What This Update Actually Is
HubSpot shipped App Install Governance as a public beta on April 10, 2026. It lives inside Settings, under Integrations, under Connected Apps, in a new tab called Approved Apps.
Super Admins can now do four things they couldn't do before from one place:
- Approve which apps are allowed in the account before anyone installs them.
- Control which humans can install each approved app, down to specific users if needed.
- Customize optional data permissions per app, such as choosing read-only versus write access for AI connectors.
- Revoke approval at any time, which automatically uninstalls the app for every user in the account within 30 minutes.
This beta covers all AI connectors, including the HubSpot connectors for ChatGPT, Claude, and Gemini. One important caveat: some HubSpot-built integrations aren't supported yet. Data sync integrations, inbox integrations like Gmail and Outlook, and other HubSpot-developed apps are outside this system for now.
Why HubSpot Shipped This
Here's the honest problem. HubSpot portals grow fast. A sales rep connects a prospecting tool. A marketer links a new social app. Someone on the ops team installs an AI connector to speed up their workflow. Nobody asks. Nobody tells the admin.
Six months later, there are a dozen apps installed across the account. Some have write access to contact records. Some are sharing data with external AI models. The admin has no idea what's in there or what those apps can touch.
We see this pattern constantly in portal audits. The integrations tab looks like a junk drawer. And when a compliance question comes up, nobody can answer it quickly. This update is HubSpot's direct response to that gap.
The internal frustration it addresses is real: admins feel like they're always playing catch-up, and the humans using the portal feel confused about what they're even allowed to install. This feature makes the rules clear for everyone.
How to Use It Step by Step
- Go to Settings, then Integrations, then Connected Apps. Look for the new Approved Apps tab.
- Browse available connectors and select the ones you want to approve for your organization.
- During approval, decide who can install the app: Super Admins only, specific named users, or everyone in the account.
- For AI connectors and any app that supports optional permissions, review data access settings. Required permissions can't be disabled, but optional ones are yours to configure.
- Confirm approval. The app now appears in your Approved Apps table where you can monitor usage at any time.
- When a user wants an unapproved app, they can submit a request from inside HubSpot. You'll get a notification you can approve or deny.
- To revoke access, return to the Approved Apps table, select the app, and remove approval. The app uninstalls for all users within 30 minutes.
What It Touches in Your HubSpot Strategy
This isn't just a settings feature. It ripples into several areas of how you run your portal.
Data governance is the biggest one. Every app you approve is a data access decision. When you choose read-only versus write access for an AI connector, you're deciding whether that connector can modify contact records, company records, or deal data. That's not a small call.
Key Takeaway
Treat each app approval as a data governance decision, not just an IT checkbox. Document why each app was approved and what permissions you granted. Your future self and your auditor will thank you.
AI strategy is the second ripple. Tools like Breeze are expanding fast inside HubSpot, and external AI connectors are growing alongside them.
As HubSpot's native AI capabilities grow, like the Prospecting Agent's buying signal detection, you need a clear framework for which AI tools can touch your data and which can't. App Install Governance gives you the on/off switch.
Compliance and security reviews become much faster. Instead of pulling up every integration one by one and trying to remember what access each one has, you have a single table that shows approved apps, who can use them, and what permissions they carry.
If you run regular portal audits, this tab should be part of your standard review. We cover the full integrations section in our HubSpot portal audit checklist, and App Install Governance makes that checklist easier to act on.
Key Takeaway
The 30-minute uninstall delay matters for compliance. If a security incident involves an app, revoke approval immediately but plan for a short window before access is fully cut. Don't assume it's instant.
Change management is the quieter benefit. When humans on your team know there's an approval process, they stop shadow-installing tools. That alone reduces data sprawl over time.
Who Should Care Most
This update matters most for the humans who own portal governance. Here's who should move on it first:
- Super Admins at companies with 10 or more HubSpot users. The more humans you have in the portal, the more app sprawl risk you carry.
- RevOps and Marketing Ops leaders who are responsible for data integrity and need to know what's touching CRM records.
- Companies in regulated industries like healthcare, finance, or legal where data access controls are required, not optional.
- Any organization actively adopting AI tools. If your team is experimenting with ChatGPT, Claude, or Gemini connectors, you need this governance layer in place before you scale those experiments.
- Agencies and consultants managing HubSpot portals on behalf of clients. A single unapproved app can create a data liability for your client.
George's Take
I've been inside hundreds of HubSpot portals. The integrations tab is almost always one of the messiest spots. Admins inherit apps they didn't install, don't know what permissions they carry, and don't have a clean way to enforce standards. What HubSpot shipped here isn't flashy, but it's genuinely important. The moment you give humans on your team an official request workflow, you shift the culture from "install first, ask never" to "here's the process." That shift is where real data governance starts. Set this up now, document your decisions, and make it part of your onboarding so every new team member understands the rules before they start connecting tools.
“App governance isn't about slowing your team down. It's about building the trust layer that lets them move faster without breaking things.”
App Install Governance pairs directly with strong data hygiene practices. If you're not sure how clean your current portal data is, our ultimate guide to data hygiene is a good place to start.
If you want a second set of eyes on your current integrations setup or you need help building an app governance policy for your organization, let's talk. Book a strategy call with the Sidekick team and we'll walk through your portal together.
Frequently Asked Questions
What is HubSpot App Install Governance?
App Install Governance is a HubSpot beta feature that gives Super Admins centralized control over which apps can be installed in their account, who can install them, and what data permissions each app receives. It covers all connected apps, including AI connectors for ChatGPT, Claude, and Gemini. It's available across all hubs and tiers.
Who can approve or revoke apps in HubSpot's App Install Governance?
Only Super Admins can approve apps, set permissions, or revoke access. Regular users who want to install an unapproved app can submit a request from inside HubSpot, and the Super Admin receives a notification to approve or deny it. This keeps oversight centralized without blocking legitimate requests.
How do I set up App Install Governance in HubSpot?
Go to Settings, then Integrations, then Connected Apps, and open the Approved Apps tab. From there you can review available connectors, approve the ones you want to allow, set who can install each one, and configure optional data permissions. Approved apps appear in a table you can monitor and update at any time.
What happens when a Super Admin revokes app approval in HubSpot?
When approval is revoked, HubSpot automatically uninstalls the app for every user in the account. The uninstall process takes up to 30 minutes to complete. Revoking approval for one user doesn't affect others unless you revoke the entire app, which removes it across the whole account.
Does HubSpot App Install Governance cover AI connectors like ChatGPT and Claude?
Yes. All AI connectors, including the HubSpot connectors for ChatGPT, Claude, and Gemini, are covered by App Install Governance. Super Admins can review and configure data permissions for these connectors during the approval process, choosing which optional permissions to grant or restrict.
Are there any apps that App Install Governance doesn't support yet?
Yes. Some HubSpot-built integrations aren't supported in the initial beta. These include data sync integrations, inbox integrations like Gmail and Outlook, and other HubSpot-developed apps. HubSpot has not announced a timeline for adding these to the governance system.
