Yes. HubSpot partners build customer portals on HubSpot CMS every week, and some of them work well for years. The more useful question is what happens once the business depends on one.
By portal we mean a website your clients, partners or members log in to and get something done: submit a request, follow it, see their own records, reply to your team. (HubSpot also calls every customer account a “portal”. That isn’t what this piece is about.)
Searching for HubSpot’s own customer portal? HubSpot now calls it the support portal. It comes with Service Hub Professional or Enterprise and gives clients a login to see and manage their support tickets, and nothing but tickets. We cover where it fits below. The rest of this piece is about portals that have to do more.
A content management system is built to publish to strangers. Its job is to get pages in front of people who don’t know you yet, measure what they read and hand the promising ones to sales. A portal works the other way round. Look at who actually logs in to one, and it’s almost never a prospect. Every person signing in is someone the firm already knows, and the portal is how the firm does business with them.
That difference decides more about where the portal should live than any feature list.
Why partners build portals on HubSpot anyway
The reasons are mostly practical, and some of them are good. The client already pays for Content Hub, so the platform looks free. The CRM is right there. The partner’s developers know HubSpot’s template language, and the project gets scoped and sold as a website build, which is what a HubSpot partner is set up to deliver.
We know these reasons well, because we were that partner for 16 years. Lynton published guides to building logins, private content and custom back ends on HubSpot from 2015 to 2024, and we wrote about what we got wrong in We Taught Companies to Build Portals on HubSpot for Ten Years.
None of those reasons is about what the portal needs.
What does a portal need that a website doesn’t?
Five things, and a marketing site needs almost none of them. A portal has to know who someone is and keep them signed in. It needs somewhere for logic to run on every request. It needs somewhere to keep the records it creates. It needs a safe way to change it, and a security model that checks every request against the person making it.
HubSpot supplies a version of each. Each version was designed for marketing pages, and each comes with a limit the portal’s owner doesn’t control.
| What a portal needs | What HubSpot provides | Where it strains | What it costs the business |
|---|---|---|---|
| Sign-in | Memberships: access groups, a registration email, HubSpot’s password rules | The flow, the emails and the rules are HubSpot’s | Your clients’ first impression is the vendor’s |
| Logic | Serverless functions (Content Hub Enterprise) | 10 seconds each, one shared per-minute budget, rules that change by platform version | The portal’s ceiling and upgrade calendar are set by the vendor |
| Records | HubDB tables or CRM objects through the API | Table caps, API allowance shared with every integration | The record of how you serve clients lives in a marketing tool |
| Change | Developer test accounts, CMS sandboxes, Content Staging | None of them is a copy of the live portal | Changes get their first full test in front of clients |
| Security | Private pages, plus whatever the builder writes | Checking who may see which record is left to the code | Your exposure depends on one developer’s diligence |
Who can log in, and how?
On HubSpot, signing in follows HubSpot’s flow. Memberships need Content Hub or Service Hub at the Professional or Enterprise tier, and they only work on your own connected domain. A contact gets access by joining an access group (Professional accounts get two, Enterprise accounts 100), and HubSpot sends them a registration email to set a password. The password rule is HubSpot’s: “at least 12 characters long” with mixed characters. Forget it, and the reset is another email, from a budget of five membership emails per contact per day. 1 Source 1 HubSpot Knowledge Base, “Create and manage access groups for private content,” updated September 29, 2026: Service Hub or Content Hub Professional or Enterprise; legacy CMS Hub Professional accounts don’t support memberships; up to two access groups on Professional and 100 on Enterprise; “Passwords must be at least 12 characters long and contain an uppercase letter, a lowercase letter, a number, or a symbol”; “Each contact can receive a maximum of five membership-related emails per day”; private content works only on connected subdomains.
To be fair to HubSpot, there are other options. You can turn on self-registration, let members sign in with a social account, or send a sign-in link that “will expire after 15 minutes.” You can sign people out after anything from 15 minutes to 24 hours of inactivity. 2 Source 2 HubSpot Knowledge Base, “Manage settings for private content,” updated December 12, 2025: self-registration, social sign-on, and password-less sign-in by email link (“The link in the email will expire after 15 minutes”); idle sign-out from 15 minutes up to 24 hours.
Every one of those options is still HubSpot’s flow on your domain, with HubSpot’s emails and the parts of the page a theme is allowed to change. For a firm moving a network of people it already knows off email and onto a portal, that matters more than it sounds. Sign-in is the one part of a portal every user touches every time, and on HubSpot it’s the part you control least.
What that costs a portal, and what a better sign-in looks like, is in HubSpot Memberships: What Your Clients See, and What You Can’t Change.
