Security is a top priority for Zip, and we believe that working with skilled security researchers can identify weaknesses in any technology. If you believe you have found a security vulnerability on Zip, please review our vulnerability disclosure program details below. While we currently do not issue bounty rewards, we will investigate all reports and do our best to quickly fix issues.

The Zip solution is a B2B platform designed to simplify the B2B procurement process for your organization. As a result the Zip solution, by its nature, only requires simple user information such as names and business contact information to manage purchasing decisions. Beyond that, customers are in control of the data that they choose to submit to the Zip solution as part of their workflows, approval requests and purchasing decisions. Customers can update, amend and delete data from the solution at any time - you are in control.

Zip performs thorough due diligence on all service providers that support the delivery of our products and services. When we engage a subprocessor we ensure our contract with the subprocessor contains, in substance, at least the same level of data protection and information security protections as provided to you by Zip, so your data is always protected. You can find a list of our subprocessors here.

ZipHQ, Inc. (“Zip”) takes data privacy seriously and respects your privacy rights. Zip participates in the EU-U.S, Swiss-U.S. Data Privacy Frameworks, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the “DPF”) issued by the U.S. Department of Commerce. ZipHQ, Inc. is now able to rely on the adequacy decision to receive EU personal data. Zip’s transfer to the United States falls under adequacy status under the European data protection law. In the event such adequacy status no longer applies, Zip shall continue to rely on the Standard Contractual Clauses (SCCs) as a transfer mechanism, see contractual measures below for more details.
‍
Where a customer’s use of the Zip solution requires the transfer of personal information outside the European Economic Area or the United Kingdom to a third country, Zip uses the Standard Contractual Clauses (also commonly referred to as EU Model Clauses) and UK International Data Transfer Addendum as legally recognized data transfer mechanisms.

If Zip receives a request from a government or law enforcement entity to disclose customer data, we will respond in accordance with our Government Data Request Policy.  We will also publish transparency reports for any such government or law enforcement requests we receive.
Latest Transparency Report: To date, Zip has not received a request from a governmental entity.

Link to Zip’s Privacy documentation.

As standard the Zip MSA includes our Data Processing Agreement and comprehensive Information Security Policy designed to keep your data secure and comply with data protection laws.