Straight answers for the current release

U.S. HubSpot ownership programs for companies, contacts, deals, tickets, leads, and qualifying portal custom objects. One program can apply the same territory plan to multiple objects, with a separate single-line text or number ZIP/postal property mapped for each object. Programs support exact ZIP5 membership, fixed HubSpot owners, draft versioning, read-only simulation, exceptions, and guarded publication/rollback machinery. Activities are not supported. New portals begin unable to write owners.

No. HubSpot authenticates you and identifies the selected portal. TerritoryLogic then checks your role in that portal's isolated workspace.

No. Each selected object maps its own ZIP/postal property. Single-line text accepts five-digit ZIP or ZIP+4 text. Number properties accept whole values from 0 through 99999 and left-pad them to ZIP5, so 501 becomes 00501. TerritoryLogic does not retain raw street addresses for routing or infer ZIPs from addresses.

No. Census ZCTAs are display approximations. The saved exact ZIP5 list is authoritative, and a five-digit ZIP input can route even when no ZCTA outline is available. TerritoryLogic validates format, not current USPS issuance.

Only in one narrow case. When the mapped ZIP/postal property is missing, a territory that explicitly claims the entire state may use normalized city and state evidence. A valid ZIP5 always wins, an invalid ZIP does not fall back, and TerritoryLogic never geocodes or infers a ZIP.

Companies, contacts, deals, tickets, leads, and qualifying portal custom objects can share an ownership program. Every selected object must expose a writable owner property and an editable single-line text or number property that can be selected as its ZIP/postal field. Activities are not supported.

No. Installation requests read access and starts read-only synchronization. Simulation also never changes owners.

Separately and deliberately: submit the live owner-write approval request after a successful simulation. The exact portal must be accepted into the production write allowlist, and its Account Owner must authorize the owner-write scope for the program's HubSpot object type. The runtime gate and authorization checks run again before every possible write.

A missing ZIP may use the explicit whole-state fallback described above. Otherwise, missing, invalid, or unassigned evidence becomes a visible exception and receives no destructive action. TerritoryLogic never clears an owner because location evidence is incomplete.

Yes. After owner sync, the Account Owner can grant a synced HubSpot user an Admin/Publisher, Editor, Viewer, or Card-only role. Access remains isolated to that portal.

Yes. Install into each portal separately, then enter the intended portal's account ID at sign-in to open its native App Page. Each portal has independent tokens, sessions, members, programs, data, and future billing.

The current early-access runtime actually enforces 500 managed CRM records, one program, five territory nodes, and a maximum hierarchy depth of two; the current public ZIP editor creates flat territories only. The approved launch catalog also targets one editor, unlimited viewers, seven-day audit retention, and one rollback per month, but those are not currently enforced as an editor-seat cap, automatic audit-purge schedule, or monthly rollback quota. That temporary state is not a promise of unlimited access, indefinite retention, or unlimited rollback at launch.

No. The catalog is visible for planning, but Stripe Checkout and paid subscriptions are disabled. A public install creates Free and requires no credit card.

Not in the current production early-access deployment. Transactional email is not configured. Check the console and status page rather than relying on an install, publish, limit, or inactivity email.

HubSpot retains the owner values present at uninstall, so complete any desired eligible guarded rollback first. The purge handler is implemented, but production uninstall-signal delivery is still being validated; during early access, follow the uninstall guide and ask Support to confirm that jobs stopped and the active installation generation was purged.

No certification is claimed. The current controls and outstanding early-access gaps are listed on the Security page.