Enterprise governance checklist

This checklist groups security and governance controls into three phases and helps you ensure the safety of your Zapier account. For each item, learn what it protects you from, who usually owns it, and where to configure it.

Available on plans:

Free

Professional

Team

Enterprise

How to use this checklist

The controls are grouped into three phases:

1. Phase 1: Controls to set up before anyone builds.
2. Phase 2: Controls to add alongside your Zapier team once your first team is building.
3. Phase 3: Controls to return to as more business units join your account.

Each control lists a suggested owner, who is the team or person at your company who usually handles it. It also lists the Zapier role needed to change the setting.

You can skip any recommendation that does not fit your organization. Some controls depend on your plan and rollout. If a control is not available in your account, contact Zapier support.

Note

This checklist is general guidance, not a compliance guarantee.

Phase 1: before anyone builds

These controls protect you from the risks that are harder to fix after the account is in use.

Identity

Verify your domain, enforce SSO, and provision users with SCIM. Single sign-on (SSO) lets people sign in to Zapier with your identity provider, the system that manages employee logins. System for Cross-domain Identity Management (SCIM) automatically creates and manages user accounts from your identity provider.

• Protects you from: Zap workflows that keep running under the login of someone who has left your company. With SCIM, removing a person from your identity provider deactivates their Zapier account, transfers their shared Zap workflows, app connections, and folders to the account owner, and pauses their unshared Zap workflows.
• Suggested owner: IT admin.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Admin Center.
• Learn more:
  • Verify ownership of your domain in Zapier
  • Set up single sign-on with SAML
  • Provision user accounts with SCIM

Log streaming

You can send Zapier audit logs to your company's SIEM. A security information and event management (SIEM) system is the software your security team uses to collect and monitor security events.

• Protects you from: Not being able to tell who changed what in your account, months after the fact. Log streaming sends a copy of your audit activity to your own system, so you keep a record that outlasts what Zapier keeps (12 months). Capture starts when you turn it on and does not include earlier activity, so set it up early.
• Suggested owner: Information Security team.
• Zapier role needed: Super admin or owner.
• Where to go: Log streams in the Admin Center.
• Learn more: Set up log streams to monitor Zap activity.

Allowed apps

New Enterprise accounts start with an empty allowed apps list, so add the apps your team needs first. All other apps are blocked by default, but you can add or remove apps at any time.

Note

If your account was upgraded from another plan, it may still use restricted apps.

• Protects you from: Customer data reaching AI tools or other apps your company has not approved, such as customer call notes sent to an unapproved AI tool. With an allowed list, people can connect only the apps you have approved.
• Suggested owner: IT admin and Information Security team.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Allowed apps in the Admin Center.
• Learn more:
  • Configure app access settings for your Enterprise account
  • App access policies in Zapier

Allowed domains

Limit app connections to accounts on your company's email domains. Allowed domains apply to OAuth connections for supported apps, such as Gmail, Microsoft Outlook, Salesforce, and Slack.

• Protects you from: Company data flowing into personal accounts, such as a personal Gmail account connected to a Zap workflow that copies leads out of your CRM. With allowed domains on, supported apps connect only with accounts on your approved domains.
• Suggested owner: IT admin.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Allowed domains in the Admin Center.
• Learn more: Allowed domains for app connections.

Workspaces

Create a workspace for each sensitive business unit, such as Finance, Legal, and HR.

Note

Workspaces are only available with certain Enterprise plans. If your account does not include workspaces, upgrade your plan.

• Protects you from: Finance, Legal, and HR sharing data, apps, connections, and admins with other teams. A workspace is a separate area of your account with its own members and settings. Creating one for each sensitive team up front gives them a secure place to work.
• Suggested owner: IT admin.
• Zapier role needed: Super admin or owner.
• Where to go: Admin Center.
• Learn more:
  • Create workspaces in your organization
  • Manage your workspaces

Phase 2: once your first team is building

Add these controls as builders start creating Zap workflows.

