Skip to main content

Buyer guide

Zapier Admin & Data Controls Checklist

Most controls a security review asks for sit on the Enterprise plan. The checklist covers what each plan includes and how Zapier handles workflow data.

Reading time
3 min read
Sources
14 cited
In this piece
Zapier−4 Mixed

Buy Enterprise if your security review needs app access lists, managed connections, SCIM, or custom retention. On every plan, Zapier keeps Zap history for 29 to 69 days on AWS in the United States and says it does not train on workflow data.

When you need this

  • Security or IT reviews Zapier before more teams adopt it.
  • Teams connect personal accounts, or departing staff own connections to company systems.
  • AI steps or assistants will act on customer or employee data.

Evaluation criteria

  1. Identity

    Do people sign in through your identity provider, and are accounts provisioned automatically?

    Look forRequire two-factor authentication, available on every plan. Team adds SAML SSO. Enterprise adds SCIM provisioning and domain capture.

  2. App and action access

    Can you limit which apps, and which actions within an app, each team can use?

    Look forOn Enterprise, restrict triggers and actions per user or team through allowed-app lists. New Enterprise accounts default to allowed apps. Test restrictions from the assistant. One builder's read-only Google Calendar MCP server still created an event through the general code tool using the same OAuth token.

  3. Credentials

    Do company credentials stay with the company?

    Look forUse shared connections on Team. Enterprise adds managed connections and admin-only managed apps. Set allowed domains to block personal OAuth accounts.

  4. Retention and location

    Is the retention and data location acceptable for your data?

    Look forCheck Zap history retention of 29 to 69 days against your policy. Enterprise admins can shorten it to 7 to 30 days. Zapier stores data on AWS in the United States and encrypts it in transit and at rest. Agents and Zapier MCP have no retention setting. Zapier's retention policy keeps files uploaded to an agent until they are deleted from every agent. It keeps agent conversations and activity logs until the agent is deleted. It keeps MCP prompts, responses, and tool logs until the MCP server is deleted. Deleted content leaves backups within 4 months. A team testing an Agent on HR and IT documents went looking for this setting during its security review, so delete pilot agents and their files when the pilot ends.

  5. AI data use

    Will workflow data or workflow structure be used to improve Zapier's AI?

    Look forZapier states that no plan uses workflow data for training. It can learn from how workflows are built. Enterprise opts out automatically. Other plans use an opt-out form.

  6. AI providers and guardrails

    Which model providers can AI steps use, and what screens their output?

    Look forTo use only your own AI provider, ask Support to disable built-in models. Restrict provider apps and mark your provider as a managed app. AI Guardrails checks output for personal data (PII) and prompt injection and keeps none of the data it checks.

  7. Audit and monitoring

    Can IT see who changed what, in its own tools?

    Look forCheck audit retention. Team keeps 6 months and Enterprise 1 year. Enterprise also offers log streams to Datadog or Splunk, plus an observability API and analytics.

Questions to ask vendors

  1. Which of our Zaps carry personal data, and does Zap history retention match our policy?
  2. Is Zapier MCP on for our account? It is on by default for Enterprise, and turning it off goes through the account manager.
  3. Which apps should be managed apps, so only admins can connect them?
  4. Do we need the SOC 2 Type II report from the Trust Center, which requires an NDA?

Red flags

  • Company systems connected through personal OAuth accounts.
  • API keys pasted into code steps.
  • Assuming the Team plan includes app access controls or custom retention.
  • AI steps sending personal data to a provider no one approved.

Products in this piece

Sources

Official documentation
11
Public source
3
  1. Zapier pricingOfficial documentationzapier.com
  2. Zapier pricing reference (machine-readable)Official documentationzapier.com
  3. Zapier: Security & complianceOfficial documentationzapier.com
  4. Zapier Help: Customize data retention in ZapierOfficial documentationhelp.zapier.com
  5. Zapier: Data retention and deletionOfficial documentationzapier.com
  6. Zapier Help: Configure app access settings for your Enterprise accountOfficial documentationhelp.zapier.com
  7. Zapier Help: App access policies in ZapierOfficial documentationhelp.zapier.com
  8. Zapier Help: Admin controls for app connectionsOfficial documentationhelp.zapier.com
  9. Zapier Help: Restrict AI by Zapier to your own AI model providerOfficial documentationhelp.zapier.com
  10. Zapier Help: AI Guardrails by ZapierOfficial documentationhelp.zapier.com
  11. Zapier MCP docs: Usage and billingOfficial documentationdocs.zapier.com
  12. Reddit r/zapier: I added MCP server with read rights, my AI agent was still able to write (Jun 10, 2026)Public sourcereddit.com
  13. Reddit r/zapier: Is it safe to store internal company data in Zapier Agents? (Jun 6, 2025)Public sourcereddit.com
  14. Reddit r/zapier: I wanted to like Zapier (Sep 24, 2026)Public sourcereddit.com

Keep reading

  1. Buyer guideZapier Team Rollout PlaybookPut builders in one shared account with a named owner for each Zap. Then set a task budget and a review step for edits.
  2. Buyer guideZapier Task Spend Controls ChecklistZapier halts task spend at the plan limit, at 3x the plan with pay-per-task on, at Enterprise workspace limits, and by default at 75 tasks per AI step run.
  3. Buyer guideZapier AI Steps, Agents & MCP GuideAI by Zapier runs inside a Zap, and Zapier MCP lets assistants call app actions. Both bill from the task pool, and Agents join that pool as Zapier migrates them.
Read the research