Security & certifications

HubSpot will automatically raise the minimum TLS version for HubSpot-hosted domains to TLS 1.2 on October 14, 2026.

Admins can now require passkeys as the only allowed login method for their account.

Azure Event Hubs and Azure Blob Storage destinations can authenticate via a Microsoft Entra ID service principal, alongside existing key-based authentication.

Amazon S3 source ingestion can combine server-side encryption with PGP file encryption; on the AWS VA6 region the max encrypted file size rises from 1GB to 10GB.

The Salesforce CRM destination adds OAuth 2 Client Credentials authentication alongside the existing Password Grant flow.

Now GA (22 Sep 2026). Current summary: Azure Event Hubs and Azure Blob Storage destinations can authenticate via a Microsoft Entra ID service principal, alongside existing key-based authentication.

Now GA (22 Sep 2026). Current summary: Amazon S3 source ingestion can combine server-side encryption with PGP file encryption; on the AWS VA6 region the max encrypted file size rises from 1GB to 10GB.

Now GA (22 Sep 2026). Current summary: The Salesforce CRM destination adds OAuth 2 Client Credentials authentication alongside the existing Password Grant flow.

Admins can set tool-by-tool permissions for each connector used by agents and Breeze Assistant, with one-click write blocking and batch confirmation rules.

Advanced Audit Trail now logs Data Extension access events for security monitoring.

A Security Dashboard gives admins one view of the account's security settings: an overall health score, factors by category, priority improvements and a PDF export. Not available on Hyperforce.

Salesforce announced that, in a future release, accounts using single sign-on will have to use MFA systems that send AMR and ACC claims; the requirement is not yet enforced.

Compliance BCC archives a copy of every outbound marketing email for regulatory recordkeeping.

Each AI Studio chat now runs in its own isolated environment; files the AI writes outside a work folder are deleted with the chat.

Super Admins can approve apps, control who can install them, and restrict data permissions per app, including AI connectors.

Adds bring-your-own-key PGP encryption for archived messages to S3 or SFTP, as an alternative to KMS encryption.

Landing pages can now enforce Web Application Firewall IP allowlisting, rejecting requests that bypass the WAF layer.

Admins must now reauthenticate with MFA before performing critical security tasks, adding step-up protection.

Routes exports to Azure Blob Storage, ADLS Gen2 and Event Hubs over private network links instead of the public internet.

Adds HMAC-based authentication, in both the UI and API, for the Shopify Streaming source connector.

Adds a Private Link Enabled selector for Snowflake Streaming and Batch destinations to support private-only inbound accounts.

Composable Audience Studio now emits premium audit log events for segments, folders, syndications, templates and bulk operations, matching Audience Studio parity.

API keys can be disabled and re-enabled from settings to respond quickly to suspected credential exposure without deleting them.

Custom actions can now authenticate via certificate-based JWT assertion instead of a client secret, for certificate-based enterprise APIs.

URL parameters in tracking and landing page links can now be encrypted, generally available after an earlier limited release.

API key expiration policies are now GA, letting admins enforce automatic key rotation with system-wide or per-user expiration lifespans of 1-365 days.

Older TLS cipher suites are no longer supported for browser or API connections to Marketing Cloud Engagement as of the Summer '26 release; customers must use a modern TLS implementation such as TLS 1.3 with SHA-256/SHA-384 cipher suites.

Treasure AI announced it will remove weak TLS 1.2 cipher suites platform-wide, continuing hardening after retiring TLS 1.0/1.1.

Users can now sign up and log in to Klaviyo with Google credentials instead of a separate password.

Now GA (1 Jun 2026). Current summary: URL parameters in tracking and landing page links can now be encrypted, generally available after an earlier limited release.

HTTP API destinations can now authenticate with OAuth 2 when the token endpoint requires mutual TLS (mTLS).

Treasure Data will drop support for TLS 1.0/1.1 on customer-facing endpoints effective February 28, 2026, requiring TLS 1.2 or higher.

Promotional texts are now automatically capped at three per 24 hours in regulated US states including Oregon, Florida, Oklahoma and Maryland.