“Should we build it on HubSpot?” is the question most firms start with, and it’s the wrong one. It picks the platform before anyone has said what the app has to do.
Ask that first. Who logs in? What records will the app create, and who has to own them? How often will it change, and what will an auditor want to see? Answer those, and the right home for a custom web app usually picks itself from five options. Three of them belong to HubSpot.
We call them the Five Homes. Each one is right for some apps. The expensive mistake is choosing a home because it’s the one you already pay for.
Where should a custom web app live?
It depends on six things about the app, not on which subscriptions you hold. The five homes run from fully inside HubSpot to fully yours:
- HubSpot memberships, for content you gate behind a login.
- HubSpot’s support portal, for clients who only need their tickets.
- App cards inside HubSpot, for tools your own staff use in the CRM.
- Your own app beside HubSpot’s CRM, for apps that keep records while HubSpot stays the CRM.
- A stack you own end to end, for apps that are core to how you do business.
The six questions below decide between them.
The six questions that decide it
1. Who logs in?
Your own staff, people you already know (clients, advisors, franchisees, members), or the public. Staff-only tools have homes inside HubSpot. People outside the company need a front door, and whose front door it is matters.
2. What does the app create?
An app that shows people content is a different animal from one that keeps records: requests, replies, attachments, approvals, histories. Records need a real database and an owner. Ask who that owner should be.
3. How often will it change?
A resource area might change monthly. A portal that runs a business process changes every few weeks, as departments join and rules shift. Frequent change needs a safe way to test and release it.
4. What does it have to connect to?
The CRM, almost always. Often an archive, a document system, an accounting or practice-management system too. Count the connections and where each one’s limits sit.
5. What will an auditor or regulator ask?
Who saw which record, who changed what, and whether client correspondence is kept. If nobody will ever ask, the bar is lower. In financial services, healthcare and law, somebody will.
6. How long does it have to last?
A campaign microsite lives a year. A client portal that replaces an email inbox should last five years or more, and its records longer than that.
HubSpot memberships: for content you gate, not records you keep
HubSpot’s memberships put pages, blog posts and knowledge articles behind a login. They need Content Hub or Service Hub Professional or Enterprise, they run only on your own connected domain, and access is decided by access groups: two on Professional, up to 100 on Enterprise. 1 Source 1 HubSpot Knowledge Base, “Create and manage access groups for private content,” updated September 29, 2026: Service Hub or Content Hub Professional or Enterprise; up to two access groups on Professional and 100 on Enterprise; private content works only on connected subdomains.
Right when the portal publishes: a customer resource library, a partner area with sales materials, documentation by product tier. Access follows a list, content changes a few times a month, and the people logging in only read.
We built portals like this on HubSpot for years as a partner, up to a contract portal with live pricing and online payments, so we know how far the platform stretches.
Wrong when the portal starts keeping records. Every request, reply and status change then has to live in HubDB tables or CRM objects, and every piece of logic runs as a time-limited function. That’s the build we walk through in Can You Build a Customer Portal on HubSpot?
HubSpot’s support portal: for clients who only need their tickets
HubSpot’s support portal (the replacement for its legacy customer portal) gives clients a login to see and manage their support tickets. It needs Service Hub Professional or Enterprise. You decide whether a contact sees only their own tickets or their company’s, and which ticket details appear. 2 Source 2 HubSpot Knowledge Base, “Set up a support portal,” last updated October 23, 2026: Service Hub Professional or Enterprise; the support portal replaces the legacy customer portal; contacts see the tickets associated with their contact record, optionally their company’s; “Only tickets will appear in the support portal.”
Right when the client’s whole relationship with the portal is “where’s my request?” It’s configured rather than built, so there’s no custom code to maintain, and HubSpot carries the upgrades.
Wrong when you need anything that isn’t a ticket. HubSpot’s own help page is plain about it: “only tickets will appear in the support portal.” Intake forms that pull from the CRM, dashboards across departments, documents, approvals, your own workflow on your own screens all need another home.
App cards: for tools your own staff use inside HubSpot
App cards put custom tools inside HubSpot’s own screens: on contact and company records, in the preview panel, in the help desk sidebar. The people who see them are your HubSpot users, which is to say your staff. Cards backed by server-side code need an Enterprise subscription to install. 3 Source 3 HubSpot Developers, “UI extensions overview,” read October 30, 2026: app cards appear on CRM record pages, in the CRM preview panel, in the help desk sidebar, and on app home and settings pages. HubSpot Developers, developer platform “Serverless functions overview”: “An Enterprise subscription is required to install an app with serverless functions.”
Right when the users are internal and already live in HubSpot: a pricing calculator on the deal record, a compliance checklist in the ticket sidebar, a lookup into another system on the company page.
Wrong when anyone outside the company needs to use it. App cards don’t face clients.
Your own app beside HubSpot’s CRM
This home rarely comes up when the partner only builds on HubSpot, and for many firms it’s the right one. The app runs on infrastructure you control, with its own sign-in and its own database, and it sends HubSpot what the CRM needs: contacts, activity, ticket and deal updates. HubSpot stays the CRM and the marketing engine. The app stops living inside it.
Carpenter Technology took this route. It is moving five websites, including the inventory portal where buyers search stock by grade, shape and size, off HubSpot CMS onto code it owns, and it kept HubSpot as its CRM. The story is in our Carpenter Technology case study.
Right when people outside the company log in, the app keeps records, and you want HubSpot to keep doing the job it’s good at. You choose the sign-in experience, the app can run as long as its work takes, every change can be tested on a full copy before release, and the records are yours to query, archive and keep.
