// Trust & Security Report
Zillow AI
by Zillow Group Inc.
Zillow AI mode: conversational real estate assistant (launched March 2026) with guided intelligence for home search, powered by custom AI models integrated with ChatGPT for MLS data access. Also includes AI-powered virtual staging and real estate agent tools (Zillow Pro).
Certifications held
1
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on board-cybersecurity.com“Zillow's information security function is 'informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework.' Security program design guided by Cyber Risk Institute's Cyber Profile.”
> Show 5 unconfirmed / not-held certifications
source: board-cybersecurity.comNo public evidence found in SEC 10-K filings or official security documentation. Zillow's 10-K references NIST Cybersecurity Framework and Cyber Risk Institute Cyber Profile but does not claim SOC 2 certification.
source: board-cybersecurity.comNo public evidence found. While Zillow conducts internal audit teams' security controls testing and engages external auditors for compliance testing, ISO 27001 certification is not mentioned in SEC filings or official documentation.
No public evidence of formal GDPR certification; GDPR is a regulation, not a certification. The vendor's privacy notice is reported by secondary sources to invoke GDPR and UK GDPR legal bases (Article 6) for EEA and UK residents, though the on-page wording could not be independently confirmed.
No public evidence. HIPAA (health insurance portability) is not applicable to Zillow's core real estate business and is not mentioned in compliance documentation.
No public evidence found in available documentation. While Zillow processes financial data for real estate transactions, PCI DSS certification is not explicitly claimed in SEC filings or public security pages.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
US-based (Zillow is a US company; data residency specifics not publicly documented)
The ChatGPT integration is designed to prevent data reuse for training: 'ChatGPT cannot use data displayed in the Zillow App outside of the Zillow experience and does not retain any record of what Zillow displayed.' OpenAI cannot train on IDX (MLS) data; Zillow worked with OpenAI to restrict any use of Zillow App data for training. Zillow AI mode uses custom AI models trained on Zillow's own data, and the training posture for internal models on customer interaction data is not explicitly disclosed as opt-out-able.
// Security controls
Chief Information Security Officer
CISO with 20+ years of technology and cybersecurity experience, holding CISSP certification
board-cybersecurity.comSecurity Controls Testing
Internal audit teams conduct security controls testing over systems in scope for regulatory and compliance requirements
board-cybersecurity.comThird-Party Risk Management
Formal program including security questionnaires, compliance reviews, audit results, network infrastructure oversight for all third-party service providers
board-cybersecurity.comVulnerability Testing
Periodic third-party vulnerability testing and cloud security assessments conducted
board-cybersecurity.comIncident Response
Policies and procedures for detecting, investigating, and responding to security events through multiple channels
board-cybersecurity.comFair Housing Classifier
Real-time guardrail that evaluates both customer questions and AI responses to prevent discriminatory steering in Zillow AI mode and ChatGPT integration
zillow.comEncryption in Transit
API users required to implement HTTPS for secure data transmission
zillowgroup.comBug Bounty / Vulnerability Disclosure
Partners with Bugcrowd to validate and assess reported vulnerabilities
zillow.com// Products & data scope
Data it handles: Zillow listing data, user search history (remembered across sessions), public property information
Launched March 2026. Conversational AI assistant with Fair Housing Classifier. ChatGPT-integrated but with explicit data isolation (no training on user queries or Zillow responses). Uses custom AI models on Zillow data. Fair housing guardrails applied.
Data it handles: MLS listing data only (no access to user identity or search history via ChatGPT)
Real estate app in ChatGPT (only major real estate app integrated). ChatGPT cannot retain data or use for training. OpenAI cannot train on IDX data. Data flow: ChatGPT sends query to Zillow, Zillow returns listing, no data flow to ChatGPT for training.
Data it handles: Agent MLS data, client contacts, transaction history
AI-powered agent suite. Enterprise/team tier offering with compliance requirements for MLS data handling.
Data it handles: Property photos uploaded by sellers or agents
AI-powered virtual staging for home listings. Allows agents/sellers to apply design styles (modern, Scandinavian, farmhouse, etc.) to photos.
// What to watch
- Zillow is a large enterprise with sophisticated security practices (CISO, internal audits, third-party assessments, NIST alignment) but does not publicly hold formal third-party certifications such as SOC 2 or ISO 27001, despite being a major B2B and B2C platform. Zillow relies on internal controls and regulatory compliance rather than third-party certification.
- The ChatGPT integration is well-documented with data isolation and no-training guarantees. However, Zillow AI mode's own custom AI models' training on customer interaction data (for example, user preferences and search patterns across sessions) is not explicitly disclosed as opt-out-able or restricted.
- No Data Processing Agreement is mentioned on public pages. Enterprise or B2B customers may have negotiated DPAs, but no standard vendor-facing DPA document is publicly available.
- While Zillow processes financial data in real estate transactions and offers agent and investor tools, no HIPAA or PCI DSS certifications are claimed. HIPAA applies to healthcare only; PCI DSS may apply to payment processing but is not claimed.
- The vendor is Zillow Group Inc. (NASDAQ: ZG), a public company operating a real estate platform. Zillow AI is its generative AI mode, launched Q1 2026. There is no conflation with similarly named vendors.
// At a glance
Pricing model
Freemium (consumer Zillow AI mode free; Zillow Pro subscription for agents; enterprise API access available through Bridge Interactive)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Zillow Group Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
privacy.zillowgroup.com