Zapier Integration Security Review
A Zapier Catch Hook URL accepts data from anyone, with only basic authentication as an option. We test that webhook, shared connections, account roles and Zap history for what each one exposes. CREST-certified testers, fixed price from £2,670 for a 2-day single-workspace scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Zapier’s own troubleshooting guide confirms its Catch Hook webhook trigger only supports basic authentication, so anything stronger has to be built into the Zap or a custom app instead.
A Zap is only as private as the connection, the role and the webhook behind it
Zapier’s Team and Enterprise accounts run on four account roles: Owner, the single highest-permission user who can transfer or delete the account; Super Admin, an Enterprise-only role with every Owner permission except that transfer; Admin, who administers users and billing without it; and Member, a general user with no administrative rights. Admins, Super Admins and Owners can all access app connections that are not even shared with them, while only Super Admins and Owners can view the account’s audit log, so the same word Admin covers a narrower set of permissions than it might suggest. Every Zap, Table and Interface also carries its own asset-level role of Owner, Editor or Viewer on top of the account role, and an Admin or Super Admin can still view, share or delete an asset that role was never given access to.
App connections are private by default, visible only to the person who created them, until they are shared with specific users, specific teams on an Enterprise account, or everyone in the account at once. Once shared, Zapier’s own documentation is clear about what a recipient can then do: view the data used to test a Zap, use the connection in their own workflows, and edit any step that uses it, all without ever seeing the underlying login. The one exception cuts the other way: if a Zap step still uses someone’s private connection, only that owner can edit the step, but everyone else with access to the Zap can still view whatever data has passed through it in the Zap history.
A Catch Hook trigger hands out a unique URL the moment you add it, and Zapier’s own troubleshooting guide confirms that if the sending service needs authentication at all, Webhooks by Zapier only supports basic authentication, so anything stronger means building a custom app on the Zapier Developer Platform instead. Everything that trigger and every action afterwards handles is kept in Zap history for 29 to 69 days by default, including the data each step received and sent, and only an Enterprise account can shorten that window. It is the same webhook and workspace-role question we test on n8n’s own instances, applied to a Zapier workspace instead.
SCOPE
What we review in a Zapier workspace
Account roles: Owner, Super Admin, Admin and Member
Zapier’s Team and Enterprise accounts have four account roles: Owner, the single highest-permission user who can transfer or delete the account; Super Admin, an Enterprise-only role carrying every Owner permission except that transfer; Admin, who handles lower-level administration such as billing and user management; and Member, a general user with no administrative privileges. Admins, Super Admins and Owners can all access app connections that are not shared with them, while viewing the account’s audit log is restricted to Super Admins and Owners alone. We test who holds each role, and whether an Admin’s practical reach matches what the role’s name suggests.
Asset roles: Owner, Editor and Viewer on every Zap, Table and Interface
On top of the account-level role, every Zap, Table and Interface carries its own asset role of Owner, Editor or Viewer, with Owner alone able to share, change ownership of, move or delete that asset. Account-level Admins and Super Admins sit above this again: they can view, share or delete an asset that was never shared with them and that they do not own, regardless of its own asset role settings. We test whether an asset’s Owner, Editor and Viewer assignments actually match the account-level roles that can override them.
Shared connections and what a recipient can do with them
An app connection is private by default, visible only to the person who created it, until it is shared with specific users, specific teams on an Enterprise account, or everyone in the account at once. Once shared, a recipient can view the data used to test the Zap, use the connection in their own workflows, and edit any step that uses it, all without ever seeing the underlying login credentials. We test every shared connection in scope against who actually still needs it, and what they can do with it beyond the workflow it was shared for.
Private connections inside a shared Zap
If a Zap step still uses its creator’s private connection rather than a shared one, only that owner can create or edit the step, and Zapier’s own documentation confirms everyone else with access to the Zap gets view-only permissions on it instead. That view-only access still includes whatever information has passed through the step in the Zap history, so a private connection stops others editing a step without stopping them reading its data. We test which steps in scope run on a private connection, and what that connection’s data is exposing to everyone else who can open the Zap.
Catch Hook and Catch Raw Hook webhook triggers
The Catch Hook trigger issues a unique URL that parses incoming GET, PUT or POST requests into individual fields, while Catch Raw Hook returns the request unparsed, up to 2MB, and includes the original headers; appending silent/ to either URL suppresses Zapier’s default 200 response for services that need an empty one. Zapier’s troubleshooting guide confirms that if the sending service needs authentication, Webhooks by Zapier only supports basic authentication, and anything more advanced has to be built as a custom Zapier Developer Platform app instead. We test which trigger and authentication combination is actually configured against what the receiving Zap does with the data.