Wrong when nobody will own it. An app you control is an app somebody has to run: hosting, monitoring, updates, security reviews. If there’s no one to do that, solve that first, whether that’s a hire or a partner on a support plan. Plan the connection around HubSpot’s API too. Each private app gets 190 requests every 10 seconds, and the daily allowance is “shared across all apps within the same HubSpot account.” 4 Source 4 HubSpot Developers, “API usage guidelines and limits,” read October 30, 2026: private apps on Professional and Enterprise get 190 requests per 10 seconds per app; the daily limit (625,000 on Professional, 1,000,000 on Enterprise) is “shared across all apps within the same HubSpot account.”
A stack you own end to end
The fifth home takes HubSpot out of the picture for this part of the business. The app, the database, the sign-in and the customer records all run on infrastructure you own, and the CRM is either part of that stack or connected to it on your terms.
Right when the app is how you do business, not a side project, and the rented platform has become a cost center rather than an asset. It’s the home we chose for Lynton: our site, our CRM and our forms run on infrastructure we own. We left HubSpot after 16 years as a partner, for reasons we’ve written about at length. The reference architecture is in the Sovereign Stack Blueprint.
Wrong when your needs fit one of the first three homes. Owning everything is worth it when the app is core. It’s overkill for a resource library.
What about off-the-shelf client portal software?
It’s the option many firms price first, and for a standard job it can be the right one. A portal product gives clients a branded login for shared files, messages, forms and status updates. Many connect to HubSpot through an integration, and they go live without custom code to maintain.
It’s still a rented platform, just a different one. The portal’s records sit in another vendor’s database under that vendor’s export terms, and what clients can do is whatever its roadmap allows. That’s what the Five Locks calls the Data Lock, with a second vendor holding the key. Check how it’s priced, too: a product billed per user or per client costs more every time your network grows.
Right when the portal’s job is standard (documents, messages, status), there’s nobody to run custom software, and nothing about the workflow sets you apart.
Wrong when the portal runs your own process (intake rules, routing across departments, approvals), when records have to be kept the way your auditor expects, or when the portal is how clients judge your service. Those are the reasons to own the app, beside HubSpot’s CRM or in a stack you own.
How do the five homes compare?
| Memberships | Support portal | App cards | Your app beside the CRM | Stack you own | |
|---|---|---|---|---|---|
| Who logs in | Known contacts | Clients with tickets | Your staff | Anyone you invite | Anyone you invite |
| Keeps records? | Not well | Tickets only | Inside the CRM | Yes, in your database | Yes, in your database |
| Who controls sign-in | HubSpot | HubSpot | HubSpot | You | You |
| Custom code to maintain | Some, on HubSpot’s terms | None | Some, on HubSpot’s terms | Yes, on yours | Yes, on yours |
| A full copy to test on | No | Not needed | No | Yes | Yes |
| Best for | Gated content | ”Where’s my request?” | Internal tools | Client portals that keep records | Apps the business runs on |
What does it cost to move later?
Far more than choosing well at the start, and the bill grows every month.
The code is custom either way. What differs is who sets its limits and its upgrade schedule for the next five years.
A portal built in the wrong home doesn’t just get rewritten. Its records have to be extracted from HubDB tables and CRM objects and mapped into a new model. Its access rules have to be rebuilt. And every member has to set up sign-in again: HubSpot keeps member passwords on its own servers, and in its words, “it isn’t possible for a user to look up a contact’s membership sign-in password.” 5 Source 5 HubSpot Knowledge Base, “Create and manage access groups for private content,” updated September 29, 2026: “Passwords are securely stored on HubSpot’s servers” and “Passwords aren’t accessible from the UI, so it isn’t possible for a user to look up a contact’s membership sign-in password.” For a portal that a network of offices relies on daily, that last step is a change-management project of its own.
The build-day comparison misleads in the other direction. A HubSpot portal looks cheaper on day one because the subscription is already paid. But server-side logic needs Content Hub Enterprise, each function gets 10 seconds, and the account shares 600 execution seconds a minute. 6 Source 6 HubSpot Developers, “Serverless functions reference” (CMS), read October 30, 2026: 10 seconds of execution time per function and 600 total execution seconds per minute per account. HubSpot Developers, “HubSpot CMS overview”: “Serverless Functions are a Content Hub Enterprise feature.” The code is custom either way. What differs is who sets its limits and its upgrade schedule for the next five years. Compare five-year costs, not build quotes. Our HubSpot TCO calculator covers the subscription side, and what happens to your content when you leave covers the move.
How to decide
Work down the six questions and stop at the first home that fits. The Portal Fit Score below does it for you: answer the six, and it names the home.
If only your staff use it, it’s an app card. If clients only need to see and reply to their tickets, it’s the support portal. If the portal gates content and keeps no records, memberships will do the job. If the job is standard and nobody will run custom software, price a portal product before building anything. Anything that lets outside people in and keeps records belongs in an app you control, beside HubSpot’s CRM or in a stack you own, depending on whether HubSpot is still earning its place as your CRM. That second call is the one our stay-or-go framework is built for.
Two answers should make you slow down whatever home you’re leaning toward. If an auditor will ask who saw which record, the security model has to be something you can describe and prove. If the app will be the main way clients reach you, a few hours of downtime is felt everywhere, so somebody needs to be watching it before it goes live.
What choosing well gives you
A portal in the right home stops being a project you maintain and becomes something you build on. Sign-in looks and feels like your firm. New features are a question of value and budget, not of what a platform version allows. The records of how you serve each client are yours to report on and archive, and to keep when vendors change. HubSpot keeps doing what it’s good at, with less of your business riding on its limits.
You don’t have to leave HubSpot to stop building apps on it.
If you already have a portal on HubSpot and it’s carrying more than it should, start with what that build is up against, and with why partners kept recommending it, us included: We Taught Companies to Build Portals on HubSpot for Ten Years.
The research is free. So is the diagnosis. 60 seconds →