A small software company had 4,873 contacts in HubSpot, and only 1,418 of them were HubSpot marketing contacts, the ones it could send marketing email to. Twenty-nine percent. The other 3,455 were flagged non-marketing, which in HubSpot means stored and visible but unmailable. Nobody had sat down and decided that 71% of the list should be out of reach. Only 239 contacts in the whole portal had opted out. The rest had been demoted by the company’s own automation, one contact at a time, to keep the HubSpot invoice down.
That is the whole story in one paragraph, and it is a common one. HubSpot prices Marketing Hub by the number of marketing contacts, so every portal on that pricing grows a set of rules whose only job is to decide who is worth paying for. Over a few years those rules do what rules do. They run. On this portal they had run 493,380 times. And because the thing they set is a billing flag, the company ended up with a list where the question “can we email this person” had been answered by a cost decision rather than by the person, and nobody could tell the two apart.
What HubSpot marketing contacts actually are
HubSpot’s marketing contact is a billable unit. 1 Definition 1 Marketing contact: HubSpot’s billable unit for Marketing Hub. A contact flagged marketable can receive marketing email and counts toward the subscription tier. A non-marketing contact is stored but cannot be sent marketing email. The flag is a billing status, not a record of consent. Flag a contact marketable and it can receive marketing email and counts toward your tier. Flag it non-marketing and it stays in the CRM, keeps its history, and cannot be sent marketing email. The flag is set by workflows, by import settings, by integrations, and by HubSpot’s own eligibility processing. It is not set by the person whose address it is.
Consent lives somewhere else entirely. An unsubscribe, a per-type opt-out, a hard bounce, a quarantine: those are separate properties on the contact, each with its own history. In principle the two systems are independent. In practice they get collapsed into one question on the list screen, which shows you how many people you can mail and never why.
The demotion does not even take effect when the rule fires. The action that made contacts non-marketing in this portal was typed “marketable until renewal”, and the portal carried a list named “Marketing contact until next update” to hold the people in limbo between the decision and the billing date. 2 Editor's note 2 The demotion is not immediate. The workflow action that sets a contact non-marketing in this portal carried the type “marketable until renewal”, and the portal kept a list named “Marketing contact until next update” to track contacts in that state. HubSpot’s own documentation describes when the change takes effect. A company managing its audience this way is not running a marketing program. It is running a subscription-tier thermostat, and the thermostat is wired to its customer database.
The machine that shrank the list
Seven enabled workflows in this portal existed to manage the marketing-contact flag and for no other reason. The first time we classified the 90 live workflows we marked all seven as HubSpot tax: cost control that dies with the contract and deserves no rebuild. Read as a set, they describe a machine.
One workflow demoted anyone who had received eight or more emails since they last engaged and had opened none of them. It had enrolled contacts 493,380 times since it was built in September 2022, in a portal of 4,873 contacts, and it had run 938 times in the week we read it. A second workflow was its re-entry valve, promoting people back when they engaged again. It had run 22 times in its life. Twenty-two promotions against nearly half a million demotions is the clearest number in the audit, and it says the machine was built to go one way.
A third workflow stamped a timestamp every time the flag changed, 3,744 times, so the sunset rule could be evaluated again later. A fourth demoted contacts whose company sat in a list of EU member states or whose email ended in one of a set of country suffixes, 1,561 times. A fifth handled bad-data contacts, writing their lead status and removing them as marketing contacts, 427 times. A sixth demoted every member of a merged bad-contact list, 836 times. The seventh was the only promotion rule that mattered: a form submission made a person marketable. It had run 167 times.
That last one deserves a sentence of its own, because it is the opt-in. When someone fills in a form on this company’s website and agrees to hear from them, the thing HubSpot records is a change to a billing flag. Not a consent record with a timestamp and a source. A flag that the sunset workflow could flip back eight unopened emails later, with no trace of what the person had actually agreed to.
Twenty-two promotions against nearly half a million demotions is the clearest number in the audit, and it says the machine was built to go one way.
Then the adversarial review overturned all seven of our deletions.
