HubSpot enrichment, 37 fields per company, synced in one click.

Overview

The Kustiq HubSpot integration runs B2B enrichment on every HubSpot company and contact in your portal. It writes classification, fit and churn scores, buying and pain signals, detected tools, funding stage, and contact role data straight into HubSpot properties so your filters, lists, and workflows pick them up without any manual export.

Two surfaces, one pipeline. Companies get 33 enriched properties: segment, vertical, account tier, churn risk, growth signal, fit score, funding stage, buying and pain signals, and 24 more. Contacts get 4 enriched properties: kustiq_email_confidence, kustiq_contact_role, kustiq_contact_department, kustiq_contact_seniority. That is 37 writeable fields total. Counts match the HowTo schema, the FAQ schema, and the property reference below, in that order.

With Kustiq, a company record refreshes every time you run a sync. With raw HubSpot, the same record stays whatever the rep typed at create time.

Setup, in 5 minutes

Six steps. HubSpot-side OAuth, no API key paste, no IP allowlist. Refresh token encrypted at rest.

01

Open Integrations in your Kustiq workspace

~ 20 seconds

From the dashboard, go to Settings → Integrations. Find the HubSpot card, click Connect. You stay signed into Kustiq the whole time.

Integrations page · /dashboard/integrations480 × 270

02

Authorise the OAuth consent screen

~ 40 seconds

HubSpot opens its consent dialog. Pick the portal, review the six scopes (crm.objects.companies.read, crm.objects.companies.write, crm.schemas.companies.read, crm.schemas.companies.write, crm.objects.contacts.read, crm.objects.contacts.write), click Connect app. HubSpot redirects back to Kustiq and the integration card flips to Connected.

HubSpot OAuth consent · app.hubspot.com480 × 270

03

Choose what to import

~ 30 seconds

Pick a HubSpot company list or all companies. Kustiq imports name, domain, and the HubSpot record ID, then matches each row against the Kustiq profile graph. Empty domains are skipped, not enriched.

Import modal · list picker + match preview480 × 270

04

Confirm the matched profiles

~ 1 minute for 100 rows

Kustiq shows the match table: HubSpot name on the left, Kustiq profile on the right. Matching is by domain; rows with an empty or free-mail domain stay unmatched instead of being guessed. You confirm and the import queue starts.

Profiles list · matched companies480 × 270

05

Run the first sync

~ 2 minutes for 1,000 rows

Click Sync now. Kustiq writes 33 company properties and 4contact properties to every matched record, in batches of 100, respecting HubSpot’s 100-req/10-sec rate limit. Progress shows per-batch status and skipped reasons.

Sync button · live progress + batch counter480 × 270

06

Verify in HubSpot

~ 30 seconds

Open any synced company in HubSpot. The right sidebar shows a Kustiq section with all 33 company properties, prefixed kustiq_*. The 4 contact properties land on the contact card, same prefix. Run Sync now again anytime to push fresh enrichment.

HubSpot company sidebar · kustiq_* properties480 × 270

Property reference

Every property is namespaced kustiq_* so it never collides with anything you already have. 33 company + 4 contact = 37 enriched properties. Counts match the HowTo + FAQ schemas. If a number disagrees somewhere, this section wins.

Permissions and scopes

Kustiq requests six HubSpot scopes, no more. You can revoke any of them from HubSpot → Settings → Integrations without contacting support.

• crm.objects.companies.read · read native HubSpot company fields (name, domain, industry, numberofemployees) for matching against the Kustiq profile graph.
• crm.objects.companies.write · write the 33 kustiq_* company properties on matched records.
• crm.schemas.companies.read · check the kustiq_*property group exists and matches Kustiq’s expected schema on every sync.
• crm.schemas.companies.write · create the kustiq_* property group on first connect, once per portal.
• crm.objects.contacts.read · read contact name, email, associations so contact role and seniority can be attributed to the right person.
• crm.objects.contacts.write · write the 4 kustiq_* contact properties (email confidence, role, department, seniority). No native contact field is ever overwritten.

Kustiq does not request files, tickets, e-commerce, deals, or any conversation scope. If your IT review asks for a written list of what we touch, the six lines above are the answer.

Webhooks

Kustiq sends a webhook to your endpoint every time a company or contact is enriched. Each request is signed with HMAC-SHA256 over the raw body, using a shared secret you generate per workspace.

The signature lives in the X-Kustiq-Signature header as a bare 64-character hex digest. The body has a top-level timestamp field (unix seconds) for replay protection. Reject any request whose computed signature does not match in constant time. Reject any request whose body timestamp is older than 5 minutes.

// Express handler. Use express.raw({ type: "application/json" }).
const crypto = require("crypto");
const SECRET = process.env.KUSTIQ_WEBHOOK_SECRET;

function verify(req) {
  const sig = req.headers["x-kustiq-signature"] || "";
  if (sig.length !== 64) return false;

  const mac = crypto
    .createHmac("sha256", SECRET)
    .update(req.body)
    .digest("hex");

  const ok = crypto.timingSafeEqual(
    Buffer.from(mac, "hex"),
    Buffer.from(sig, "hex"),
  );
  if (!ok) return false;

  // Replay check: body has top-level "timestamp" (unix seconds).
  const body = JSON.parse(req.body);
  return Date.now() / 1000 - body.timestamp < 300;
}

Retry policy: a non-2xx response or no response inside 10s triggers one retry 5 seconds later. After that the event is dropped; every attempt is logged with status code and latency.

Sync rules

• Cadence. On demand. Every Sync now run rewrites all matched records. On Pro, Kustiq also refreshes churn signals from HubSpot once a day.
• Direction. Properties flow one way, Kustiq to HubSpot. On Pro, Kustiq reads deal and contact-activity counts daily to power churn scoring; it never reads email content.
• Conflict. Kustiq only writes kustiq_* properties. Native HubSpot fields (industry, numberofemployees) are read for matching, never overwritten.
• Match key. Domain, normalized (lowercase, www and email prefixes stripped). Rows without a usable domain are skipped, never guessed.
• Rate limit. 100 requests / 10 seconds, batched 100 records at a time. Rate-limited batches are logged; re-running the sync retries them.
• Disconnect. Revoking from HubSpot stops new writes. kustiq_* properties stay on records until you delete the property group.

Troubleshooting

Twelve known states. Each has a stable anchor so you can link a teammate to the exact row.

FAQ

Changelog

• 2026-05-16 · v2.1 Pair-lock production-ready audit. Scope list corrected to six (crm.objects.companies.read/write, crm.schemas.companies.read/write, crm.objects.contacts.read/write) to match the actual OAuth grant. Webhook verifier snippets rewritten to match the bare-hex X-Kustiq-Signature header the server emits. Free-tier copy unified to 3 profiles a week across hero, mid-CTA, final CTA, and JSON-LD. Pricing fixed in ERR_QUOTA_FREE (Insight 200 credits, Pro 800 credits). JSON-LD @id-graph linked to root #org and #site.
• 2026-05-08 · v2.0 Property count clarified to 33 + 4 = 37 across docs, JSON-LD, and OG. Webhook section adds verification snippets. Six setup-step screenshots wired to HowToStep schema. New “Last verified” badge.
• 2026-03-08 · v1.0 Initial release.