Data Privacy#

We take the security of your data seriously. You can read the nitty gritty details at our privacy policy. Below are a few bullet points to help with common questions.

High Level#

  • Credentials that you use to connect your Accounts to Zapier are protected with bank-level encryption.

  • The only action that Zapier takes on your Accounts are those necessary to run the Zaps you create.

  • The raw requests Zapier makes to other services on your behalf are stored for 7 days for troubleshooting purposes, then purged on a rolling basis.

  • User-facing Task History is stored for longer periods of time so that you can monitor Zapier activity and replay failures.

Technical Details#

  • Zapier login credentials are one-way PBKDF2 hashes with a workload of about 10000 iterations.

  • Account access credentials (like API keys for Mailchimp, tokens for Salesforce, and passwords for developer apps like SAManage) held by Zapier are encrypted with AES and stored in a database. Of course, Zapier has the decryption keys on hand so we can use the credentials but they are stored and maintained separately.

  • All Zapier employees have access to raw HTTP logs as a part of daily support - we censor access tokens/secrets to the best of our ability. All debug logs censor Account credentials (API keys, tokens, etc.) so they are not viewable in raw request logs.

  • Raw low-level request logs are stored for 7 days, user-facing Task History is stored rolling for the previous three months and historical tasks may be stored indefinitely for in-house analysis purposes.

  • We always use https or SSL where possible (both via https://zapier.com and external API services).

  • We use KeyCzar (an open source library made and maintained by Google) with default settings. There is a black box with hot keys that runs and houses our KeyCzar servers. We use standard IAM credentials to limit access to the cold stored keys in S3.

If you have any questions on how Zapier stores or handles your information, feel free to email us at contact@zapier.com.

EU Standard Clauses#

If you are based in Europe and need standard contractual clauses signed to be able to use Zapier, you can use the form below to generate a data processing agreement. Fill in the fields on the form, and you will be emailed a document to e-sign that will have all those details filled in.

https://zapier.typeform.com/to/TcS4pD

HIPAA Compliance#

Zapier can not claim HIPAA compliance.

↑ Was this documentation useful? Yes No (Suggest Edits)
Get Help