Step-by-step guide to installing and configuring Strac AI DLP for HubSpot: detect and redact SSNs, card numbers, PHI, and 100+ data types in Conversations and CRM, with audit trails for HIPAA, PCI, SOC 2, ISO 27001, and GDPR.
Short answer: Strac is an AI data loss prevention (DLP) app for HubSpot. Once connected, it detects and redacts sensitive data (SSNs, card numbers, PHI, API keys, and 100+ types) in your HubSpot Conversations and CRM in real time, keeps the original in an audited vault, and gives you an audit trail for HIPAA, PCI DSS, SOC 2, ISO 27001, and GDPR. This guide walks through install, configuration, and day-to-day use.
Strac is an AI data loss prevention (DLP) app for HubSpot. Once connected, it watches your HubSpot Conversations inbox (email, chat, and form threads) and CRM engagements (logged emails, notes, calls, meetings, SMS) in real time, including attachments and inline images. When a customer or teammate shares sensitive data (Social Security numbers, credit or debit card numbers, bank account and routing numbers, driver’s licenses, passports, health information, API keys, and 100+ other types), Strac detects it within seconds and, according to your policy:
Redact is the default enforcement action; in configuration you can switch it to Mask, Label, or Alert only (see step 3). Strac uses OCR and ML detectors, so it also finds data inside PDFs, images, Office documents, and spreadsheets attached to conversations.
Typical use cases: support teams receiving card numbers or IDs in the shared inbox; healthcare and fintech companies that must keep PHI and PCI out of the CRM; and compliance teams who need evidence that sensitive data is remediated, not just flagged.
1. Open the Strac listing in the HubSpot App Marketplace and click Install app (or go directly to the install link your Strac onboarding contact sent you).
2. HubSpot shows "Connecting Strac to HubSpot, Choose an account." Select the HubSpot account you want to protect and click Choose Account.
3. Review the permissions Strac requests and click Connect app. Strac asks for read access to conversations, CRM objects (contacts, companies, deals, tickets, custom objects), files and forms, sales emails, timeline, and content, plus write access so it can redact sensitive values in place and apply labels. Strac never changes anything other than the sensitive values it detects.
4. You are redirected to a Strac confirmation page: "Success! We have received your onboarding request and will contact you shortly." Installation is complete.
After you install, the Strac team links the HubSpot connection to your Strac workspace, usually within one business day. You will receive an email from hello@strac.io confirming the link, or you can reply to your onboarding thread to confirm immediately. If you installed before you had a Strac account, reply to that email and we will create the workspace for you.
Once linked, Strac begins receiving new-conversation and new-message events from HubSpot automatically. Nothing else needs to be installed; there are no browser extensions, proxies, or agents.
Sign in to the Strac dashboard and open Integrations → HubSpot:
Optionally request a backfill so Strac scans existing conversations from a start date you choose. Your Strac onboarding contact can configure all of this with you on a 20-minute call.
Automatic: every new HubSpot conversation message or engagement is scanned as it arrives. When sensitive data is found, the message in HubSpot is replaced with a redacted version that keeps the sender, subject, time, and body, marks each redacted value, and lists the data types detected (for example "Sensitive info detected: BANK_ACCOUNT_NUMBER, CREDIT_DEBIT_NUMBER"). Your team keeps working in HubSpot as normal.
Manual: in the Strac dashboard, open Findings to see every detection with the HubSpot record it came from, the data types found, who sent it, and when. Authorized admins can open the original from the Secure Vault, mark a detection as a false positive, re-run detection, export findings, or download compliance reports mapped to HIPAA, PCI DSS, SOC 2, ISO 27001, and GDPR.
In the Strac dashboard go to Integrations → HubSpot → Disconnect, or email hello@strac.io and we will disconnect it for you the same business day. Strac immediately stops receiving events from HubSpot and stops scanning.
In HubSpot, go to Settings → Integrations → Connected apps, find Strac, click Actions → Uninstall, and type "uninstall" to confirm. This revokes Strac’s OAuth token; Strac can no longer read or write anything in your HubSpot account.
Strac processes new HubSpot conversation messages and CRM engagements to detect and redact sensitive data. It acts only on the sensitive values your policy covers and never changes anything else, and you control which inboxes and engagement types are in scope.
Messages Strac already redacted stay redacted; uninstalling does not restore the original values into HubSpot. Originals in Strac's Secure Vault remain available to authorized admins for your retention period, and Strac stops receiving new data the moment you disconnect or uninstall. Email hello@strac.io to purge vault data sooner.
Yes. In Integrations, HubSpot you pick the detectors (SSN, credit card, bank account, PHI, API keys, and 100+ more) or add a custom detector described in plain English, and choose whether Strac redacts, masks, labels, or only alerts.
When you choose Redact, Strac replaces the value in HubSpot and keeps the original in an audited Secure Vault so authorized admins can view it when needed. You set the retention period and can request deletion at any time.
.avif){kind=icon}
.gif)
.webp)
