Stripe View-Only Access and a HubSpot View-Only Seat: What an Outside Consultant Should See

Stripe view-only access: what the View Only role can and cannot do

Stripe’s user roles page describes View Only as a role “for people who need to view payments, balance, and connected accounts, but can’t edit any of them. This role can also export data and download reports.” Its list of what the role can do includes viewing payments, customers, products and disputes, viewing events and logs, creating and downloading financial reports, and bulk exports of payments, customers and products. It cannot refund, create or edit customers, change settings, invite team members, or create, view, edit or delete API keys.

Two neighboring roles are worth knowing because they look similar and are not. The Accountant role can also view payments, invoices and customers, but it can create accounting rules, modify revenue recognition settings and reopen accounting periods — permissions a reviewer has no use for. The Developer role can create unrestricted API keys, which in Stripe’s words “grant access to almost all API resources.” Stripe also warns that a user assigned several roles gets “all the permissions of each individual role.”

• For a person: View Only, one named user, removed on a date written down when the invitation goes out.
• For a script: a restricted API key limited to reading the objects in question. Stripe describes a restricted key as an “API key with permissions you control” and the account’s standard unrestricted key as having “unrestricted permissions on all Stripe APIs,” and recommends restricted keys for new uses.
• For neither: the unrestricted API key, an Administrator or Developer role, or a shared login.

HubSpot view-only seats and view permissions are two different things

HubSpot’s knowledge base separates the seat a user holds from the permissions set on that user. A View-Only Seat is free and unlimited on Starter, Professional and Enterprise subscriptions. Users with one “can: View records, dashboards, customer data, and reports, and can filter reports,” and can “Log notes on CRM records they can view.” They cannot save reports, edit records or change settings.

The permissions guide adds that “View permissions are not the same as a View-only Seat.” For each object — contacts, companies, deals — the View setting can be all records, the user’s team’s records, or the user’s own. And export is its own switch: “Export” lets a user export CRM records and reports, and “Export without approval” lets them do it without anyone approving. A seat called view-only, left with default view settings and export switched on, can still carry the whole contact database out of the account.

The narrow version is simple to set: a View-Only Seat, view limited to the objects the question needs, export off, and the company running any export itself or approving each one.

Exports or a login: what to send a consultant, and what to keep

Exports run by the company’s own staff leave no standing access to revoke and let the founder see every column before it leaves. A login is faster for follow-up questions. Either way, the request list decides what is exposed, and nearly everything a revenue review asks of a B2B SaaS company can be answered from fields like these.

• Send: subscriptions with an account code, plan, amount, interval, status, start, trial end, cancel date and cancellation reason.
• Send: invoices with account code, amount, status, due date, paid date and attempt count; annual invoices with the purchase-order field if one exists.
• Send: deals with account code, stage entry dates, amount, owner role and close date; trials with signup, activity milestones and end date as counts per account.
• Send: renewal dates and notice terms per contract, typed into a sheet rather than the contracts themselves.
• Keep: customer contact names, email addresses and phone numbers; call notes, email threads and support tickets; the unrestricted API key; admin roles; the production database; and any login to the product itself.

Account names can be replaced with codes — Account 001, Account 002 — with the key held inside the company. A reviewer who needs to know that one annual account waited 70 days for a purchase order does not need to know which account it was until the founder decides to say.

When California law or the company’s own contracts set the floor

B2B contact data is personal information too. The California Consumer Privacy Act defines a consumer as a natural person who is a California resident, and the partial exemption it once gave to people acting for another company — section 1798.145(n) — says it “shall become inoperative on January 1, 2023.” A HubSpot contact who lives in California and buys for a customer is, for a business the law covers, a consumer.

The law covers a “business” that does business in California and meets one or more of the thresholds in section 1798.140(d): annual gross revenues above $25,000,000 in the preceding calendar year, as adjusted under the statute; buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50 percent or more of annual revenues from selling or sharing it. A covered business that discloses personal information to a service provider or contractor must, under section 1798.100(d), have an agreement that limits the purposes and binds the recipient to the law’s obligations; the definitions in 1798.140 require a written contract that prohibits selling or sharing the data or using it for other purposes.

Two more floors sit outside the statute. For contacts in the EU, Article 28 of the GDPR requires processing on a controller’s behalf to be governed by a contract or other legal act. And the company’s own enterprise customers may have signed a data processing agreement that names approved subprocessors. Whether any of this applies, and what a consultant agreement must say, is a question for the company’s attorney. The simplest design is a request that never includes personal information at all.

What to put in writing — and how our Review handles access

Whoever the consultant is, including us, these belong in the signed document before anything moves.

• An NDA signed before any record opens.
• The request list, field by field, with why each field is needed and what is never requested.
• Exports or login; if a login, the role, the named user, two-step verification and the end date.
• Where files are stored, who can open them, and which other tools or subcontractors touch them, including any analysis or AI tool.
• Deletion at the end: what is deleted, by when, and how that is confirmed in writing.

If the question can be answered from counts the founder can pull alone, nothing needs to leave the company. Our Revenue Review is built for the minimal end of the range. As a B2B SaaS RevOps consultant it reads billing and subscription data in Stripe or Chargebee through the View Only role or exports the company runs, HubSpot, Salesforce or Pipedrive through a view-only seat with export off or through exports, and product analytics at account level. No unrestricted API keys, no production database, no login to the product, and contact names can be removed or coded before anything is sent, under an NDA signed first. It takes two weeks and ends in a written report the company keeps. It gives no legal advice and certifies no compliance with any law. If the numbers suggest it, the next step is a free 20-minute call, where the request list gets written before anything moves.