Zapier
automation · zapier.com · last read 2026-10-07
Identity
No identity observation recorded yet.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | No EU location | — | zapier.com | 2026-10-07 |
EU: Asked whether data can be stored only within the EU, the document answers that Zapier does not support this option. It also says Zapier hosts data in AWS servers located in the United States.
Subprocessor chain
31 third parties · 5 of the vendor's own group companies · 35 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Ada | US | Technical support chat management |
| Algolia | US | Search functionality for Zapier content, including templates, blog posts, and apps |
| Amazon Web Services (AWS) | US | Cloud service and artificial intelligence provider |
| Anthropic | US | Artificial intelligence provider |
| Databricks | US | Data intelligence |
| Datadog | US | Application performance monitoring, infrastructure and network monitoring, and error capturing |
| Firecrawl | US | Knowledge source gathering capabilities |
| Fireworks AI | US | Artificial intelligence provider |
| Fullstory | US | Analytics to improve Zapier services |
| Gong | US | Call recording and transcribing for services and technical support |
| US | Cloud service and artificial intelligence provider | |
| Grafana Labs (Raintank, Inc.) | US | Observability, monitoring, and application reliability |
| Heroku | US | Deployment and management of Zapier services |
| Knock | US | Customer and end-user communications |
| Liveblocks | US | Collaboration capabilities |
| Looker | US | Analysis of Zapier services usage |
| MadKudu | US | Lead Score by Zapier: Information gathering capabilities about leads submitted by customer queries |
| Mailgun | US | Email by Zapier: Email sending capabilities per customer queries |
| Microsoft | US | Artificial intelligence provider |
| OpenAI | US | Artificial intelligence provider |
| Pinecone | US | Vector database for search features |
| Redis | US | Data storage and caching |
| Sentry | US | Debugging and support for error reporting |
| Stytch | US | End-user authentication capabilities |
| Twilio | US | SMS by Zapier: SMS sending capabilities per customer queries |
| Uploadcare | US | File uploading capabilities |
| Vercel | US | Cloud service provider |
| Vitally | US | Customer success health scoring, and user engagement/usage |
| US | WhatsApp Notifications: WhatsApp chat sending capabilities per customer queries | |
| Zendesk | US | Technical support ticket management |
| Zoom | US | Video conferencing and communications for services and technical support |
Zapier's own group companies listed as subprocessors (5)
| Company | Country | Purpose |
|---|---|---|
| Zapier Australia Pty Ltd. | AU, NZ | Zapier services and support |
| Zapier Automation Inc. | CA | Zapier services and support |
| Zapier Automation Ireland Ltd. | IE, ES | Zapier services and support |
| Zapier India Private Limited | IN | Zapier services and support |
| Zapier UK Ltd. | GB | Zapier services and support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | Full compliance; DPA-backed processor terms included in your agreement with SCCs for international transfers. | zapier.com | 2026-10-05 |
| GDPR | Claimed | Full compliance; DPA-backed processor terms included in your agreement with SCCs for international transfers. | zapier.com | 2026-10-05 |
| UK GDPR · GDPR | Claimed | DPA-backed processor terms included in your agreement with SCCs for international transfers. | zapier.com | 2026-10-05 |
| SOC 2 (Type II) · SOC2T2 | Available on request | Audited annually by an independent firm. Reports available in the Trust Center. | zapier.com | 2026-10-05 |
| SOC 3 · SOC3 | Available on request | Audited annually by an independent firm. Reports available in the Trust Center. | zapier.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Zapier, Inc. | Active | HR data, non-HR data | 2027-07-14 | 2026-10-07 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Zapier, Inc. | Active | HR data, non-HR data | 2027-07-14 | 2026-10-07 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Zapier, Inc. | Active | HR data, non-HR data | 2027-07-14 | 2026-10-07 |
- ACN qualified cloud (Italy): checked 2026-10-07, no entry under Zapier
- Data Privacy Framework List (US): checked 2026-10-07, 3 entries under Zapier
- FedRAMP Marketplace (US): checked 2026-10-07, no entry under Zapier
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-05 |
| residency | Public | full | 200 | 2026-10-07 |
| subprocessors | Public | full | 200 | 2026-10-05 |
History
Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.