# IP allowlist for HubSpot

*Restrict HubSpot logins to trusted IP addresses, also called an IP whitelist.*

HubSpot can refuse sign-ins from any address that isn’t on your list. It is one of the few SaaS allowlists available below Enterprise, which makes it one of the cheapest ways to keep a CRM full of customer data away from a phished password.

## What this control covers

- Sign-ins to your HubSpot account, on computers and on the mobile app.
- Every user in the account, except those you exempt one by one.

## What it doesn’t cover

- API calls with private app tokens and OAuth integrations: HubSpot’s documentation describes the setting only for logins, so treat integrations as outside it until you have tested them.
- Scoping by team or role: the list applies to the whole account.
- Anyone who already has a valid session; HubSpot doesn’t say whether saving the list ends existing sessions, so sign suspicious users out yourself.

## The plan you need

A Starter, Professional or Enterprise subscription; the free tools don’t include it. Only a Super Admin can change it. Source: [HubSpot: manage login and account access settings](https://knowledge.hubspot.com/account-security/limit-logins-to-trusted-ip-addresses).

## Why an allowlist needs fixed IPs

An IP allowlist is only as good as the addresses on it. Home and mobile IPs change without notice, so a list of your team’s own addresses locks people out every few weeks, and someone ends up adding a broad range or switching the control off.

A shared VPN looks like a fix, but its exit IP belongs to every customer of that VPN server. Allowlisting it lets them in too.

What works is a small set of addresses that belong to your team alone and don’t change: your team’s traffic to the service leaves from them, and nothing else does.

## Add your own IP first

> HubSpot applies the list to every non-exempt user as soon as you save it, on the mobile app too. Put the IP you are on right now in the list, and exempt one Super Admin who can switch the setting off if your fixed IPs ever become unreachable. Don’t also turn off HubSpot employee access on the same day: that removes HubSpot support as a way back in.

## Set it up

1. **Collect the addresses.** Write down the fixed IPs your team’s traffic to HubSpot will leave from. With a Gate pair that is two addresses, for example `203.0.113.10` and `203.0.113.11`. Add the office IP only if it is static and nobody else shares it.
2. **Open the login settings.** In HubSpot, click the settings icon, then under Account management choose **Security**, open the **Login** tab and go to **Account restrictions**.
3. **Turn on allowed login IPs.** Switch on **Allowed login IPs** and enter your addresses under **Allowed IP Addresses**. Separate addresses with commas; for a range, HubSpot asks for a dash between the first and last address, not CIDR notation.

   ```
   203.0.113.10, 203.0.113.11
   ```
4. **Exempt your break-glass admin.** Under **Exempt Users**, tick one Super Admin who should still be able to sign in from anywhere. Keep that account’s password and MFA in your safe, not in daily use.
5. **Save.** Click **Save**. Keep your current HubSpot tab open until you have checked the next section.

## Check that it works

1. **Sign in through your fixed IPs.** From a browser whose traffic to HubSpot leaves from an allowed IP, sign in in a private window. It should work as before.
2. **Sign in from somewhere else.** From a phone on mobile data, or any network that isn’t on the list, try to sign in with a non-exempt user. HubSpot should refuse the login.
3. **Test your integrations.** Run one sync for each connected app and private app. If one of them stops working, it is calling from an address you haven’t allowed; if they all keep working, the allowlist doesn’t apply to them, and those tokens need their own protection.

## Where the fixed IPs come from

Teicho sends your team’s traffic to the service through a pair of Gates dedicated to your team, each with a fixed IP. Allowlist both, and the service sees only your people and machines, each signed in as themselves, while everyday browsing still goes straight to the internet. Teicho is in early access.

## FAQ

### Is this the same as an IP whitelist for HubSpot?

Yes. HubSpot calls the setting Allowed login IPs; many people search for it as an IP whitelist. It is an allowlist of addresses that may sign in.

### Can I restrict HubSpot logins by IP on the free plan?

No. HubSpot lists Starter, Professional or Enterprise as required, and only a Super Admin can change the setting.

### Does HubSpot accept IPv6 addresses or CIDR ranges?

HubSpot’s documentation mentions only commas between addresses and dashes for ranges, and says nothing about IPv6 or CIDR. Use single IPv4 addresses or dash ranges, and test anything else before you rely on it.

### Why not just add everyone’s home IP?

Home and mobile IPs change, so people get locked out and the list grows until it protects little. Fixed IPs that only your team’s traffic leaves from keep the list short and correct.

### Should I use allowed login locations instead?

Country or state limits are a useful extra layer, but anyone in an allowed country still gets through. An IP allowlist is much narrower.

## Sources

- [HubSpot: manage login and account access settings](https://knowledge.hubspot.com/account-security/limit-logins-to-trusted-ip-addresses)

Plans, limits and steps on this page were checked against the vendor’s documentation on 2 November 2026. Vendors change them; if something here is out of date, tell us at hello@teicho.io.