The reviewer’s argument was simple and correct. The billing motive dies with the contract, but the rules underneath do not. The engagement sunset is a deliverability policy, and a new sending domain needs one from the first send or a stale list burns it. The geographic exclusion is the company’s definition of its market, and the country list existed nowhere except inside that workflow’s enrollment criteria. The bad-data and bad-contact rules were years of accumulated knowledge about which addresses not to mail. Every one of those is a real business rule. HubSpot had simply offered one action to express all of them, and that action was the invoice.
So the seven are in the migration after all, as suppression lists and segment exclusions in a platform where “do not mail this person for now” and “this person did not agree to be mailed” are different fields. The review overturned 12 of our 27 proposed deletions in total. These seven were the ones that changed how we think about the pricing model.
Why could nobody tell who had opted out?
Because the flag ate the consent record, and it took us two passes to see how badly.
The September audit did the obvious subtraction. 3,455 non-marketable, 239 opted out, so 3,383 contacts were unreachable by configuration alone and could, we wrote, “legally be re-marketed”. That line was wrong in two ways, and it is worth being precise about both because any agency reading your portal from the list screen will make the same mistakes.
The first mistake was arithmetic. The opt-outs and the non-marketable contacts are not two slices of one pie. They overlap. When we pulled every contact’s suppression state in October, 174 of the 246 people who had unsubscribed from all email were still flagged as marketing contacts. HubSpot was billing for them and refusing to send to them, which is the correct behavior for an unsubscribe and an absurd one for an invoice. Add the 61 who had opted out of marketing email specifically and the 4 in quarantine, and 239 of the 1,401 marketing contacts on the October count were people the platform would never mail.
The sendable audience was not 1,418. It was 1,157.
That number changed our own plan. The first load plan for the new email platform treated “marketable” and “subscribed” as the same set: suppress the non-marketable, then load the marketable as subscribers. Run as written, it would have re-subscribed 174 people who had unsubscribed from everything, over an API path that honors a subscribed flag without asking. We caught it on our own read of the extraction, before a single contact was loaded, and the load files were rebuilt to split on consent and deliverability instead of billing: 3,709 suppressed, 1,157 subscribed.
The second mistake was the word “legally”. More on that below.
What the October pull also showed was who had done the demoting. Of the 3,478 non-marketable contacts on that date, 3,040 carried no opt-out, no bounce and no quarantine. Their property history recorded the flag being set by batch update jobs, by integrations, by a browser extension, and by HubSpot’s own eligibility processing. Not by the contact. In the fortnight between the two reads, the portal saw 22 more demotions, 20 of them by two batch jobs, against 10 promotions from form fills and 7 new unsubscribes from the live nurture sends. The machine was still running on the day we read it, and it was still winning.
HubSpot was billing for them and refusing to send to them, which is the correct behavior for an unsubscribe and an absurd one for an invoice.
The Audience Lock, measured
Lock 4 of The Five Locks is the Audience Lock: your segments are queries against the vendor’s behavioral data, so exporting the list gives you the members and loses the criteria. 3 See also 3 See The Five Locks, Lock 4, the Audience Lock: segments are queries against the vendor’s behavioral data, so exporting the members loses the criteria. This piece is that lock measured on one portal, with a twist the framework did not anticipate: the billing flag had absorbed the consent record too.Read The Five Locks: How SaaS Vendors Keep You Trapped This portal was a clean case of it. Fourteen lists carried the suppression and exclusion logic, 5,708 memberships across 3,244 distinct contacts, and the country suffixes and spam patterns behind two of them lived in filter definitions, not in any member export.
But the lock here was tighter than the framework describes, and the pricing is why. The Audience Lock as written is about segments. On a per-contact billing model it reaches the consent record too, because the cheapest way to stop paying for someone is the same action as the way to stop mailing them, and HubSpot gave this company one switch for both. Four years of running that switch produced a database where the most basic marketing question, who may we email, had no answer that did not route through the invoice.
The TCO calculator has a line for contact tiers, and most people fill it in from the renewal quote. This portal shows what the line costs on the other side of the ledger: not the fee for the 1,418, but the 3,040 the company had stopped talking to in order to hold the fee where it was, and the 174 it was paying for anyway.
