Semrush

AI-powered SEO and digital marketing platform for visibility, content, and competitive intelligence

HubSpot

AI-powered CRM platform for marketing, sales, and customer service

Semrush

Moderate

13/25

HubSpot

Moderate

16/25

Score Breakdown

DimensionSemrushHubSpot

Data Residency

Where is your data stored and processed?

Semrush: Infrastructure spans US and EU; no dedicated per-customer data residency selection; standard DPA available for GDPR compliance

HubSpot: EU data hosting on AWS EU is available for Professional and Enterprise tiers but requires explicit configuration.

2/5

Infrastructure spans US and EU; no dedicated per-customer data residency selection; standard DPA available for GDPR compliance

3/5

EU data hosting on AWS EU is available for Professional and Enterprise tiers but requires explicit configuration.

Legal Jurisdiction

Which laws govern the company and your data?

Semrush: US-incorporated public company, now a subsidiary of Adobe Inc.; subject to US jurisdiction and CLOUD Act; GDPR DPA available

HubSpot: US-incorporated public company on the NYSE, subject to CLOUD Act, with SCCs available for EU data transfers.

2/5

US-incorporated public company, now a subsidiary of Adobe Inc.; subject to US jurisdiction and CLOUD Act; GDPR DPA available

2/5

US-incorporated public company on the NYSE, subject to CLOUD Act, with SCCs available for EU data transfers.

Data Retention & Training

Is your data used for model training?

Semrush: Primarily processes public web data; customer project and account data retained per privacy policy; no known use of customer data for AI model training

HubSpot: Does not train AI models on customer CRM data; configurable data retention and deletion controls are available.

3/5

Primarily processes public web data; customer project and account data retained per privacy policy; no known use of customer data for AI model training

4/5

Does not train AI models on customer CRM data; configurable data retention and deletion controls are available.

Certifications

ISO 27001, SOC 2, Cyber Essentials, etc.

Semrush: SOC 2 Type II certified; GDPR and CCPA compliant; no ISO 27001 publicly confirmed

HubSpot: Holds both SOC 2 Type II and ISO 27001, with a detailed sub-processor list and DPA available for all customers.

3/5

SOC 2 Type II certified; GDPR and CCPA compliant; no ISO 27001 publicly confirmed

4/5

Holds both SOC 2 Type II and ISO 27001, with a detailed sub-processor list and DPA available for all customers.

Regulatory Fit

Suitability for regulated industries and professional services

Semrush: Suitable for marketing and SEO teams across regulated industries; primary risk is account data jurisdiction rather than sensitive data processing

HubSpot: Adequate for most EU businesses when EU hosting is confirmed and DPA signed; regulated sectors should validate sub-processors.

3/5

Suitable for marketing and SEO teams across regulated industries; primary risk is account data jurisdiction rather than sensitive data processing

3/5

Adequate for most EU businesses when EU hosting is confirmed and DPA signed; regulated sectors should validate sub-processors.

Total Score

13/25

16/25

Best For

Semrush

Best for privacy-conscious teams who need strong data retention controls; teams on a tight budget.

HubSpot

Best for teams that prioritise data retention & training (scores 3/5) and need a bronze-tier tool.

Detailed Comparison

HubSpot vs Semrush: Trust & Compliance Comparison

HubSpot (HubSpot, US) scores 16/25 overall with a Bronze (Moderate) trust badge. AI-powered CRM platform for marketing, sales, and customer service. Semrush (Semrush, US) scores 13/25 with a Bronze (Moderate) trust badge. AI-powered SEO and digital marketing platform for visibility, content, and competitive intelligence.

Dimension-by-Dimension Breakdown

#### Data Residency

HubSpot leads with 3/5 vs 2/5.

●HubSpot (3/5): EU data hosting on AWS EU is available for Professional and Enterprise tiers but requires explicit configuration.

●Semrush (2/5): Infrastructure spans US and EU; no dedicated per-customer data residency selection; standard DPA available for GDPR compliance

#### Legal Jurisdiction

Both score equally at 2/5.

●HubSpot (2/5): US-incorporated public company on the NYSE, subject to CLOUD Act, with SCCs available for EU data transfers.

●Semrush (2/5): US-incorporated public company, now a subsidiary of Adobe Inc.; subject to US jurisdiction and CLOUD Act; GDPR DPA available

#### Data Retention & Training

HubSpot leads with 4/5 vs 3/5.

●HubSpot (4/5): Does not train AI models on customer CRM data; configurable data retention and deletion controls are available.

●Semrush (3/5): Primarily processes public web data; customer project and account data retained per privacy policy; no known use of customer data for AI model training

#### Certifications

HubSpot leads with 4/5 vs 3/5.

●HubSpot (4/5): Holds both SOC 2 Type II and ISO 27001, with a detailed sub-processor list and DPA available for all customers.

●Semrush (3/5): SOC 2 Type II certified; GDPR and CCPA compliant; no ISO 27001 publicly confirmed

#### Regulatory Fit

Both score equally at 3/5.

●HubSpot (3/5): Adequate for most EU businesses when EU hosting is confirmed and DPA signed; regulated sectors should validate sub-processors.

●Semrush (3/5): Suitable for marketing and SEO teams across regulated industries; primary risk is account data jurisdiction rather than sensitive data processing

Certifications at a Glance

Certification	HubSpot	Semrush
ISO 27001	Yes	No
SOC 2 Type II	Yes	Yes

Overall Verdict

HubSpot has a clear trust advantage, scoring 16/25 compared to Semrush's 13/25. HubSpot particularly excels in data residency, data retention & training, certifications.

Frequently Asked Questions

Which is better for EU compliance, Semrush or HubSpot?

Semrush has a TrustKit score of 13/25 while HubSpot scores 16/25. HubSpot currently rates higher across data residency, legal jurisdiction, data retention, certifications, and regulatory fit.

How do Semrush and HubSpot compare on data residency?

Semrush scores 2/5 for data residency (Infrastructure spans US and EU; no dedicated per-customer data residency selection; standard DPA available for GDPR compliance), while HubSpot scores 3/5 (EU data hosting on AWS EU is available for Professional and Enterprise tiers but requires explicit configuration.).

Are Semrush and HubSpot GDPR compliant?

Both tools are assessed across five compliance dimensions. Semrush has a regulatory fit score of 3/5 and HubSpot scores 3/5. Check the full comparison above for a detailed breakdown.

Explore Each Tool