Snapshot 38550
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Enterprise security Stay in control while you scale Zapier helps you protect your data, control access, govern every AI tool and agent, and stay compliant without slowing down adoption. Visit Trust CenterContact Sales SOC 2 (Type II) & SOC 3 Annually audited GDPR & CCPA Full compliance Enterprise SSO SAML 2.0 + SCIM Observability Logs, analytics, and alerts Security-first companies run on Zapier Identity and Access Management Financial Services Biotech SaaS Audit Management Software Cloud Storage Industrial Technology AI & Agent Security AI security your team can trust Make security easy for everyone to uphold. Zapier applies your policies, guardrails, and audit trail across workflows, agents, and AI steps. AI guardrails: Scan AI steps, agents, and MCP connections for PII, prompt injection, and toxicity. Block, route, or detect only, per check. Model controls: Zapier lets you approve providers or bring your own model, and turn AI off entirely at any time. Agent permissions: Zapier lets you decide which apps and actions are available by user, team, and workspace. App credentials: Zapier stores encrypted app credentials (OAuth, API keys, and more) in account-owned connections, so agents and MCPs never receive raw third-party tokens. Audit trail: Zapier records every AI and agent action, so you can always see what happened and when. Talk to Sales Security built into every workflow SOC 2 (Type II) SOC 3 CCPA GDPR Compliant GDPR UK Compliant Infrastructure and assurance Being compliant isn't the same as being secure. Zapier does both through a robust combination of third-party testing, independent audits, and a dedicated internal security team. Features SOC 2 (Type II) & SOC 3 Audited annually by an independent firm. Reports available in the Trust Center. Security monitoring & incident response Real-time threat detection, with a dedicated team that owns the response. AWS cloud infrastructure Enterprise-grade hosting on AWS in the United States. Annual penetration tests Independent experts test our defenses every year. Bug bounty program Security researchers are paid to find vulnerabilities before attackers do. Built-in resilience Autoreplay and flood protection recover many failures; replay is limited and not guaranteed. Access and identity Provision, deprovision, and enforce policies all in one place. Zapier works with your existing identity and access management tools, so you can govern access from someone's first day on the job to their last. Features SSO (SAML) Secure sign-in through your existing identity provider (IDP). Role-based access Define who can view, build, or manage, and what apps and actions they can use, set by role and workspace. Two factor authentication (2FA) Add a second layer of protection to prevent unauthorized access. SCIM provisioning Automate user provisioning for efficient access management. Allowed domains Prevent data exfiltration by locking certain apps to a company email domain (no personal accounts allowed). Domain capture Route new signups on verified domains into your Enterprise account via SSO. Data protection and privacy Zapier protects your data in transit, at rest, and over time. Get encryption everywhere it travels or sits, retention you control, and privacy commitments you feel good about. Features Encryption in transit (TLS 1.2+) and at rest (AES-256) Your data is encrypted everywhere it moves and everywhere it's stored. Custom data retention Control exactly how long your sensitive data remains. Static IP Zapier's requests can come from a fixed set of IPs your firewall can allowlist. GDPR, UK GDPR, and CCPA DPA-backed processor terms included in your agreement with SCCs for international transfers. VPC Peering Connect internal data sources privately, without crossing the public internet. Audit and observability See for yourself. Zapier makes every action visible so you can search, stream, and pull into your own tools. Features Audit logs Immutable, searchable records of who did what, when. Asset History API Pull every change record into your own reporting tools. Log streaming Stream activity to Datadog, Splunk, or your SIEM in real time. Analytics Get an overview of your accounts so you can identify issues and drive adoption. Governance controls Built for companies where every team builds Most platforms assume a small circle of trusted builders. Zapier is designed to govern builders who aren't security experts. You set the guardrails; teams build within them. Contain team info. Workspaces keep each team’s work separate and scoped. Control which apps run, and what they can do. Allow or block any app, then restrict which teams or individuals can do what with it by endpoint. Lock sensitive apps to company connections. Managed connections: For designated apps, teams build only on connections you own and control. Nothing ships without signoff. Pause any changes until designated approvers say yes. Explore Zapier for Enterprise FAQs Is Zapier compliant with SOC 2 and SOC 3 standards? Yes. Zapier is SOC 2 (Type II) and SOC 3 certified, audited annually by an independent firm. Where can I find Zapier’s SOC 2 and SOC 3 reports? Both are in the Zapier Trust Center. SOC 3 is public; SOC 2 (Type II) requires an NDA. Does Zapier use customer data to train AI models? We don’t train on the data that runs through your workflows, on any plan. To improve AI features, Zapier may learn from how workflows are built: the structure, not the contents. Enterprise accounts are opted out of even that automatically; other plans can opt out with one form. Opting out doesn’t change how your workflows run. How does Zapier secure MCP connections? Zapier handles OAuth and stores credentials, so agents don’t see your passwords or API keys. Admins control which apps and actions each agent can use. Every agent action lands in the audit log. Where does Zapier store data? Zapier stores data on Amazon Web Services (AWS) in the United States. Does Zapier offer two-factor authentication (2FA)? Yes, Zapier offers 2FA on every plan. Enterprise adds SSO (SAML) and SCIM provisioning. How do I keep teams from publishing risky workflows on Zapier? Zapier is designed for companies where everyone builds, not just a small circle of trusted admins, so the controls run deep. A few examples: block apps entirely, allow an app but limit its actions (your CRM can be read but not written to), or require sign-off so nothing goes live until someone you choose approves it. Does Zapier support approval workflows? Yes. Approvals pause any workflow change for sign-off before it reaches production. What is Zapier's approach to vulnerability management? Zapier’s approach is continuous, not annual: threat assessments, yearly third-party penetration tests, and an active bug bounty program. How does Zapier monitor and log user activity? Zapier’s audit logs show who did what, when. Customers on Enterprise plans can stream them to tools like Datadog and Splunk in real time. Is Zapier secure? Yes. Zapier is SOC 2 Type II and SOC 3 certified, encrypts data in transit and at rest, and puts governance controls on every workflow, agent, and AI surface. This page covers the specifics. What security measures does Zapier use to protect user data? Zapier encrypts data in transit (TLS 1.2+) and at rest (AES-256). Details, including our security whitepaper, are in the Zapier Trust Center. Is Zapier GDPR and CCPA compliant? Zapier supports compliance through a DPA included in your agreement: we process personal data in Customer Content as your processor under GDPR, UK GDPR, and CCPA/CPRA, with SCCs for international transfers. Compliance is shared—you govern lawful use of data in your workflows; we provide contractual processor terms, security controls, and retention tools. Learn more How does Zapier handle data privacy in AI features? Zapier’s AI features meet the same bar as everything else. For full control, bring your own keys or your own provider, like Amazon Bedrock; AI runs through your accounts, so your data falls under your contracts. And AI Guardrails protect every AI step, detecting PII, blocking prompt injection, and flagging toxic content before anything reaches your systems. We're here to help Whether you need documentation, answers to technical questions, or help finishing a security review. Talk to salesView Trust Center