Zoominfo

Controller vs. Processor Under the GDPR, a “controller” means a person who “determines the purposes and means of the processing of personal data,” while a “processor” “processes personal data on behalf of the controller.” (GDPR Art. 4(7)-(8).) To the extent that ZoomInfo processes personal data within its proprietary database, ZoomInfo determines the means and purpose of such processing, and is therefore a controller. When those data are transmitted to one of ZoomInfo’s customers, we believe that the recipient also becomes a controller of those data because that customer is processing those data by its own means and for its own purposes. Because we are each independently controllers with respect to these data, to the extent we are processing them, ZoomInfo and its customer each have independent duties of a controller under the GDPR. ZoomInfo also acts as the processor of customer data that is provided to us in order to provide our products and services, such as customers’ employees’ personal data processed in order to access and use our database (e.g., name, email address, password) or the business contact information customers may transmit to ZoomInfo for purposes of matching, cleansing, or updating records with information from ZoomInfo’s database. In these situations, ZoomInfo acts as the processor of its customer data because it is processing the data on behalf of and at the direction of its customers.

We strive for 99.9% uptime on a monthly basis. Status can be tracked here.

Anthropic's announcement of Claude Mythos, and the broader emergence of frontier AI models capable of autonomously discovering and chaining software vulnerabilities, represents a pivotal evolution in the cyber threat landscape. ZoomInfo has been preparing for this, actively assessing how these new tools will change how we build and protect our systems, and converting those insights to actionable measures. ZoomInfo maintains a formal Vulnerability Management Program that governs the identification, prioritization, and remediation of CVEs across our environment. We leverage continuous scanning and threat intelligence feeds to ensure remediation velocity keeps pace with the abbreviated windows that AI-powered threat actors now operate within. We also maintain incident response and preparedness plans that account for advanced attack scenarios, including exploit chaining and AI-crafted social engineering, validated through periodic tabletop exercises and red team testing. Trust is foundational to everything we do at ZoomInfo. Protecting the data our customers entrust to us is not a compliance obligation, it is a core commitment. We will continue to invest in the people, processes, and technologies needed to stay ahead of an evolving threat landscape.