Webhook rate limits and delayed processing
Webhooks by Zapier is rate-limited to 20,000 requests every 5 minutes per user, and to 1,000 requests every 5 minutes per Zap on legacy webhook routes that do not include a Zapier user ID in the URL, returning a 429 status once exceeded. During periods of high webhook activity Zapier may return a 200 status but delay processing by several minutes, and some receiving services need Zapier’s own outbound IP addresses allowlisted before they will accept its calls at all. We test which webhook routes and rate-limit behaviour a workflow in scope actually relies on.
Zap history retention and what a run actually stores
Zapier retains Zap history, including the specific data each step received and sent, for 29 to 69 days by default depending on your plan, and only an Enterprise account can customise that window down to as little as 7 days or up to 30. Deleting an individual Zap run only removes the record of it from Zap history; if the run had already completed an action, deleting the record does not undo that action. We test what a run’s stored details actually contain for the workflows in scope, and how long that data has been sitting there.
App access policies: restricted apps versus allowed apps
Enterprise accounts can run one of two app access policies: Restricted apps, the default open policy where every app is usable unless it is added to a block list, or Allowed apps, a closed policy where only apps on an explicit allow list can be used, with specific triggers or actions inside an allowed app still prohibited if needed. Either policy supports member and team exceptions, and an existing Zap using a newly prohibited app keeps running with only the affected step held rather than the whole Zap stopping. We test which policy is configured and whether its exceptions still match your intended app estate.
Workspaces and task limits inside an Enterprise organisation account
An Enterprise organisation account can hold multiple workspaces, each grouping its own Zap workflows under either no task limit, where usage moves to pay-per-task billing once the plan limit is reached, or a set task limit that holds every Zap in that workspace once it is hit; setting the limit to zero effectively disables the workspace. We test workspace boundaries and task limits the same way we test an n8n instance’s own project and role boundaries, since both decide what a single scope actually covers.
Single sign-on with SAML and what enabling it changes
Setting up SAML single sign-on requires domain verification and Admin, Super Admin or Owner access, supports both Zapier-initiated and IdP-initiated login plus Just-in-Time user provisioning, and can use Single Logout if your identity provider supports it. Enabling SAML login is immediate and account-wide: it forces every team member to authenticate through your identity provider from that point on and disables username-and-password sign-in entirely, so testing it against a live account needs coordinating in advance. We test SAML configuration, provisioning and Single Logout behaviour against what your identity provider is actually set up to enforce.
OUR PROCESS
Zapier Integration Security Review: From Scope to Attestation
Account, Workspace and Role Mapping
We map every account role, asset role, workspace and app access policy in scope, and which connections, Zaps and webhooks each one actually reaches.
Connection and Sharing Testing
We test shared and private connections, asset sharing and account-role overrides for gaps between who has access and who should.
Webhook and History Testing
We test Catch Hook and Catch Raw Hook authentication directly, review Zap history retention and stored payload data, and check SAML SSO configuration.
Reporting and Retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest after remediation and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Zapier pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Zapier Integration Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Zapier For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Zapier Integration Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Zapier workspace?
At least one login for every account role in scope, from Member up to Admin, Super Admin or Owner where we’re reviewing account-wide settings, app access policies or SAML SSO directly. Read access to Zap history and the connections list, not the connection credentials themselves, speeds up scoping but is not required to start.
Will testing touch live data?
We test read-only against your live workspace by default, and where a Zap writes, updates or deletes real records we agree a sandbox environment or specific test data with you first. Anything we create during testing to prove a finding is documented and removed afterwards.
Do you test our whole Enterprise account or just one workspace?
Our single-workspace scope covers one workspace and the Zaps, connections and webhooks inside it. Additional workspaces, or account-wide settings such as SAML SSO and app access policies, are scoped and quoted alongside it.
Does Zapier have a customer penetration-testing policy we need to follow?
Zapier publishes SOC 2 Type II and SOC 3 reports and its own penetration testing results through its Trust Center, but we confirm Zapier’s current terms of service and any notification requirement with you during scoping before testing starts.
What is out of scope?
Zapier’s own platform infrastructure, other accounts on shared Zapier infrastructure, and the third-party apps your connections authenticate to are all out of scope. We test your workspace’s Zaps, connections, webhooks, roles and account settings; a separate system on the other end of a connection is scoped and quoted as its own engagement.
How long does a Zapier security review take?
A single workspace with a handful of Zaps sits in our 2-day single-workspace scope, with more Zaps, connections, app access rules or a wider integration surface extending it. We confirm the exact day count once we’ve seen the workspace.
Do you need our Zap definitions or admin access?
No, testing is black-box by default against the role accounts you provide. Exported Zap history and step configuration speed up root-causing anything we find, and pair well with a separate source code review for any custom Developer Platform app in use.
Are your testers CREST certified?
Yes. Every Zapier engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Zapier workspace
A Zapier Catch Hook URL accepts data from anyone, with only basic authentication as an option. We test that webhook, shared connections, account roles and Zap history for what each one exposes. CREST-certified testers, fixed price from £2,670 for a 2-day single-workspace scope, quoted within 24 hours.