What “legally re-approachable” does not mean
Our own first architecture pass wrote of the demoted contacts: “HubSpot demoted them for billing reasons, so they are legally re-approachable”. Our own review of that pass struck it, and the strike is the most useful paragraph in the whole engagement for anyone about to leave HubSpot with a long non-marketing list. 4 Editor's note 4 Nothing in this piece is legal advice. The lawful basis for contacting any address depends on how and where it was collected. Check it with counsel per segment before the first send.
The reasoning was a claim, not a finding. “We stopped paying to mail them” says nothing about the basis on which the address was collected in the first place, and the basis is what consent law cares about. This company had a live workflow excluding contacts in EU member states, which means it had EU contacts, which means GDPR applies to some unknown share of the 3,040 and a billing demotion is not a lawful basis for anything. The portal did carry a legal-basis property per contact, and we pulled it, but a property is only as good as whoever filled it in.
So the rule we adopted, and the one we would give any company in this position: do not mass re-subscribe. Re-permission deliberately, one segment at a time, most engaged first, with a documented basis per segment and a re-opt-in email wherever the original basis is unclear. Get a yes from the person who signs for the company before the first segment goes out. And keep it off the cutover week entirely, because it is a growth program, not a migration task.
What the company gets back
Here is the upside, and it is larger than the saving.
The consent record becomes a field. On the new CRM, the thing a form fill will write is an explicit, timestamped, sourced opt-in, and the thing an unsubscribe will write is a separate status with its own reason. No workflow can flip the first one because the invoice got too high, because there is no invoice tied to it. The email platform the company is moving to bills on subscribed contacts, so the sunset rule survives as a targeting exclusion that keeps unengaged people out of the warm-up ramp, and nothing in it touches whether those people may be mailed.
The 3,040 become a lever. These are people who came into the CRM and then went quiet long enough, or sat in the wrong country, for a rule to stop paying for them. Under the old model they were a cost to be avoided. Under the new one they are the largest unworked audience the company has: 3,040 people, against the 1,157 it could actually send to. The lead-pipeline audit had already made the point in its own terms: the company was acquiring leads and letting them land, go cold and never be re-engaged, because the audience it could nurture was capped at 29%. The cap goes with the contract. What remains is the consent question, segment by segment, and that is a program a lean marketing team can run.
The ordering is already there. Among the 1,157 sendable contacts, 545 sit on the company’s unengaged list, 426 on a manual re-engage-or-delete list, and 166 on the nurture suppression list. Those memberships came out as columns on the export, so the first send can go only to people who are on none of them, and the ramp widens from there. The same columns exist for the 3,040. Engaged-first is not a plan to be written. It is a filter to be applied.
And the company stops paying a thermostat. Seven workflows and nearly half a million enrollments of cost-control automation disappear, along with the fortnightly drift of demotions that nobody ordered. The marketer’s list of workflows gets shorter, and every remaining rule on it is about the business rather than the bill.
Before your renewal, count four things
If you are on HubSpot’s marketing-contact pricing, you can measure your own version of this in an afternoon, and you should do it before the renewal conversation rather than after.
Count total contacts and marketable contacts; the gap is the audience you are not talking to. Count the contacts with an opt-out, a bounce or a quarantine; that is the consent and deliverability state, and it is a different number. Then count the overlap, because the people HubSpot bills you for and will not mail are on both lists, and on this portal they were 239 of the 1,401 contacts on the bill. Last, read the property history on a sample of the non-marketable contacts and see who set the flag. If the answer is mostly batch jobs and workflows, your list has been shrunk by a cost decision, and the size of the decision is the size of the growth lever you have been sitting on.
Do the counts from the contact records through a read-only key, not from the list screen. On this portal the contact-level pull replayed the September figures exactly. It also surfaced the 174, which the screen never would have.
Then, if you are leaving, pull the consent state out before the contract date, in both layers, because the suppression history on deleted contacts dies with the portal. The practitioner’s version of the split, with the load files and the row counts per reason, is in marketable is not subscribed. And if you are weighing whether the pricing model is reason enough to go, the six-factor framework will tell you where it ranks against everything else. On this portal, the company described its list in discovery as under 2,000 contacts. The marketable count was 1,418. The audit found the other 3,455.
The research is free. So is the diagnosis. 60 seconds →