Skip to content
Enterprise security

Stay in control while you scale

Zapier helps you protect your data, control access, govern every AI tool and agent, and stay compliant without slowing down adoption.

Visit Trust CenterContact Sales
SOC 2 (Type II) & SOC 3
Annually audited
GDPR & CCPA
Full compliance
Enterprise SSO
SAML 2.0 + SCIM
Observability
Logs, analytics, and alerts

Security-first companies run on Zapier

  • Identity and Access Management
  • Financial Services
  • Biotech SaaS
  • Audit Management Software
  • Cloud Storage
  • Industrial Technology

AI & Agent Security

AI security your team can trust

Make security easy for everyone to uphold. Zapier applies your policies, guardrails, and audit trail across workflows, agents, and AI steps.

  • AI guardrails: Scan AI steps, agents, and MCP connections for PII, prompt injection, and toxicity. Block, route, or detect only, per check.

  • Model controls: Zapier lets you approve providers or bring your own model, and turn AI off entirely at any time.

  • Agent permissions: Zapier lets you decide which apps and actions are available by user, team, and workspace.

  • App credentials: Zapier stores encrypted app credentials (OAuth, API keys, and more) in account-owned connections, so agents and MCPs never receive raw third-party tokens.

  • Audit trail: Zapier records every AI and agent action, so you can always see what happened and when.

Talk to Sales

Security built into every workflow

SOC 2 Type II and SOC 3 compliance certification badge
SOC 2 (Type II) SOC 3
CCPA compliance certification badge
CCPA
GDPR compliance certification badge
GDPR Compliant
GDPR UK compliance certification badge
GDPR UK Compliant

Infrastructure and assurance

Being compliant isn't the same as being secure. Zapier does both through a robust combination of third-party testing, independent audits, and a dedicated internal security team.

Features

SOC 2 (Type II) & SOC 3
Audited annually by an independent firm. Reports available in the Trust Center.
Security monitoring & incident response
Real-time threat detection, with a dedicated team that owns the response.
AWS cloud infrastructure
Enterprise-grade hosting on AWS in the United States.
Annual penetration tests
Independent experts test our defenses every year.
Bug bounty program
Security researchers are paid to find vulnerabilities before attackers do.
Built-in resilience
Autoreplay and flood protection recover many failures; replay is limited and not guaranteed.

Access and identity

Provision, deprovision, and enforce policies all in one place. Zapier works with your existing identity and access management tools, so you can govern access from someone's first day on the job to their last.

Features

SSO (SAML)
Secure sign-in through your existing identity provider (IDP).
Role-based access
Define who can view, build, or manage, and what apps and actions they can use, set by role and workspace.
Two factor authentication (2FA)
Add a second layer of protection to prevent unauthorized access.
SCIM provisioning
Automate user provisioning for efficient access management.
Allowed domains
Prevent data exfiltration by locking certain apps to a company email domain (no personal accounts allowed).
Domain capture
Route new signups on verified domains into your Enterprise account via SSO.

Data protection and privacy

Zapier protects your data in transit, at rest, and over time. Get encryption everywhere it travels or sits, retention you control, and privacy commitments you feel good about.

Features

Encryption in transit (TLS 1.2+) and at rest (AES-256)
Your data is encrypted everywhere it moves and everywhere it's stored.
Custom data retention
Control exactly how long your sensitive data remains.
Static IP
Zapier's requests can come from a fixed set of IPs your firewall can allowlist.
GDPR, UK GDPR, and CCPA
DPA-backed processor terms included in your agreement with SCCs for international transfers.
VPC Peering
Connect internal data sources privately, without crossing the public internet.

Audit and observability

See for yourself. Zapier makes every action visible so you can search, stream, and pull into your own tools.

Features

Audit logs
Immutable, searchable records of who did what, when.
Asset History API
Pull every change record into your own reporting tools.
Log streaming
Stream activity to Datadog, Splunk, or your SIEM in real time.
Analytics
Get an overview of your accounts so you can identify issues and drive adoption.
Governance controls

Built for companies where every team builds

Most platforms assume a small circle of trusted builders. Zapier is designed to govern builders who aren't security experts. You set the guardrails; teams build within them.
  • Contain team info. Workspaces keep each team’s work separate and scoped.
  • Control which apps run, and what they can do. Allow or block any app, then restrict which teams or individuals can do what with it by endpoint.
  • Lock sensitive apps to company connections. Managed connections: For designated apps, teams build only on connections you own and control.
  • Nothing ships without signoff. Pause any changes until designated approvers say yes.
Explore Zapier for Enterprise

FAQs

Is Zapier compliant with SOC 2 and SOC 3 standards?
Yes. Zapier is SOC 2 (Type II) and SOC 3 certified, audited annually by an independent firm.
Where can I find Zapier’s SOC 2 and SOC 3 reports?
Both are in the Zapier Trust Center. SOC 3 is public; SOC 2 (Type II) requires an NDA.
Does Zapier use customer data to train AI models?
We don’t train on the data that runs through your workflows, on any plan. To improve AI features, Zapier may learn from how workflows are built: the structure, not the contents. Enterprise accounts are opted out of even that automatically; other plans can opt out with one form. Opting out doesn’t change how your workflows run.
How does Zapier secure MCP connections?
Zapier handles OAuth and stores credentials, so agents don’t see your passwords or API keys. Admins control which apps and actions each agent can use. Every agent action lands in the audit log.
Where does Zapier store data?
Zapier stores data on Amazon Web Services (AWS) in the United States.
Does Zapier offer two-factor authentication (2FA)?
Yes, Zapier offers 2FA on every plan. Enterprise adds SSO (SAML) and SCIM provisioning.
How do I keep teams from publishing risky workflows on Zapier?
Zapier is designed for companies where everyone builds, not just a small circle of trusted admins, so the controls run deep. A few examples: block apps entirely, allow an app but limit its actions (your CRM can be read but not written to), or require sign-off so nothing goes live until someone you choose approves it.
Does Zapier support approval workflows?
Yes. Approvals pause any workflow change for sign-off before it reaches production.
What is Zapier's approach to vulnerability management?
Zapier’s approach is continuous, not annual: threat assessments, yearly third-party penetration tests, and an active bug bounty program.
How does Zapier monitor and log user activity?
Zapier’s audit logs show who did what, when. Customers on Enterprise plans can stream them to tools like Datadog and Splunk in real time.
Is Zapier secure?
Yes. Zapier is SOC 2 Type II and SOC 3 certified, encrypts data in transit and at rest, and puts governance controls on every workflow, agent, and AI surface. This page covers the specifics.
What security measures does Zapier use to protect user data?
Zapier encrypts data in transit (TLS 1.2+) and at rest (AES-256). Details, including our security whitepaper, are in the Zapier Trust Center.
Is Zapier GDPR and CCPA compliant?
Zapier supports compliance through a DPA included in your agreement: we process personal data in Customer Content as your processor under GDPR, UK GDPR, and CCPA/CPRA, with SCCs for international transfers. Compliance is shared—you govern lawful use of data in your workflows; we provide contractual processor terms, security controls, and retention tools.
Learn more
How does Zapier handle data privacy in AI features?
Zapier’s AI features meet the same bar as everything else. For full control, bring your own keys or your own provider, like Amazon Bedrock; AI runs through your accounts, so your data falls under your contracts. And AI Guardrails protect every AI step, detecting PII, blocking prompt injection, and flagging toxic content before anything reaches your systems.

We're here to help

Whether you need documentation, answers to technical questions, or help finishing a security review.

Talk to salesView Trust Center