Zoominfo

Yes. Zoominfo's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Yes — Zoominfo undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Zoominfo's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Zoominfo publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Zoominfo publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Zoominfo is SOC 2 compliant and holds CSA STAR, ISO 27017, ISO 27001, ISO 27701, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Zoominfo hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@zoominfo.com or via a /security page (Zoominfo lists a security contact).

Zoominfo lists 28 subprocessors on its trust center, including SingleStore, Inc., Slack Technologies, LLC, The Trade Desk, Inc., Transloadit-II GmbH, Twilio Inc. (Sendgrid). Buyers use this for fourth-party risk review.

Zoominfo hosts on AWS. Data residency details are on its trust center.

Zoominfo's trust center is at https://trust.zoominfo.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Controller vs. Processor Under the GDPR, a “controller” means a person who “determines the purposes and means of the processing of personal data,” while a “processor” “processes personal data on behalf of the controller.” (GDPR Art. 4(7)-(8).) To the extent that ZoomInfo processes personal data within its proprietary database, ZoomInfo determines the means and purpose of such processing, and is therefore a controller. When those data are transmitted to one of ZoomInfo’s customers, we believe that the recipient also becomes a controller of those data because that customer is processing those data by its own means and for its own purposes. Because we are each independently controllers with respect to these data, to the extent we are processing them, ZoomInfo and its customer each have independent duties of a controller under the GDPR. ZoomInfo also acts as the processor of customer data that is provided to us in order to provide our products and services, such as customers’ employees’ personal data processed in order to access and use our database (e.g., name, email address, password) or the business contact information customers may transmit to ZoomInfo for purposes of matching, cleansing, or updating records with information from ZoomInfo’s database. In these situations, ZoomInfo acts as the processor of its customer data because it is processing the data on behalf of and at the direction of its customers.

We strive for 99.9% uptime on a monthly basis. Status can be tracked here.

Anthropic's announcement of Claude Mythos, and the broader emergence of frontier AI models capable of autonomously discovering and chaining software vulnerabilities, represents a pivotal evolution in the cyber threat landscape. ZoomInfo has been preparing for this, actively assessing how these new tools will change how we build and protect our systems, and converting those insights to actionable measures. ZoomInfo maintains a formal Vulnerability Management Program that governs the identification, prioritization, and remediation of CVEs across our environment. We leverage continuous scanning and threat intelligence feeds to ensure remediation velocity keeps pace with the abbreviated windows that AI-powered threat actors now operate within. We also maintain incident response and preparedness plans that account for advanced attack scenarios, including exploit chaining and AI-crafted social engineering, validated through periodic tabletop exercises and red team testing. Trust is foundational to everything we do at ZoomInfo. Protecting the data our customers entrust to us is not a compliance obligation, it is a core commitment. We will continue to invest in the people, processes, and technologies needed to stay ahead of an evolving threat landscape.