The portal’s logic runs on HubSpot’s clock
Anything a HubSpot portal does beyond showing a page runs as a serverless function: filling an intake form with what the CRM already knows, listing a client’s open requests, saving a reply. Serverless functions are a Content Hub Enterprise feature, and HubSpot sets their terms.
On the CMS, each function gets 10 seconds and 128 MB of memory. The whole account gets 600 execution seconds per minute, shared by every function on it, and calls beyond that are refused with an error. 3 Source 3 HubSpot Developers, “Serverless functions reference” (CMS), read October 30, 2026: 10 seconds of execution time, 128 MB of memory, “Each account is limited to 600 total execution seconds per minute,” with calls over the limit returning a 429 response; 50 secrets and 100 endpoints per account; nodejs20.x only. HubSpot Developers, “HubSpot CMS overview”: “Serverless Functions are a Content Hub Enterprise feature.” Do the arithmetic for a busy Monday. A CRM lookup that takes five seconds, called 120 times in a minute, spends the entire budget. Every other function in the portal starts failing until the minute rolls over.
Then there is the platform itself. HubSpot’s docs say serverless functions are not supported on version 2025.2 of its developer platform, so projects that need them stay on 2025.1. Version 2026.03 brought them back, with a 15-second timeout and a new restriction: “Apps using OAuth for authentication cannot use 2026.03 serverless functions.” 4 Source 4 HubSpot Developers, “Serverless functions overview” (CMS), read October 30, 2026: serverless functions are not supported in version 2025.2 of the developer platform; use 2025.1. HubSpot Developers, developer platform “Serverless functions overview” and “reference”: “Starting with version 2026.03, apps built on the developer platform fully support and deploy serverless functions”; a 15 second execution timeout; “Apps using OAuth for authentication cannot use 2026.03 serverless functions.” Each of those changes is work the portal’s owner didn’t schedule and can’t refuse.
The portal’s ceiling isn’t set by what the business needs. It’s set by a marketing vendor’s roadmap.
The full platform timeline, and what the limits rule out, is in HubSpot Serverless Function Limits for Client Portals (2026).
Where do the portal’s records live?
A portal creates records. A single request can produce the request itself, three replies, two attachments, an approval and a history of who changed its status. HubSpot has no application database to put them in, so they go one of two places.
The first is HubDB, a table store built to feed web pages: team directories, resource libraries, location finders. It holds 10,000 rows per table and a million per account, and a page can query it ten times. 5 Source 5 HubSpot Developers, “HubDB,” read October 30, 2026: 1,000 tables and 1 million rows per account; 10,000 rows and 250 columns per table; 10 calls to the hubdb_table_rows function per CMS page. That’s plenty for a resource library and a squeeze for the history of every client conversation.
The portal’s ceiling isn’t set by what the business needs. It’s set by a marketing vendor’s roadmap.
The second is the CRM itself: tickets, custom objects, associations, all reached through HubSpot’s API. Each app gets 190 requests every 10 seconds, and the daily allowance (625,000 on Professional, a million on Enterprise) is “shared across all apps within the same HubSpot account.” 6 Source 6 HubSpot Developers, “API usage guidelines and limits,” read October 30, 2026: private apps on Professional and Enterprise get 190 requests per 10 seconds per app, and 625,000 (Professional) or 1,000,000 (Enterprise) requests a day, “shared across all apps within the same HubSpot account.” The CRM search, associations and GraphQL APIs have stricter limits of their own. Your portal competes with your integrations for the same budget.
Either way, the record of how you serve each client lives in a tool designed to market to them, and it leaves under that vendor’s export rules. We’ve written about what that means for your data layer and about the ownership HubSpot implies but doesn’t give.
We follow a portal’s records through HubDB and the CRM in Is HubDB a Database? HubDB vs Custom Objects for Portals.
There’s nowhere to rehearse a change
Portals change every month. A department joins, a field gets added, a bug gets fixed. On HubSpot there’s no full copy of the live portal to try those changes on first.
HubSpot’s advice is to build in a developer test account, which gives you somewhere to work “without impacting a standard HubSpot account,” or in a CMS developer sandbox. Its Content Staging tool stages pages for a redesign, and HubSpot itself recommends a developer sandbox, not staging, for changes to themes, templates and modules. 7 Source 7 HubSpot Developers, “HubSpot CMS overview,” read October 30, 2026: a developer test account gives “a testing environment to build out your CMS assets without impacting a standard HubSpot account,” or “you can create a CMS developer sandbox account.” HubSpot Developers, “Content staging”: “For building and testing changes to assets like themes, templates, modules, we recommend using a developer sandbox account.” The catch is that a test account is a separate account. Your live content isn’t in it. Neither are your CRM records, your access groups or the contacts whose permissions the change might break.
