The least access the job needs, and none after.

The token can’t write. Preflight requests only the least-privilege read scopes it needs:

• Attio: record_permission:read, object_configuration:read, list_configuration:read, list_entry:read, task:read, user_management:read.
• HubSpot: crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read, crm.objects.owners.read, and the three crm.schemas.*.read scopes.

With that scope list, the token couldn’t write a change even if it tried.

The scanner won’t ask, either. It carries a fixed list of read-only requests and blocks anything else before it goes out. The HubSpot client has no method for sending an edit or a delete. Preflight never writes to your CRM.

• Reads: contacts, companies and deals, their field definitions, your deal pipeline stages, and your list of users or owners.
• Doesn’t read: emails, notes, call recordings, custom objects, billing, or anything outside your CRM.

The report holds scores, counts, up to five record IDs per finding so you can check our work, field names, and, for the job-title check, the conflicting spellings we found. It isn’t a copy of your data.

The report goes into one Google Drive folder you share with us, restricted to our account.

Scan data is deleted within 30 days unless you hire us. That covers both the scan output and our working copy of it. If you hire us, that same data becomes the “before” half of your handover pack.

It comes to us through a one-time secret link from a password manager, or gets pasted live on a screen-share. Never in Slack, never in email, never in the shared folder.

Where it lives. Preflight and build tokens stay in the studio machine’s system keychain, one entry per client. They’re never written to a plain file, printed or logged. The HubSpot scanner refuses to run at all if the token arrives any other way.

• Read-write, and only on what the build actually touches. Attio: records, object and field setup, lists, tasks, webhooks. HubSpot: contacts, companies, deals, and their field definitions.
• Never: billing, adding or removing your users, installing apps, or deleting your workspace.
• Snapshot first. We export a snapshot before any bulk change. Everything we add gets tagged, so it can be found and pulled back out.

Each teammate opts in. Nobody’s connections get mapped unless that person chooses to share their own export. We use what they share to map paths for your sprint and for nothing else.

We never contact anyone. We don’t message your teammates’ connections and we never email your prospects. Intro briefs go to your teammate, who decides whether to ask.

Access keys are revoked and deleted at handover. Preflight access is gone the moment you have the report, whether you buy anything after or not. Nothing sits live “just in case”. You can revoke it yourself, any time, too:

• Attio: Workspace settings → Developers → find the token → Delete.
• HubSpot: Settings → Integrations → Private Apps → the app → Actions → Delete.
• Google Drive: remove our account from the folder.

Each takes effect immediately.

• Send email, messages or anything else outside your company on your behalf. Your reps send; we never email your prospects.
• Ask for admin, billing or user-management rights.
• Write to your CRM during a Preflight.
• Map a teammate’s connections without that teammate opting in.
• Leave access live after the work is done.