What the export does and does not establish
HubSpot record exports download current property values and associations. Activities such as calls and notes can require separate collection routes. Decide whether you need a current CRM snapshot or a history of interactions before selecting an export. Confirm the relevant export permission and inspect a small file rather than assuming all timeline content is present.
Content boundaries to review
Contacts, companies, deals, and tickets may contain purchased leads, imported enrichment, personal identifiers, and messages from people who only expected a sales or support interaction. Marketing subscription status concerns communication preferences; it should not be treated as blanket approval for selling a person’s information for model training. Review each source and purpose independently.
Prepare a narrow candidate collection
Define a field allowlist tied to the intended task. A deal-classification example may need stage definitions and outcomes but not phone numbers or meeting transcripts. Distinguish machine-enriched properties from staff-authored notes. Check associations carefully, because a join that makes analysis convenient can also combine information across customers or expose relationships that were not otherwise obvious.
Evidence to preserve
Keep export filters, selected properties, object definitions, timestamps, and association mappings. Preserve the origin of imported contact lists and any restrictions attached to enrichment services. Record whether a value is current, historical, calculated, or manually corrected. Maintain a reviewed exclusion list for deleted contacts and sensitive free-text fields across later refreshes.
Validate before offering a sample
Pilot with a narrow, documented cohort and test whether direct identifiers can be removed without creating ambiguous labels. Validate that outcomes occur after the features used for prediction to avoid leakage. A technically clean CSV still needs a documented basis for its proposed disclosure and use; export access alone does not answer that commercial question.
Before any external sample or sale, have the responsible rights and privacy reviewers assess the proposed recipient, training or evaluation purpose, retention, redistribution, and deletion obligations. Preserve the relevant contract versions and written decisions. These preparation steps are a review framework, not a legal conclusion or a statement that the platform endorses commercialization.