So the first complete test of a change is the moment clients see it. Teams respond the way you’d expect. They change the portal less often, and the knowledge of how it fits together ends up with whoever made the last change. When that person moves on, the portal becomes something nobody wants to touch, which feels like stability and is closer to being stuck.
What that does to a team, and what a safe release process looks like, is in Does HubSpot Have a Sandbox? Not One That Copies Your Portal.
Who is responsible for security?
Making a page private on HubSpot controls who can see it. It doesn’t make the portal secure, and HubSpot doesn’t claim it does. Of pages protected by a shared password, HubSpot’s own help page says “sensitive data isn’t encrypted.”
The bigger question sits in the code. When a client’s dashboard asks for “requests for client 123,” something has to check that the person asking is client 123. HubSpot tells a function whether the visitor is a logged-in member, but only when the request comes from a recognized contact, and using that answer correctly is the builder’s job. On HubSpot’s 2026.03 platform, a function’s public endpoint is, in HubSpot’s words, “a publicly accessible endpoint (without authentication),” and the docs suggest “implementing your own authentication logic.” 8 Source 8 HubSpot Knowledge Base, “Create and manage access groups for private content,” updated September 29, 2026, on password-protected content: “sensitive data isn’t encrypted.” HubSpot Developers, “Serverless functions reference” (CMS): context.contact.isLoggedIn is true when the contact is logged in, and the contact object is populated only for a cookied contact. Developer platform “Serverless functions reference”: the endpoint config “defines a publicly accessible endpoint (without authentication)”; “Consider implementing your own authentication logic (API keys, tokens, etc.)”.
If the code trusts the number the browser sends, any client can read any other client’s requests by changing it. OWASP ranks broken access control, the family this flaw belongs to, first among web application security risks. 9 Source 9 OWASP Top 10:2025, “A01 Broken Access Control,” read October 30, 2026: the category holds “its position at #1 in the Top Ten” and includes “permitting viewing or editing someone else’s account by providing its unique identifier (insecure direct object references).” Nothing in the platform prevents it.
Regulated firms have one more question to answer. If clients and staff message each other through the portal, that correspondence may have to be archived and produced on request. HubSpot doesn’t do that for a custom portal. Someone has to build it.
The questions to put to whoever built or runs a portal are in Is HubSpot Private Content Secure? 12 Questions to Ask.
When is HubSpot the right home for a portal?
More often than this piece might suggest. HubSpot memberships are a good fit when the portal publishes rather than records: a resource library for customers, a partner area with sales materials, documentation by product tier. Access is decided by a list, the content changes a few times a month, and nothing in it would interest an auditor.
HubSpot has two more homes worth knowing. Its support portal (Service Hub Professional or Enterprise) gives clients a login to see and reply to their tickets, and “only tickets will appear” in it. For your own staff, app cards put custom tools inside HubSpot’s screens: on record pages, in the preview panel, in the help desk. 10 Source 10 HubSpot Knowledge Base, “Set up a support portal,” last updated October 23, 2026: Service Hub Professional or Enterprise; the support portal replaces the legacy customer portal; “Only tickets will appear in the support portal.” HubSpot Developers, “UI extensions overview,” read October 30, 2026: app cards appear on CRM record pages, in the CRM preview panel, in the help desk sidebar and on app home and settings pages. If your needs fit one of those, use it.
The trouble starts when a portal that keeps records, runs logic on every page and serves people outside the company gets built in the CMS because it was the platform the firm already paid for.
What you gain when the app lives where it should
You don’t have to leave HubSpot to stop building apps on it. You can keep HubSpot for what it does well (contacts, pipeline, marketing email) and put the portal somewhere built for applications, with the two connected.
What changes is who sets the limits. Sign-in is designed around your clients: the account they already use, one step from invitation to first login, your wording on every screen. The back end runs as long as the work needs, so the slow jobs a firm actually wants (generating documents, importing files, copying correspondence to an archive) stop being off the table. Client records sit in a database you own and query, and HubSpot receives what it needs from them rather than the other way round. Every change gets tried on a full copy of the portal, reviewed and recorded, and can be reversed in minutes. Your compliance lead gets a security model they can describe to an auditor.
That is the difference between a portal you maintain and a portal you build on. Over five years it shows up as features shipped instead of workarounds, and as a client experience that belongs to your brand.
Where the portal should live depends on six questions about what it has to do, and three of the five homes we’d consider are HubSpot’s own. We walk through them in Custom Client Portal or HubSpot? 5 Options Compared. For the wider pattern of how SaaS platforms make leaving expensive, start with the Five Locks.
The research is free. So is the diagnosis. 60 seconds →