// Trust & Security Report
Zillow Group Inc.
Zillow AI mode — conversational real estate assistant (launched March 2026) with guided intelligence for home search, powered by custom AI models integrated with ChatGPT for MLS data access. Also includes AI-powered virtual staging and real estate agent tools (Zillow Pro).
Certifications held
1
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on board-cybersecurity.com“Zillow's information security function is 'informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework.' Security program design guided by Cyber Risk Institute's Cyber Profile.”
> Show 5 unconfirmed / not-held certifications
source: board-cybersecurity.comNo public evidence found in SEC 10-K filings or official security documentation. Zillow's 10-K references NIST Cybersecurity Framework and Cyber Risk Institute Cyber Profile but does not claim SOC 2 certification.
source: board-cybersecurity.comNo public evidence found. While Zillow conducts internal audit teams' security controls testing and engages external auditors for compliance testing, ISO 27001 certification is not mentioned in SEC filings or official documentation.
source: zillow.comno public evidence of formal GDPR certification (GDPR is a regulation, not a certification); the previous proof quote attributed to this page was not verbatim (actual nearby text reads 'Zillow Group may choose or be required by law to provide different or additional disclosures...', not 'Zillow may provide...') and does not itself reference GDPR. The vendor's privacy notice is reported by secondary sources to invoke GDPR/UK GDPR legal bases (Article 6) for EEA/UK residents, but the page returns 403 to automated fetch, so the literal on-page wording could not be independently confirmed.
No public evidence. HIPAA (health insurance portability) is not applicable to Zillow's core real estate business and is not mentioned in compliance documentation.
No public evidence found in available documentation. While Zillow processes financial data for real estate transactions, PCI DSS certification is not explicitly claimed in SEC filings or public security pages.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
US-based (Zillow is a US company; data residency specifics not publicly documented)
ChatGPT integration explicitly designed to prevent data reuse for training: 'ChatGPT cannot use data displayed in the Zillow App outside of the Zillow experience and does not retain any record of what Zillow displayed.' OpenAI cannot train on IDX (MLS) data. Zillow worked with OpenAI to restrict any use of Zillow App data for training. However, Zillow AI mode uses custom AI models trained on Zillow's own data — the training posture for internal models on customer interaction data is not explicitly disclosed as opt-out-able.
// Security controls
Chief Information Security Officer
CISO with 20+ years of technology and cybersecurity experience, holding CISSP certification
board-cybersecurity.comSecurity Controls Testing
Internal audit teams conduct security controls testing over systems in scope for regulatory and compliance requirements
board-cybersecurity.comThird-Party Risk Management
Formal program including security questionnaires, compliance reviews, audit results, network infrastructure oversight for all third-party service providers
board-cybersecurity.comVulnerability Testing
Periodic third-party vulnerability testing and cloud security assessments conducted
board-cybersecurity.comIncident Response
Policies and procedures for detecting, investigating, and responding to security events through multiple channels
board-cybersecurity.comFair Housing Classifier
Real-time guardrail that evaluates both customer questions and AI responses to prevent discriminatory steering in Zillow AI mode and ChatGPT integration
zillow.comEncryption in Transit
API users required to implement HTTPS for secure data transmission
zillowgroup.comBug Bounty / Vulnerability Disclosure
Partners with Bugcrowd to validate and assess reported vulnerabilities
zillow.com// Products & data scope
data: Zillow listing data, user search history (remembered across sessions), public property information
Launched March 2026. Conversational AI assistant with Fair Housing Classifier. ChatGPT-integrated but with explicit data isolation (no training on user queries or Zillow responses). Uses custom AI models on Zillow data. Fair housing guardrails applied.
data: MLS listing data only (no access to user identity or search history via ChatGPT)
Real estate app in ChatGPT (only major real estate app integrated). ChatGPT cannot retain data or use for training. OpenAI cannot train on IDX data. Data flow: ChatGPT sends query to Zillow, Zillow returns listing, no data flow to ChatGPT for training.
data: Agent MLS data, client contacts, transaction history
AI-powered agent suite. Enterprise/team tier offering with compliance requirements for MLS data handling.
data: Property photos uploaded by sellers or agents
AI-powered virtual staging for home listings. Allows agents/sellers to apply design styles (modern, Scandinavian, farmhouse, etc.) to photos.
// What to watch
- OVER-CLAIM RISK: Zillow is a large enterprise with sophisticated security practices (CISO, internal audits, third-party assessments, NIST alignment) but does NOT publicly hold formal third-party certifications (SOC 2, ISO 27001) despite being a major B2B and B2C platform. This is either an authentic gap (Zillow relies on internal controls + regulatory compliance rather than third-party certs) or an intentional avoidance of external audit scrutiny.
- DOCUMENTATION GAP: Zillow's privacy portal and security pages return 403 Forbidden or minimal content when fetched, limiting direct verification of compliance details. Information derived from SEC 10-K cybersecurity disclosures and press releases rather than direct trust center access.
- AI TRAINING POSTURE PARTIALLY UNCLEAR: ChatGPT integration is well-documented with data isolation and no-training guarantees. However, Zillow AI mode's own custom AI models' training on customer interaction data (e.g., user preferences, search patterns across sessions) is not explicitly disclosed as opt-out-able or restricted.
- DPA ABSENCE: No Data Processing Agreement mentioned on public pages. Enterprise/B2B customers may have negotiated DPAs, but no standard vendor-facing DPA document publicly available.
- GDPR CLAIM CORRECTED: Prior draft marked GDPR held=true using a proof quote that was not verbatim (misquoted the privacy notice's disclosures sentence, which does not itself mention GDPR) and conflated a regulation with a certification. Downgraded to held=false / no independently-confirmed on-page evidence; the privacy notice's page returns 403 to automated fetch.
- NO HIPAA/PCI DSS CLAIMS: While Zillow processes financial data in real estate transactions and offers agent/investor tools, no HIPAA or PCI DSS certifications claimed. Likely out of scope (HIPAA for healthcare only; PCI DSS may apply to payment processing but not claimed).
- IDENTITY CONFIRMED: Verified vendor is Zillow Group Inc. (NASDAQ: ZG), public company, real estate platform. Zillow AI is their new generative AI mode launched Q1 2026. No conflation with similarly-named vendors.
// At a glance
Pricing model
Freemium (consumer Zillow AI mode free; Zillow Pro subscription for agents; enterprise API access available through Bridge Interactive)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Zillow Group Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
privacy.zillowgroup.com