Security

2.0 OAuth protocol

Quarterdeck requires three read scopes (deals, owners, contacts) and asks for further read access only as optional permissions, so an install never fails on a portal that lacks a feature. It requests no HubSpot write scopes. One exception to disclose: HubSpot names its workflows permission automation and offers no read-only variant, so granting it technically allows writes. Quarterdeck sends only read requests, and this is enforced in code by a guard that rejects every non-read HubSpot call before it is sent, so a broader grant cannot be used to change your CRM.

crm.objects.deals.read
crm.objects.owners.read
crm.objects.contacts.read

# optional, granted only if you approve them
automation                           (workflow definitions)
marketing.campaigns.read             (campaigns and engagement)
marketing.campaigns.revenue.read     (HubSpot campaign revenue report)
automation.sequences.read            (sequence definitions)
crm.objects.companies.read           (company metadata)

3.0 Encryption

4.0 Tenant isolation

Quarterdeck's database schema enables row-level security and membership-scoped policies for workspace-accessible records.

5.0 AI data handling

Anthropic narrative requests contain structured metrics and deterministic evidence. Depending on the findings, this can include company name, reporting period, at-risk deal names, HubSpot deal IDs, amounts, and risk reasons. Revenue Efficiency narratives also receive aggregate scores, counts, and the names of workflows and campaigns named in findings. A numeric guard rejects any model output containing a figure Quarterdeck did not compute. Quarterdeck does not send contact names, email addresses, or note bodies in these narrative requests; it does not store them either.