Stack: HubSpot
Okta disaster recovery for teams running HubSpot through Okta
Marketing and sales teams depend on HubSpot. When Okta governs HubSpot authentication, an unintended change to the Okta-side configuration becomes a revenue-operations incident. Campaign launches paused, sales reps unable to update deal stage, support agents unable to reach service tickets — all because of a single Okta-side policy push.
Butterfly captures versioned snapshots of the Okta configuration governing HubSpot access — the SAML or OIDC app, assigned groups, sign-on policies, and the SCIM provisioning feed where used. Restore preview shows the exact diff before any revert.
What you get
How Butterfly fits HubSpot
HubSpot SSO app is versioned
Every backup captures the Okta-side HubSpot app integration — SAML signing certificate, attribute mapping, assigned groups, and sign-on policy.
Group rules drive HubSpot user provisioning
Group rules that gate HubSpot license assignment are versioned. Restore preview tells you which HubSpot-bound groups would gain or lose members before you commit.
Sign-on policy changes are diffable
Restore preview surfaces the policy-statement diff against the prior snapshot — so a tightening intended for engineering does not silently apply to the marketing team.
What goes wrong
Three incidents you have already seen variations of
Sign-on policy change blocks the marketing team mid-campaign launch
A tightening of step-up MFA requirements was meant for engineering. The group expression caught the marketing-team group too. Marketing operators could not reach HubSpot during a launch window. Restore preview surfaces the diff.
SAML signing-cert rotation breaks HubSpot SSO
A scheduled signing-cert rotation in Okta was not coordinated with the HubSpot SSO trust. Sales reps hit a SAML error mid-day. Restore preview retrieves the prior certificate as a known-good fallback.
Group rule cleanup drops sales license assignment
A directory cleanup removed a group rule feeding the hubspot-sales-licensed group. New sales reps showed up in Okta but never landed in HubSpot. The discrepancy surfaced on the next license audit.
Honest scope
What Butterfly captures — and what it does not
In scope
The Okta-side configuration governing HubSpot access: the HubSpot SAML / OIDC app integration, attribute mappings, assigned users and groups, group rules, sign-on policies, SCIM provisioning configuration (where used), and Workflows automations.
Out of scope
We do not back up HubSpot contacts, deals, campaigns, workflows (HubSpot-side), or any HubSpot CRM data. HubSpot-side backup is handled by HubSpot's own export tools.
Plans
Free, Standard, or Business
Free
$0 / forever
- 1 Okta connection
- 7-day retention
- 1 total backup
- No credit card
Standard
$1 / user / month — $99 minimum
- 2 Okta connections
- 90-day retention
- Restore preview + dry-run
- Audit Pack PDF (framework-filterable)
Business
$2 / user / month — $299 minimum
- Unlimited Okta connections
- Unlimited retention
- Continuity (warm standby)
- Priority restore support
Pricing reference: /upgrade. Provider coverage today: Okta, Okta Workflows, Auth0.
Regulatory shape
Compliance and audit angle
SOC 2 CC6 (logical access) is the most common framework relevant for revenue-system identity continuity. GDPR Article 32 expects appropriate security around personal-data systems, including identity-layer recovery.
Butterfly's own SOC 2 Type II work is in progress; current status lives in the Trust Center.
Frequently asked
FAQ
Does Butterfly back up HubSpot CRM data?
No. Butterfly backs up the Okta configuration governing HubSpot access. HubSpot-side data backup is owned by HubSpot's own export tooling.
What if our team uses HubSpot OIDC instead of SAML?
Both are in scope. Butterfly captures the Okta-side app integration regardless of protocol.
Can we revert a single sign-on policy without touching the others?
Yes. Restore preview lets you pick the scope — a single app, a single policy, a single group, or the full tenant.
Recover your Okta org in minutes, not hours
Talk to Mick (the founder) for a 30-minute demo, or start the free trial. No credit card for the free tier.
More stacks
Okta DR for other stacks
Trust posture, subprocessors, and security details: Trust Center.