If my CRM runs in the cloud, does the vendor take care of login security and keeping a copy of my data?
Summary
Half of it. The vendors now force a second login factor on paid accounts, so that part is no longer optional. Keeping your own copy of the data is still your job, and the export tools come with frequency limits, expiring download links, and gaps in what they include. Single sign-on also depends on the plan you buy.
What the vendor already makes mandatory
- Salesforce has required multi-factor authentication for all logins to its products since February 1, 2022. The requirement covers direct username-and-password logins and single sign-on alike, and Salesforce calls it both a technical and a contractual requirement.
- HubSpot requires two-factor authentication for every user who logs in with a username and password on Starter, Professional, and Enterprise accounts, and it can't be turned off. Accounts on the free tools can choose whether to require it.
Getting a copy of your data out
Salesforce's Data Export Service builds backup files of your org's data. Weekly export is available in Enterprise, Performance, and Unlimited editions; everyone else except Database.com gets monthly export, and Professional and Developer editions can only generate a file every 29 days. Formula and roll-up summary fields are always left out. The zip files are deleted 48 hours after the notification email goes out, not counting weekends, so a missed email means a missed backup.
HubSpot lets any plan export all records of an object from its list view, up to 300 exports in a rolling 24 hours and three at a time. The export carries property values and associations, but calls, notes, and other activities need a separate route, such as the individual contact data export or the API. Download links expire after 30 days.
Single sign-on depends on the plan
Requiring everyone to log in through your company's identity provider takes a Professional or Enterprise subscription at HubSpot. Pipedrive offers SSO on all plans, with one catch: it doesn't work alongside Pipedrive's own two-factor authentication, so an account chooses one or the other. IP- and time-based access restrictions are listed under Pipedrive's top Ultimate plan.
Sources
- https://help.salesforce.com/s/articleView?id=sf.security_overview_2fa.htm&type=5
- https://security.salesforce.com/mfa/
- https://knowledge.hubspot.com/account-security/set-up-two-factor-authentication-for-your-hubspot-login
- https://help.salesforce.com/s/articleView?id=sf.admin_exportdata.htm&type=5
- https://knowledge.hubspot.com/import-and-export/export-records
- https://knowledge.hubspot.com/account-security/set-up-single-sign-on-sso
- https://support.pipedrive.com/en/article/single-sign-on
- https://www.pipedrive.com/en/pricing
Related on this site
- What does an enterprise CRM plan give you that a small-business plan doesn't?
- How do I move customer data from a spreadsheet or an old CRM into a new CRM?
- What's inside a CRM database, and which limits will you hit when you move your data in?
- What the seat price leaves out
Written by Kaz (pen name). Published September 27, 2026. The figures above come from the vendor and review-site pages listed under Sources. We have not used these products. Corrections: contact form.