Somewhere in your HubSpot portal right now there are signed contracts, receipts, and onboarding documents that exist nowhere else. If that sentence made you pause, this post is for you: why CRM-only file storage is a quiet risk, and a backup ritual simple enough that your team will actually keep doing it.
Doesn't HubSpot already back up my files?
HubSpot protects its platform — it does not implement your retention policy. Those are different jobs. HubSpot's infrastructure guards against their disasters; it does nothing about yours:
- Deletions look like normal work. An admin cleaning up "old records" takes their attached files along. An offboarded employee's purge, a well-meaning dedupe, a bulk delete with the wrong filter — all ordinary Tuesday events.
- Integrations misbehave. A sync tool with write access and a bad mapping can orphan or overwrite data faster than anyone notices.
- Access ends. Downgrades, subscription lapses, or a future migration all raise the same question: can you produce the documents when the portal isn't in front of you?
None of this is a knock on HubSpot. It's the difference between a platform's uptime promise and a business's obligation to hold onto its own paperwork.
Which files are actually at risk?
Audit yourself with three questions — most teams fail at least one:
- Where do signed agreements live? If sales attaches contracts to deals and nobody copies them elsewhere, the CRM is your legal filing cabinet.
- Where are financial documents? Receipts and invoices stored in File-type properties on deals or custom objects are exactly what an auditor will someday ask for on a deadline.
- What's hiding on notes? Attachments added to records over the years — through the API, integrations, or agents dragging files into the timeline — accumulate silently and are the easiest to forget entirely.
If any answer was "only in HubSpot," you don't have a backup problem — you have a backup absence.
The quarterly backup ritual
The sustainable version is boring on purpose — four steps, once a quarter, calendar-driven:
- Pick the objects that matter. Usually deals, contacts, and whichever custom objects carry documents. Skip what doesn't hold files; a backup ritual survives by staying small.
- Pull each object's files with a filter. Using FileFetch, select the object, choose the file source — File-type properties or record attachments — and filter to the period (say, records created or closed last quarter). Hit start and you get one organized zip, filenames tied to record IDs and names, de-duplicated.
- Store the zip outside HubSpot. Your document management system, a governed drive, wherever your retention policy already lives. The point is a second system with different failure modes.
- Log the pull. One line in a shared doc — date, object, filter, file count. Ninety seconds now; enormously reassuring during an audit later.
One honest caveat: FileFetch is an on-demand tool, not a scheduler — nothing runs automatically in the background. The recurring part of this ritual is a calendar reminder and a human clicking a button. In practice that's a feature: someone confirms each quarter that the pull actually happened.
What about the rest of the CRM data?
Files are the blind spot, but they're not the whole backup story. HubSpot's native exports cover the structured side well — contacts, companies, deals, and properties export to spreadsheets in a few clicks, and that's worth doing on the same quarterly calendar. The gap those exports leave is precisely the documents: standard exports carry your data about the deal, not the signed PDF attached to it. Pair the two and you have a genuinely complete snapshot; do only the spreadsheet half and you'll discover the difference at the worst possible moment, usually mid-migration or portal cleanup.
Questions ops teams ask before the first pull
"Our portal is huge — will one pull cover it?" FileFetch handles large record sets up to HubSpot's 10,000-record search limit per filter. If a quarter's deals exceed that, split the pull by date range or pipeline — two filtered pulls instead of one, same ritual, same zip-per-pull tidiness.
"What will IT want to know?" The connection is OAuth with read-only access — the tool cannot edit or delete anything in your portal — and nothing is stored on our servers; the zip goes to you and nowhere else. That answer tends to end the security review early.
"How long do we keep the zips?" Match your existing document retention policy — the backup shouldn't outlive the obligation it exists to meet. A consistent naming scheme (object, filter, pull date) means anyone can find the right archive later without asking who ran it.
"What if nothing bad ever happens?" Then you spent roughly an hour a year on insurance, and you're the ops lead who could produce the contract on demand. There are worse reputations to have.
How to start this week
Don't design a retention framework — just take the first snapshot. Install FileFetch from the HubSpot Marketplace (OAuth, read-only, no developer), run one unfiltered-by-drama pull of your deals' attachments, store the zip, and put a repeating event on the ops calendar. Total elapsed time is usually shorter than the meeting where someone asks whether the contracts are backed up. If you'd like help deciding what belongs in the ritual for your portal, we're happy to take a look.
Frequently Asked Questions
Does HubSpot back up my files automatically?
HubSpot protects its own platform, but it doesn't enforce your retention policy. Accidental deletions, integration mistakes, and access changes are your risks to manage — which is why keeping periodic file archives outside the portal matters.
How do I back up files stored in HubSpot?
Export the structured data with HubSpot's native tools, then pull the actual documents — file properties and record attachments — with a bulk tool like FileFetch, which packages them into one organized zip per object, filtered to the records you choose.
How often should I back up HubSpot files?
Quarterly is the sweet spot for most teams — frequent enough that a loss window stays small, infrequent enough that the ritual survives. High-volume or heavily regulated businesses may prefer monthly pulls with tighter filters.