// Trust & Security Report
ZoomInfo
B2B go-to-market (GTM) intelligence platform including SalesOS (contact and company database), ZoomInfo Copilot (AI sales assistant), MarketingOS, TalentOS (recruiting), OperationsOS (data enrichment), and GTM Studio (workflow automation)
Certifications held
11
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.zoominfo.com“CSA star level 1 ISO 27017 ISO 27001:2013 ISO 27701 Resources View all GTM SOC 2 Type II - 2026 Security Overview TRUSTe Responsible AI Certification TRUSTe GDPR Attestation Legitimate Interest”
Verify on trust.zoominfo.com“Impact Assessment SalesOS Dataflow Diagram Zoominfo CAIQ 2025 SalesOS pentest ISO 27001 and 27701 Controls View all Privacy Public Privacy Policy TRUSTe Enterprise Privacy Certification TRUSTe CCPA”
Verify on trust.zoominfo.com“sment SalesOS Dataflow Diagram Zoominfo CAIQ 2025 SalesOS pentest ISO 27001 and 27701 Controls View all Privacy Public Privacy Policy TRUSTe Enterprise Privacy Certification TRUSTe CCPA Validation View 7 m”
Verify on trust.zoominfo.com“EU-US Data Privacy Framework Swiss-US Privacy Shield CSA star level 1 ISO 27017 ISO 27001:2013 ISO 27701 Resources View all GTM SOC 2 Type II - 2026 Security Overview TRUSTe Responsible AI”
Verify on trust.zoominfo.com“Privacy Certification EU-US Data Privacy Framework Swiss-US Privacy Shield CSA star level 1 ISO 27017 ISO 27001:2013 ISO 27701 Resources View all GTM SOC 2 Type II - 2026 Security Overview TRUSTe”
Verify on trust.zoominfo.com“C 2 Type II - 2026 Security Overview TRUSTe Responsible AI Certification TRUSTe GDPR Attestation Legitimate Interest Assessment - 2025 Transfer Impact Assessment SalesOS Dataflow Diagram Zoominfo CAIQ 202”
Verify on trust.zoominfo.com“TRUSTe Enterprise Privacy Certification listed as a primary certification on the Trust Center and under Privacy controls section”
Verify on trust.zoominfo.com“TRUSTe CCPA Validation listed under Privacy controls on the Trust Center”
Verify on trust.zoominfo.com“TRUSTe Responsible AI Certification listed as a downloadable resource in the Trust Center resources section”
Verify on trust.zoominfo.com“EU-US Data Privacy Framework listed as a certification on the Trust Center; privacy policy confirms compliance and appointment of VeraSafe as Article 27 representative”
Verify on trust.zoominfo.com“Swiss-US Privacy Shield listed as a certification on the Trust Center; the Trust Center uses the older 'Privacy Shield' name, which likely refers to the Swiss-US Data Privacy Framework adopted in 2023-2024”
> Show 5 unconfirmed / not-held certifications
source: trust.zoominfo.comNo public evidence found on vendor domain; ISO 27017 is confirmed but ISO 27018 is not separately listed
source: zoominfo.comNo mention of HIPAA compliance in ZoomInfo's privacy policy, security overview, or trust center. Security overview lists HIPAA only as a requirement ZoomInfo places on its own third-party vendors, not as a certification ZoomInfo itself holds
source: zoominfo.comPCI DSS is listed only as a requirement ZoomInfo places on third-party service providers; no evidence ZoomInfo itself holds PCI DSS certification
source: trust.zoominfo.comNo public evidence found on vendor domain; TRUSTe Responsible AI Certification is held instead
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Primarily United States (AWS infrastructure); personal information 'may be transferred to, and stored and processed in, the United States or any other country in which we or our affiliates or subcontractors maintain facilities.' No contractual data residency guarantee for EU customers beyond DPA Standard Contractual Clauses.
ZoomInfo's privacy policy states it may use customer information to 'Fine-tune or train LLMs or other Artificial Intelligence models.' The License Terms and Conditions (Section 5.5-5.6) grant ZoomInfo a perpetual right to use Submitted Data and Related Information to 'test, develop, improve, or enhance ZoomInfo's products and services.' An opt-out mechanism is available within the ZoomInfo platform settings (Section 5.5). Anthropic PBC is listed as a subprocessor providing 'Generative AI services,' meaning ZoomInfo routes data through Claude for AI features.
// Security controls
Audit Logs
Available; 90-day retention for most systems, over 1 year for certain logs
trust.zoominfo.comPenetration Testing
Vulnerability testing on established schedule; 2025 SalesOS pentest report available in Trust Center
trust.zoominfo.comIncident Response
Incident Response Plan (IRP) and Data Breach Notification policy listed as controls
trust.zoominfo.comInfrastructure
Amazon Web Services (primary); Google LLC (cloud hosting and generative AI services); Auto Scaling and Data Redundancy listed; DoS protection available
trust.zoominfo.com// Products & data scope
Data it handles: Business contact data, company firmographics, technographics, intent signals; CRM enrichment
Core product; SOC 2 Type II report covers GTM platform including SalesOS. Pentest report specifically named 'SalesOS pentest 2025' available in Trust Center.
Data it handles: Customer account data, contact records, sales interaction data processed by AI; uses Anthropic (Claude) as subprocessor
AI-powered co-pilot for sales reps; leverages generative AI via Anthropic PBC. Data submitted through Copilot may be used for AI training unless opt-out is exercised.
Data it handles: Contact and company data for marketing segmentation, intent data, ad targeting
Marketing-focused module; same data governance as SalesOS. Buyer intent data sourced from ZoomInfo's contributory network.
Data it handles: Candidate contact data, employment history, skills data
Recruiting intelligence platform. Same certifications as overall platform apply.
Data it handles: CRM and marketing automation data enrichment at scale
Data enrichment and pipeline management. Integration with Salesforce, HubSpot, Marketo, Outreach, Salesloft, and others.
Data it handles: Sales and marketing workflow automation using ZoomInfo data signals
AI-guided workflow automation; part of the GTM platform offering.
// What to watch
- ZoomInfo's privacy policy permits using customer data to 'Fine-tune or train LLMs or other Artificial Intelligence models.' The License Terms and Conditions (Section 5.5-5.6) grant a perpetual right to use Submitted and Related data for product improvement. An in-platform opt-out exists but is not default-off.
- Anthropic PBC is listed as a subprocessor for 'Generative AI services,' meaning ZoomInfo routes customer interaction data through Claude APIs for AI features such as Copilot.
- The Trust Center lists 'Swiss-US Privacy Shield,' using older terminology. The Swiss-US Privacy Shield was superseded by the Swiss-US Data Privacy Framework in 2023-2024; this appears to be stale branding rather than reliance on an invalidated framework.
- No EU or regional data residency option is publicly documented. Data may be processed in the US or other countries where ZoomInfo or its subprocessors operate. EU customers rely on SCCs and the EU-US Data Privacy Framework for lawful transfer.
- ZoomInfo does not hold HIPAA certification. It is not suitable for handling covered PHI.
- ZoomInfo holds CSA STAR Level 1, a self-assessment, not CSA STAR Level 2, which requires a third-party audit.
- ZoomInfo Technologies LLC (zoominfo.com) is a separate company from Zoom Video Communications (zoom.com). Any Zoom.com certifications (SOC 2, ISO, etc.) do not apply to ZoomInfo.
// At a glance
Pricing model
Annual subscription; seat-based with tiered plans. Free trial available. Enterprise pricing negotiated directly. Global Data Passport available as an add-on for EU/international data access.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on ZoomInfo Technologies LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-29. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.zoominfo.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.