Step 1
HubSpot workflow automation ✨
Protect client email addresses in HubSpot workflows
Keep HubSpot as the CRM and system of record while a workflow or custom integration asks ProxiedMail to create controlled email identities for downstream teams.
No public or native HubSpot app is implied. This workflow uses HubSpot automation, API calls, custom properties, and your permission configuration.How HubSpot email masking can work
Use lifecycle data to decide when a protected client identity should become available.
Step 2
Trigger ProxiedMail
Step 3
Return the protected identity
Example workflow
Create the downstream contact at Closed Won
Jane Smith at jane@acme.com becomes acme-4831@relay.company.com for the post-sale team after Deal stage → Closed Won. The exact property visibility, workflow entitlements, and CRM permissions depend on the customer's HubSpot configuration and plan.
HubSpot remains the source of truth; ProxiedMail supplies and routes the controlled identity.
Make protection part of the customer lifecycle
Lifecycle-based protection
Create a protected identity when the right deal, account, or lifecycle condition is reached.
Automatic creation
Use workflow automation instead of asking staff to create and copy aliases manually.
CRM stays the source of truth
Retain external CRM IDs, ownership, and lifecycle context in the system your team already uses.
Bulk migration
Process existing contacts through API or import tooling while preserving the mapping to CRM records.
Ownership-aware revocation
Update authorization when account ownership or team responsibility changes.
Keep Outlook or Gmail
Employees can continue using their normal email client after the protected identity is assigned.
HubSpot use cases
Use CRM events to control when access changes
The workflow should reflect how your business moves a client between teams—not force every contact into the same rule.
Closed Won handoff
Create a protected address as account or delivery work begins.
Owner reassignment
Update authorized users when a company, contact, or deal owner changes.
Lifecycle transitions
Apply protection at a defined customer stage instead of during early prospecting.
Existing database migration
Create mappings for selected existing clients in a controlled batch process.
Technical integration
Map a HubSpot workflow to the existing proxy-binding API
The existing ProxiedMail API creates proxy bindings at POST /api/v1/proxy-bindings. A custom integration maps the HubSpot record and your authorization rules around that resource; it should not assume a separate /protected-contacts contract.
- Keep the external CRM ID and authorization context in your integration or CRM workflow.
- Store only the returned protected identity in the property exposed to downstream teams.
- Confirm the current API schema for your deployment before implementing production automation.
POST /api/v1/proxy-bindings
{
"data": {
"type": "proxy_bindings",
"attributes": {
"real_addresses": ["jane@acme.com"],
"proxy_address": "acme-4831@relay.company.com"
}
}
}
Clear answers
Frequently asked questions
Can this trigger when a HubSpot deal becomes Closed Won?
Yes. A customer-configured HubSpot workflow can invoke a custom integration or webhook when a deal reaches Closed Won, then write the returned protected identity to a custom property. Available workflow features depend on the HubSpot plan.
Do we need to replace the normal HubSpot email property?
Not necessarily. Many deployments retain the real email in a restricted property or source system and add a separate protected-email property for downstream use. Your HubSpot permission model determines who can see each field.
Can we protect existing contacts in bulk?
Yes. An API or import process can create protected identities for a selected set of existing records and write the mappings back to HubSpot.
Can employees still use Outlook or Gmail?
Yes. The protected identity is used in the employee's normal email workflow; ProxiedMail supplies the routing layer. The exact send and reply configuration depends on the deployment.
Does ProxiedMail need access to our entire HubSpot database?
No. A custom integration can send only the fields required for the routing workflow. Data access is governed by the integration credentials and scopes you configure.
Is there a native HubSpot application?
This page does not claim a public or native HubSpot Marketplace application. The described workflow uses API calls, webhooks, HubSpot automation, custom properties, and custom integration.
Build client contact protection into your HubSpot handoff
Share the deal stages, properties, teams, and email clients involved. We will help scope the custom workflow and routing model.
Book a call
Discuss your use case with ProxiedMail
Choose a convenient time for a 30-minute conversation about your workflow, integration, and infrastructure requirements.
Enterprise contact
Tell us about your client communication workflow
Enterprise deployments are scoped based on workflow, infrastructure, integration, and usage requirements.
- Which system stores the real client contact?
- Which teams need communication access?
- What should trigger assignment or revocation?


