Zapier AI safety profile

What it does with your data

Whether Zapier trains on your data depends on your plan, and Zapier’s own pages give two different answers. On Enterprise plans, Zapier automatically opts you out of having your customer content used for model training and improvement. On every other plan, Zapier’s legal page says you “may opt out at any time.” That means your content can be used for training unless you opt out.

Zapier’s security page describes something narrower. It says Zapier does not train on the data that runs through workflows on any plan. It may learn from how workflows are built, “the structure, not the contents.” Because the two pages disagree, plan around the broader reading.

Zapier also uses usage information, such as which apps and actions appear in a Zap, to run and improve its products. The pages checked describe no opt-out for this. Zapier’s subprocessors are not allowed to train their own models on your content.

By default, Zapier deletes Zap content and history on the first Monday of each month. Data stays in your account for 29 to 69 days.

Settings to change first

The vendor pages checked do not describe an in-product setting or menu path for training. You opt out by sending Zapier a form.

1. If you are not on Enterprise, submit Zapier’s opt-out form. The legal page and the security page link to two different form addresses, so ask Zapier which one is current and keep a record that you sent it. Opting out does not change how your workflows run.
2. Turn on two-factor authentication for every account. Every plan offers it.
3. If you are on a Company or Enterprise plan, replace the default retention with a custom period of 7 to 30 days.
4. If your plan includes model controls, choose which AI providers staff may use. You can also turn AI off until you have reviewed it.

Enterprise accounts are already opted out of training, so you do not need to send the form on that plan.

Free and paid tiers

The vendor pages checked do not describe a free plan on its own. They separate Enterprise from all other plans, and they name Company plans when discussing retention.

• Training: Enterprise is opted out automatically. All other plans must opt out with the form.
• Retention: Every account gets the default monthly deletion (29 to 69 days). Custom retention of 7 to 30 days is available only on Company or Enterprise plans. Enterprise can also cut Zap history to as few as 7 days.
• Sign-in and logs: 2FA is on every plan. SSO, SCIM provisioning and audit log streaming are Enterprise features.
• AI Guardrails: All Zapier accounts can use this feature. Data it processes, including personal details, is held for a time in Zapier’s logs under its normal retention practices. The page does not state how long.

Admin controls

Enterprise admins get the most control. That plan includes single sign-on via SAML, user provisioning via SCIM, domain capture, IP allowlisting, role-based access, app and action controls, and forms access controls. Audit logs show who did what and when, and Enterprise customers can stream those logs to outside tools.

Zapier also describes model controls, which let admins approve AI providers, bring their own model or turn AI off entirely. Other features it describes include workspaces, app allowlists and blocklists, and agent activity tracking. The pages do not say which plans include these, so confirm with Zapier before you rely on them.

For audits, Zapier holds SOC 2 (Type II) and SOC 3 reports, checked each year by an independent firm. The SOC 3 report is public. The SOC 2 (Type II) report requires an NDA.

Using it with donor and client data

If staff will build automations that touch donor or client records, Enterprise is the safest tier because it is opted out of training automatically. On any other plan, send the opt-out form before anyone connects a donor database or mailing list.

Whatever your tier, keep these out of Zaps and AI steps:

• donor names alongside gift amounts or giving history
• client case notes
• health details
• payment card or bank details

Your data sits on servers in the United States, and Zapier does not support storing it only in the EU. If you work with European supporters, check that the transfer terms in Zapier’s data processing agreement fit your obligations.

Get these answers in writing from Zapier:

• which opt-out form is current
• whether your content or only your workflow structure is used for training
• which plans include model controls

Questions people ask

Does Zapier train AI on our donor data?

It depends on your plan and on which Zapier page you read. Enterprise is opted out automatically, and other plans can be used for training until you submit the opt-out form. The security page says workflow contents are never used, but the legal page is broader.

How long does Zapier keep what runs through our Zaps?

By default, Zapier deletes Zap content and history on the first Monday of each month, so data stays for 29 to 69 days. Company and Enterprise plans can set a shorter period of 7 to 30 days.

Can we use our own AI provider instead of Zapier’s?

Yes. Zapier describes a Bring Your Own Model option, and admins can choose whether to fail closed or let Zapier’s models act as a fallback. The pages checked do not say which plans include it.