Is it safe to put client data through Zapier?

Once a firm has a few Zaps running, someone eventually asks the uncomfortable question: client names, emails, invoices and sometimes documents are passing through Zapier every day. Is that safe, and is it allowed?

The short answer: for ordinary business data, Zapier is a well-run platform with independent security audits, encryption and admin controls, and many firms use it responsibly. The real risks are less about Zapier being hacked and more about what you send through it, how long copies sit in its logs, whose login each connection uses, and whether your data protection obligations allow storage in the United States. Those are decisions you control. This article walks through them; it is not legal advice, so check the final position with your lawyer or compliance lead.

What Zapier says about its own security

Zapier's security and compliance page states, as of October 2026:

• Audits: Zapier is SOC 2 Type II and SOC 3 certified, audited annually by an independent firm. The SOC 3 report is public; the SOC 2 Type II report is available under an NDA.
• Encryption: data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Hosting: data is stored on Amazon Web Services in the United States. Zapier does not list any other region.
• Contract terms: a data processing agreement (DPA) with Standard Contractual Clauses for international transfers is part of its terms.
• AI training: the same page says Zapier does not train on the data that runs through your workflows, that Enterprise accounts are opted out automatically, and that other plans can opt out with a form.
• Admin controls: administrators can allow or block apps and restrict who can use them; SSO (SAML) and SCIM provisioning come with Enterprise.

A SOC 2 report tells you a vendor's controls were tested by an auditor. It does not tell you whether a particular workflow is appropriate for a particular kind of data. That part is still your call.

Where the real risk sits

1. Copies of your data in Zap history

Every time a Zap runs, Zapier keeps a record of the data that passed through each step so you can troubleshoot. According to Zapier's help article on data retention, Zap history is kept for 29 to 69 days by default, and only Enterprise accounts can shorten it (to between 7 and 30 days). Zapier's data retention and deletion page also describes separate retention for logs and backups.

In practice, this means a Zap that moves a client's intake form into your CRM leaves a readable copy of that form in Zapier for weeks. Anyone in your Zapier account with access to that Zap can open it. Ask yourself whether you would be comfortable with that copy existing if a client asked where their data is held.

2. Personal logins on firm connections

When a staff member connects Gmail, Outlook or your CRM to Zapier, the connection runs with their permissions. If that person has access to every client folder, so does the Zap. If they leave and their account is closed, the Zap stops, often silently. We cover this failure in more detail in why Zapier automations break. The safer pattern is a firm-owned account for each connection, with only the permissions the workflow needs.

3. Sending more than the workflow needs

Most triggers hand over the whole record: every field on the form, every attachment on the email. If the next step only needs a name and an email address, map only those fields. A Zap that forwards a full email body, with whatever the client wrote in it, carries far more risk than one that copies three fields.

4. Shadow Zaps

On Free, Pro and Team plans, individuals can build Zaps on their own. Firms are regularly surprised by what they find when they list every active Zap: personal accounts moving client files, test Zaps left running, connections to apps nobody approved.

Data residency: Switzerland and Singapore

Because Zapier stores data in the United States, the question for firms outside the US is whether that transfer is permitted and on what basis. The rules differ by country.

Switzerland. The Swiss Federal Council added the United States to its list of countries with adequate data protection from 15 September 2024, but only for recipients certified under the Swiss-US Data Privacy Framework. Zapier's data privacy overview says it has certified under the EU-US framework, its UK extension and the Swiss-US framework. That is the starting point, not the whole answer: professional secrecy rules for lawyers, fiduciaries and medical providers, client contracts and sector guidance may set stricter expectations than the general data protection law. A fiduciary or law firm in Geneva or Zurich should get a clear position from its own lawyer before sending client files through any US-hosted tool.

Singapore. Under section 26 of the PDPA, an organization transferring personal data outside Singapore must make sure the recipient protects it to a comparable standard, for example through contractual terms. The PDPC's advisory guidelines on the Transfer Limitation Obligation explain the mechanisms, and they make clear the organization stays responsible even when a service provider does the transferring. In practice, Singapore firms usually rely on the vendor's DPA and contractual clauses; confirm with your data protection officer that these meet your obligations.

EU and UK. The same framework certifications and Standard Contractual Clauses apply. Most EU firms treat Zapier like any other US SaaS processor: list it in your records of processing, keep the DPA on file and mention it in your privacy notice where relevant.

US healthcare. If you handle protected health information, the answer is different and simpler: Zapier does not sign a Business Associate Agreement. See Is Zapier or Make HIPAA compliant?

If US hosting is a dealbreaker, Make runs separate European and US zones and your organization lives in one of them, and self-hosted n8n keeps data on a server you control. Both shift the trade-offs rather than remove them: you still need a DPA, and self-hosting makes security your own job.

A practical checklist before client data goes through Zapier

1. Classify the data. Contact details and invoice numbers are one thing; identity documents, health information, case files and bank details are another. Keep the sensitive categories out unless you have a clear basis and a reason.
2. List every active Zap and the account each one runs under. Turn off anything nobody owns.
3. Map the minimum fields. Remove full email bodies and attachments from steps that do not need them.
4. Move connections to firm-owned accounts with the narrowest permissions that work.
5. Restrict apps in the admin settings so new Zaps cannot connect tools you have not approved.
6. Check retention. If default Zap history is too long for your data, either keep that data out of Zapier or consider an Enterprise plan where retention can be shortened.
7. File the paperwork. Download the DPA, note the transfer basis, add Zapier to your processor list and update your privacy notice if needed.
8. Opt out of AI-related use if you are not on Enterprise and your policy requires it.
9. Review quarterly. Forms gain fields and Zaps gain steps; a workflow that was harmless in March may carry sensitive data by June.

When to use something other than Zapier

Zapier is a reasonable choice for most internal admin: routing enquiries, creating tasks, syncing contacts, posting notifications. Consider a different route when:

• The data is regulated in a way that needs a specific contract Zapier does not offer, such as a BAA.
• Your clients, regulator or professional body require data to stay in a specific country.
• The workflow moves documents rather than a few fields. A native integration between your document system and practice management tool often avoids an intermediate copy altogether.

How Flow Mesh helps

Our stack audit lists every tool and automation in your firm, including the Zaps nobody remembers building, shows which ones carry client data and under whose login, and gives each tool a verdict: keep, configure, consolidate or replace, with a written scope. Any follow-up work is quoted in writing after the audit and done inside your own accounts, under an NDA signed at the start; a DPA is available on request. See how this applies to law firms.

Key takeaways

• Zapier publishes SOC 2 Type II and SOC 3 reports, encrypts data in transit and at rest, and stores data on AWS in the United States.
• The bigger risks are copies in Zap history (29 to 69 days by default), personal logins on firm connections and sending more fields than a workflow needs.
• Swiss transfers rely on Zapier's Swiss-US Data Privacy Framework certification; Singapore firms remain responsible for overseas transfers under the PDPA. Confirm your position with your lawyer.
• Zapier does not sign a BAA, so keep US patient health information out.
• List every Zap, move connections to firm-owned accounts and review the list every quarter.