HubSpot enrichment, 37 fields per company, refreshed daily.

Overview

The Kustiq HubSpot integration runs B2B enrichment on every HubSpot company and contact in your portal. It writes verified firmographics, tech stack, hiring + funding signals, and contact role data straight into HubSpot properties so your filters, lists, and workflows pick them up without any manual export.

Two surfaces, one pipeline. Companies get 33 enriched properties: industry, headcount band, ARR estimate, funding stage, last round date, tech stack array, hiring signals, and 26 more. Contacts get 4 enriched properties: kustiq_email_confidence, kustiq_contact_role, kustiq_contact_department, kustiq_contact_seniority. That is 37 writeable fields total. Counts match the HowTo schema, the FAQ schema, and the property reference below, in that order.

With Kustiq, a company record refreshes every 24 hours. With raw HubSpot, the same record stays whatever the rep typed at create time.

Setup, in 5 minutes

Six steps. HubSpot-side OAuth, no API key paste, no IP allowlist. Refresh token encrypted at rest, rotated every 6 hours.

Property reference

Every property is namespaced kustiq_* so it never collides with anything you already have. 33 company + 4 contact = 37 enriched properties. Counts match the HowTo + FAQ schemas. If a number disagrees somewhere, this section wins.

Permissions and scopes

Kustiq requests six HubSpot scopes, no more. You can revoke any of them from HubSpot → Settings → Integrations without contacting support.

• crm.objects.companies.read · read native HubSpot company fields (name, domain, industry, numberofemployees) for matching against the Kustiq profile graph.
• crm.objects.companies.write · write the 33 kustiq_* company properties on matched records.
• crm.schemas.companies.read · check the kustiq_*property group exists and matches Kustiq’s expected schema on every sync.
• crm.schemas.companies.write · create the kustiq_* property group on first connect, once per portal.
• crm.objects.contacts.read · read contact name, email, associations so contact role and seniority can be attributed to the right person.
• crm.objects.contacts.write · write the 4 kustiq_* contact properties (email confidence, role, department, seniority). No native contact field is ever overwritten.

Kustiq does not request files, tickets, e-commerce, deals, or any conversation scope. If your IT review asks for a written list of what we touch, the six lines above are the answer.

Webhooks

Kustiq sends a webhook to your endpoint every time a company or contact is enriched. Each request is signed with HMAC-SHA256 over the raw body, using a shared secret you generate per workspace.

The signature lives in the X-Kustiq-Signature header as a bare 64-character hex digest. The body has a top-level timestamp field (unix seconds) for replay protection. Reject any request whose computed signature does not match in constant time. Reject any request whose body timestamp is older than 5 minutes.

// Express handler. Use express.raw({ type: "application/json" }).
const crypto = require("crypto");
const SECRET = process.env.KUSTIQ_WEBHOOK_SECRET;

function verify(req) {
  const sig = req.headers["x-kustiq-signature"] || "";
  if (sig.length !== 64) return false;

  const mac = crypto
    .createHmac("sha256", SECRET)
    .update(req.body)
    .digest("hex");

  const ok = crypto.timingSafeEqual(
    Buffer.from(mac, "hex"),
    Buffer.from(sig, "hex"),
  );
  if (!ok) return false;

  // Replay check: body has top-level "timestamp" (unix seconds).
  const body = JSON.parse(req.body);
  return Date.now() / 1000 - body.timestamp < 300;
}

Retry policy: 5xx response or no response inside 10s triggers exponential backoff (1m, 5m, 30m, 2h, 12h) for up to 24 hours, then the event is dropped and logged.

Sync rules

• Cadence.Every 24 hours, off-peak in your portal’s region (EU portals run between 02:00 and 04:00 CET).
• Direction. One way, Kustiq to HubSpot. We never read contact email content, deal data, or activity.
• Conflict. Kustiq only writes kustiq_* properties. Native HubSpot fields (industry, numberofemployees) are read for matching, never overwritten.
• Match key. Domain first, name fallback. Confidence below 80% never writes.
• Rate limit. 100 requests / 10 seconds, batched. Kustiq backs off automatically on 429.
• Disconnect. Revoking from HubSpot stops new writes. kustiq_* properties stay on records until you delete the property group.

Troubleshooting

Twelve known states. Each has a stable anchor so you can link a teammate to the exact row.

FAQ

Changelog

• 2026-05-16 · v2.1 Pair-lock production-ready audit. Scope list corrected to six (crm.objects.companies.read/write, crm.schemas.companies.read/write, crm.objects.contacts.read/write) to match the actual OAuth grant. Webhook verifier snippets rewritten to match the bare-hex X-Kustiq-Signature header the server emits. Free-tier copy unified to 3 profiles a week across hero, mid-CTA, final CTA, and JSON-LD. Pricing fixed in ERR_QUOTA_FREE (Insight 200 credits, Pro 800 credits). JSON-LD @id-graph linked to root #org and #site.
• 2026-05-08 · v2.0 Property count clarified to 33 + 4 = 37 across docs, JSON-LD, and OG. Webhook section adds verification snippets. Six setup-step screenshots wired to HowToStep schema. New “Last verified” badge.
• 2026-04-12 · v1.4 Added kustiq_score_a/b/c ICP-fit tier properties. Bumped batch size from 50 to 100.
• 2026-02-28 · v1.3 EU region (Frankfurt) opened. Refresh-token rotation cut from 24h to 6h.
• 2025-11-04 · v1.2 Match-confidence floor raised to 80%, with ERR_MATCH_LOW surfaced.
• 2025-08-19 · v1.0 Initial release.