Fuse synchronizes only HubSpot Deals explicitly marked with
Deployment / Ecosystem = AWS. It creates and updates the
corresponding AWS Partner Central opportunity, and imports AWS Partner
Central opportunities into the installing HubSpot portal. Azure, GCP,
on-premises, and ordinary HubSpot Deals are not sent to AWS.
After a portal is successfully activated, Fuse also emits one installation-scoped event that creates one AWS-classified Deal in a21.ai’s own HubSpot portal for launch and funding operations. That bridge uses a separately administered a21.ai credential, never the installing portal’s OAuth token. Missing customer company, country, or contact details are marked for a21.ai representative review and are not guessed.
FuseAI is included in Fuse’s tenant-one launch scope. FuseAI is disabled until the a21.ai portal administrator explicitly opts in during installation; this is a consent control, not a later delivery phase.
The public app is multi-tenant: every HubSpot portal is a separate tenant with its own OAuth grant, AWS seller-role connection, configuration, records, queues, and export namespace. A browser cannot choose or override the tenant identifier.
Fuse does not assume that every HubSpot Deal belongs in AWS Partner
Central. A Deal enters the Fuse workflow only when
Deployment / Ecosystem is set to AWS, or when
an administrator links it to an existing AWS Partner Central opportunity
during initial reconciliation. Non-AWS Deals retain the normal HubSpot
record experience.
Fuse prevents an accidental duplicate while the same linked opportunity is active. If an earlier AWS opportunity is closed and the business requires a replacement, the replacement AWS opportunity is synchronized as a new HubSpot Deal under the configured lifecycle mapping.
Fuse autosaves changes and also provides Save draft. After closing the overlay, the Deal tab confirms that the draft was saved, shows remaining work, and lets the rep resume without forcing the form open. Resume returns to the saved section and retains the previously entered values.
After submission, the Deal’s a21.ai Fuse tab shows the linked AWS opportunity, Partner Central identifiers and status, synchronization state, owner/contact information, next action, editable opportunity sections, history, and FuseAI. HubSpot and Partner Central changes synchronize through the configured bidirectional field and lifecycle mappings. Administrators can correct an incorrectly linked pair by disassociating it and linking the correct records.
HubSpot Super Admins use the dedicated Fuse App Page—not an extra CRM object—to manage the connector. The administration workspace contains:
The first synchronization never silently accepts an uncertain record match. Each candidate is presented with the HubSpot Deal, AWS opportunity, match evidence, and one of these administrator decisions:
An administrator can later inspect linked records, correct a wrong association, refresh candidates, and resolve synchronization conflicts from Sync & Associations.
The HubSpot user who completes Fuse activation must be a current Super Admin and must be able to install Marketplace apps and grant the requested scopes. Fuse verifies that authority against HubSpot’s current account-user record; a UI-supplied role or email is not sufficient. The installing organization must also have an AWS account with Partner Central Selling API access. One HubSpot portal connects to one AWS Partner Central seller environment in V1.
Activation is not rolled back if the separate a21.ai internal-Deal delivery is delayed. That delivery is durably retried and monitored under the same immutable installation activation event ID.
Reconnect is an explicit OAuth operation. Deploying a scope change
does not update an existing grant, so a current Super Admin must
re-authorize Fuse to restore missing permissions. A successful new OAuth
grant reactivates only the portal represented by HubSpot’s returned
hub_id; it cannot reactivate another tenant or silently
extend an existing trial.
| Scope | Why Fuse requires it |
|---|---|
oauth |
Install the app separately in each portal and refresh that portal’s token. |
crm.objects.deals.read,
crm.objects.deals.write |
Read AWS-marked Deals and project AWS-owned opportunity status back to the same Deals. |
crm.schemas.deals.read,
crm.schemas.deals.write |
Verify and provision Fuse’s aws_pc_* Deal
properties. |
crm.objects.companies.read,
crm.objects.companies.write |
Read associated customer information and create/update the company association needed by an imported AWS opportunity. |
crm.objects.contacts.read,
crm.objects.contacts.write |
Read optional customer/partner contacts; create/update imported contact associations; read Deal-associated notes, tasks, calls, and meetings as FuseAI evidence; and create a note or task only after the signed-in user explicitly confirms the exact FuseAI draft. HubSpot’s engagement APIs use these contact scopes rather than separate activity-object scopes. |
crm.objects.owners.read |
Match an AWS partner-contact email to an active HubSpot owner; otherwise use the configured tenant fallback owner. |
settings.users.read |
Verify that the exact signed HubSpot user accepting the agreement is still a current Super Admin, using HubSpot’s server-side account-user record. |
| Scope | Feature enabled when granted |
|---|---|
sales-email-read |
Read the content of Deal-associated one-to-one email engagements as source evidence for tenant-authorized FuseAI guidance. Fuse does not send email. |
Fuse records the exact scope inventory returned by HubSpot. If an
administrator does not grant sales-email-read, Fuse remains
connected and shows a limited feature state for activity evidence with
a reconnect action; note and task creation remain covered by the required
crm.objects.contacts.write scope. If a required scope is
absent, Fuse stores that current grant truth but blocks HubSpot provider
operations until an administrator reconnects.
The app does not request broad CRM export, automation, content,
billing, or user-management write scopes. Account-user access is
read-only and is used for activation authority verification. HubSpot
documents marketplace plus OAuth as the supported
developer-platform configuration for Marketplace apps: https://developers.hubspot.com/docs/apps/developer-platform/build-apps/app-configuration.
The settings page requires confirmation before disconnecting. On confirmation, the backend:
REVOKED before any external call,
immediately stopping API and scheduled work;A transient HubSpot failure leaves the portal disabled and retains the token only so cleanup can be retried. Tokens and client credentials are never returned to the UI, written to HubSpot properties, included in exports, or logged. HubSpot’s current uninstall contract is documented at https://developers.hubspot.com/docs/api-reference/latest/app-management/app-uninstalls/uninstall-app.
Fuse data is used only to synchronize and operate the installing tenant’s HubSpot and AWS Partner Central records, diagnose failures, provide tenant-authorized exports, and meet security/recovery obligations.
Source validation and successful test-portal installation do not themselves authorize public release. The verified domain, public privacy policy and terms URLs, security review, HubSpot AUP, Marketplace listing, two-portal/two-AWS-account acceptance, and production deployment approval must all be complete before listing.
Current requirements: https://developers.hubspot.com/docs/apps/developer-platform/list-apps/listing-your-app/app-marketplace-listing-requirements.