legal or procurement team needs anything beyond what’s here — a DPA, insurance certificate, or answers to a vendor questionnaire — get in touch and we’ll turn it around quickly.