You can export HubSpot attachments without writing a single line of code. FileFetch, our HubSpot Marketplace app, does it in five steps: install, authorize, pick an object, filter, download. No developer, no API keys, no spreadsheet full of URLs that don't work — just one zip with every file, named by record.
This post is for the ops person who got handed the task and doesn't have an engineer to hand it to. We'll cover why attachments are genuinely hard to get, the exact no-code flow, and the security questions IT will ask before saying yes.
Where do HubSpot attachments actually live?
Not where you'd think — and that's the root of the whole problem. When someone drags a PDF onto a contact or deal, HubSpot doesn't put the file "on" the record. It creates a note (an engagement) associated with the record, and attaches the file to that. The record only knows about the file through a chain: record, to associated note, to attachment, to file.
So there's no attachments folder to open and no export button to click. Getting one deal's files manually means scrolling its timeline and opening notes one at a time. Getting five hundred deals' files means either a developer who can script that chain-walk through the API — or a tool that has already done it for you. Some portals also keep files in File-type properties, a field on the record itself; a complete export has to cover both.
What does the no-code export flow look like?
Five steps, start to zip:
- Install FileFetch from the HubSpot Marketplace. It connects through HubSpot's standard OAuth screen — click authorize, done. No API keys to generate, no private apps to configure.
- Open it from the card on your CRM records. FileFetch lives where you already work — a card right on the record page, not a separate portal to learn.
- Pick the object and the file source. Contacts, deals, tickets, companies, or any custom object — the app reads your portal's live schema, so whatever you've built shows up. Then choose File-type properties, note attachments, or both.
- Filter to the records you need. Date ranges, owner, pipeline stage, or any property on the object, in any combination. "Tickets closed this year in the onboarding pipeline" is three clicks, not a query language.
- Download. A progress bar shows every file's success or failure in real time, and you get one zip — de-duplicated, filenames based on the records they came from.
That's the entire skill requirement: knowing which records you want. If you can build a HubSpot list view, you can run this export.
What will your IT team ask — and what do you tell them?
Non-technical doesn't mean nobody reviews it. Here are the questions IT and security teams actually ask about FileFetch, with the answers:
- "How does it authenticate?" OAuth 2.0 through HubSpot's own consent flow — no passwords shared, no API keys pasted into anything.
- "What can it change in our portal?" Nothing. The scopes are read-only; it cannot create, edit, or delete records or files.
- "Where are the tokens kept?" Encrypted server-side. They never live in your browser.
- "Do our files pass through your servers?" No. Files download through HubSpot's own signed URLs directly to you — nothing is stored on our infrastructure, ever.
- "What happens when we uninstall?" A clean uninstall deletes the credentials. No lingering access.
That's usually the whole review. Read-only access plus zero file storage removes most of what security teams worry about with third-party apps.
How large an export can it handle?
Large record sets are handled automatically — pagination and parallel downloads happen behind the progress bar without you managing anything. The one boundary worth knowing: HubSpot's search API returns at most 10,000 records per filter set.
If your export scope is bigger than that, split it into multiple filter sets and run each one — by year, by pipeline, by owner, whatever divides the set cleanly. Two pulls instead of one, each with its own zip and its own success counts. Not glamorous, but it means portal size isn't the thing that forces you back to hiring a developer.
When is code actually the better answer?
Honesty time: sometimes it is. FileFetch is on-demand — you run it when you need it. If your requirement is a fully automated pipeline that runs itself on a schedule, pushes files into another system, renames them against an external index, or transforms them along the way, that's a custom API integration, and a developer should build it.
But most attachment-export needs aren't that. They're an audit request, a migration archive, a periodic backup, a "legal needs everything on these accounts" fire drill — one-time or occasional pulls where filter-click-zip is exactly the right amount of tooling. That's the job FileFetch was built for, and it's why we — Market Disrupt, a HubSpot Platinum Solutions Partner since well before this app existed — put it on the Marketplace. Not sure which side of the line your project falls on? Ask us — we'll tell you straight, even when the answer is "hire a developer."
Frequently Asked Questions
How do I export attachments from HubSpot without a developer?
Use a Marketplace app built for it. FileFetch, for example, installs via OAuth, launches from a card on your CRM records, and lets you pick an object, filter records by any property, and download every attachment and File-type property file into one organized zip — no code, API keys, or technical setup required.
Why can't I just export attachments with HubSpot's built-in export?
Because HubSpot's exports cover property data, not files. Attachments are connected to the notes and engagements associated with a record rather than the record itself, so they never appear in a standard export. Getting them out in bulk requires walking those associations via the API — or a tool that does it for you.
Is it safe to give a third-party app access to my HubSpot files?
It depends on the app's architecture, so check three things: read-only OAuth scopes (so it can't modify your portal), no file storage on the vendor's servers (files should flow through HubSpot's signed URLs directly to you), and credential deletion on uninstall. FileFetch meets all three, which is what most IT reviews look for.