Managed AI apps

Mark the AI apps your team uses as managed, so only admins can create, share, and delete connections for them.

• Protects you from: Connections that no one can review or control, such as each builder connecting an AI tool with a personal login or API key. With a managed app, an admin creates the connection once and shares it with your account.
• Suggested owner: IT admin.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Managed apps in the Admin Center.
• Learn more: Restrict app connections with managed apps.

Read-only service accounts

Create a read-only account login in the source app, such as a Salesforce user without delete permissions. Then add it to Zapier as a managed connection and share it with your team.

• Protects you from: Accidental deletion or editing of existing information. With a shared read-only connection, people can use the information in an app without being able to change it, and builders do not each need a separate login.
• Suggested owner: IT admin.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: App Connections page.
• Learn more:
  • Share company credentials with managed connections
  • Admin controls for app connections

Action restrictions

Block risky actions, such as deleting or sending email, without preventing searching, drafting, or other actions.

• Protects you from: Zap workflows that take unintended actions, such as a workflow meant to draft emails that sends them instead. With action restrictions, members can still connect the app, but you choose which triggers and actions they can use. For example, you can restrict a send email action and allow a create draft action.
• Suggested owner: IT admin and Information Security team.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Allowed apps in the Admin Center.
• Learn more: Configure app access settings for your Enterprise account.

Usage alerts

Set a threshold for tasks per hour. When usage exceeds it, Zapier emails all admins, super admins, and the account owner, and sends them an in-app notification.

• Protects you from: Runaway task usage, such as a Zap workflow stuck in a loop that runs 40,000 times over a weekend. A usage alert tells you when usage passes your threshold, so you can investigate and prevent the issue from continuing.
• Suggested owner: IT admin and budget owner.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: Usage alerts in the Admin Center.
• Learn more: Set up usage alerts in your Enterprise account.

AI Guardrails by Zapier

Add an AI Guardrails step to your Zap workflows and agents to check text for prompt injection, personal data, and toxic content. Place it before an AI step to check what goes in, or after it to check what comes out.

• Protects you from: AI acting on harmful or sensitive text, such as a customer email that tells your AI to ignore its instructions, or a form that passes along someone's personal details. The AI Guardrails step checks the text first, so you can stop it, reroute it, or send it to someone for review.
• Suggested owner: Builders and Information Security team.
• Zapier role needed: Any role.
• Where to go: Find AI Guardrails by Zapier.
• Learn more:
  • How to get started with AI Guardrails by Zapier

Phase 3: as more business units join

Return to these controls as more business units start using Zapier.

Workspace admins

Name an admin in each sensitive business unit.

Note

Workspaces are only available with certain Enterprise plans. If your account does not include workspaces, upgrade your plan.

• Protects you from: A central admin deciding what counts as sensitive for every business unit. Each workspace gets its own admin who approves apps, connections, and members for their team. The controls you set in phase 1 stay in place.
• Suggested owner: Each business unit.
• Zapier role needed: Super admin or owner.
• Learn more:
  • Roles and permissions in organizations and workspaces
  • Manage your workspaces

Approved AI model provider

Connect your own AI model provider to route AI requests from Zapier Agents and Knowledge by Zapier through your approved cloud provider account. AWS Bedrock is currently the supported provider, so you need an AWS account with access to Amazon Bedrock.

This setting does not apply to AI by Zapier. In AI by Zapier steps, each builder can select the Bring Your Own Key model tier and connect their own AI provider account.

• Protects you from: AI requests running on infrastructure that your security team has not approved. After you connect your provider, AI inference from supported products routes through your cloud provider instead of Zapier's built-in models.
• Suggested owner: IT admin.
• Zapier role needed: Admin, super admin, or owner.
• Where to go: AI model configuration in the Admin Center.
• Learn more: Set up your own AI accounts in Zapier.

Next steps

• Review the full set of admin features in Set up admin tools for your Enterprise account.
• Contact Zapier support if you need help.