In August 2021 we published “5 Ways to Use HubSpot CMS Memberships.” It suggested “customer portals where contacts can view and manage their deals, quotes, subscriptions, and service tickets,” and employee portals too, “as long as you have the correct lists and data structure in place.”
We wrote that. This is the update.
What we taught
The 2021 post wasn’t a one-off. For close to a decade, Lynton published guides to turning HubSpot’s CMS into an application platform, and we built what we wrote about.
- 2015: “How we built buyer-centric surveys and user logins on the HubSpot COS,” a home builder’s site where visitors registered, logged in and saved the homesites they liked. It closed by saying we “didn’t want to be limited by any technology.”
- 2019: “How to Create Private Content on HubSpot.” Among the common uses for private pages, it listed “partner portals with sensitive information.”
- 2020: “What You Need to Know About Serverless Functions in HubSpot,” which pitched functions for “creating secure member portals with personalized data access” and counted it as a plus that “you only depend on HubSpot.”
- 2021: the memberships post above.
- 2024: “10 Ways to Use HubDB for Your HubSpot Website,” which called HubDB “HubSpot’s robust relational database.”
Our Rubric theme shipped HubSpot’s membership login, registration and password-reset templates. Every one of those posts is still live on this site, now with a note at the top saying what we recommend instead.
None of it was wrong about what HubSpot could do. Each feature worked as described. What we got wrong was what a portal turns into once a business depends on it.
Why partners build portals on HubSpot
When a client asks for a portal, a HubSpot partner reaches for HubSpot. We did it for years, and the reasons are worth naming, because almost none of them is about the client.
The client already pays for Content Hub, so the platform looks free. The CRM is right there, which feels like an architecture even when it isn’t one. The partner’s developers know HubSpot’s template language, and there’s nobody else on the bench. The project gets scoped and sold as a website build, because that’s the thing a HubSpot partner is set up to deliver. And a custom build on HubSpot keeps the client’s next three years of work on HubSpot, with the same partner.
Put those together and the question “where should this portal live?” never gets asked. It isn’t bad faith. It’s what any specialist does with the tool they specialize in.
What happens in year two
The call usually comes in year two. We’ve had it.
A firm has moved a whole channel of its business onto the portal: requests that used to arrive by email now come through an intake form, and clients follow them on a dashboard. It works. Then the developer who built the custom pieces moves on. The firm’s own HubSpot admins are good. They can add a property, fix a pipeline, rebuild a list. They can’t touch the custom code, and nobody wrote down how it fits together. Every request to the partner starts with explaining the requirements again, to someone new.
HubSpot doesn’t give anyone a full copy of the live portal to test against. A developer test account is a separate account, built so you can work “without impacting a standard HubSpot account,” which also means none of the portal’s real content, contacts or permissions are in it. 1 Source 1 HubSpot Developers, “HubSpot CMS overview,” read October 30, 2026: a developer test account gives “a testing environment to build out your CMS assets without impacting a standard HubSpot account.” It is a separate account, so it holds none of the live site’s content or CRM records. So each fix gets its first real test in front of clients, and the firm, sensibly, asks for fewer fixes. The portal that was supposed to replace the inbox gets frozen at whatever it was on the day the developer left.
What we got wrong
We judged portals on launch day
Launch is when a HubSpot portal looks best: the pages are on-brand, the login works, the CRM fills in the form. The costs arrive later, and they arrive as maintenance, which is exactly where nobody is looking when the build gets approved.
The portal that was supposed to replace the inbox gets frozen at whatever it was on the day the developer left.
We treated the limits as small print
Our 2020 post listed HubSpot’s limits under “other important considerations”: 10 seconds of execution time, 128 MB of memory, 50 secrets, 600 seconds of function time a minute. Six years later HubSpot’s own reference lists the same numbers. 2 Source 2 Lynton, “What You Need to Know About Serverless Functions in HubSpot,” May 14, 2020, listing 50 secrets per account, 128 MB of memory, 10 seconds of execution time and 600 seconds of execution time per minute. HubSpot Developers, “Serverless functions reference” (CMS), read October 30, 2026: 10 seconds, 128 MB, 50 secrets and 600 total execution seconds per minute per account. They were never small print. They were the ceiling of every portal we built, and the client’s business grew into them.
We let “private” sound like “secure”
When we listed partner portals with sensitive information as a use for private pages, the line didn’t separate a member login from a page behind one shared password. HubSpot’s help page is clearer than we were: password-protected content isn’t indexed, “but sensitive data isn’t encrypted.” 3 Source 3 HubSpot Knowledge Base, “Create and manage access groups for private content,” updated September 29, 2026, on password-protected content: “Password-protected content isn’t indexed by search engines, but sensitive data isn’t encrypted.” Keeping one client’s records away from another is the builder’s job on HubSpot, not the platform’s.
We sold “only HubSpot” as a strength
“You only depend on HubSpot” turned out to be the problem, not the selling point. Depending only on HubSpot means depending on HubSpot’s roadmap. In 2025 its new developer platform didn’t support serverless functions at all, and they came back in version 2026.03 with different rules. 4 Source 4 HubSpot Developers, “Serverless functions overview” (CMS), read October 30, 2026: serverless functions are not supported in version 2025.2 of the developer platform. HubSpot Developers, developer platform “Serverless functions overview”: “Starting with version 2026.03, apps built on the developer platform fully support and deploy serverless functions.” A portal that runs a business process can’t treat a platform version as weather.
What we recommend now
Decide where the app should live before anyone picks a platform. Ask who logs in, what records the portal keeps and who should own them, how often it will change, and what an auditor will ask. Some of the answers point back to HubSpot. Its memberships are a good home for gated content, and its support portal is a good home for clients who only need their tickets. A portal that keeps records for people outside the company usually belongs in an app you control, and that app can still use HubSpot as its CRM.
We stopped selling new HubSpot implementations in 2025, after 16 years and more than 2,000 projects. We wrote about why in Why We Left HubSpot After 16 Years as a Partner. We still support clients who run on HubSpot, because a portal that’s live today needs looking after today, whatever happens to it next.
If you’re about to commission a portal, ask your partner one question: is this the best place for the app, or the place you know how to build? If they can’t answer without mentioning what you already pay for, you’ve learned something.
The full walkthrough of what a portal needs and where HubSpot strains is in Can You Build a Customer Portal on HubSpot?, and the five places a portal can live are in Custom Client Portal or HubSpot? 5 Options Compared. For how platforms make leaving expensive in the first place, see the Code Lock in the Five Locks.
The research is free. So is the diagnosis. 60 seconds →