{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"zuora","name":"Zuora","domain":"zuora.com","category":"Payments","one_liner":"Zuora is the leading Quote to Cash and subscription management platform, unifying billing, payments, revenue, and AR to scale your modern","trust_center_url":null,"security_page_url":null,"url":"https://certreports.com/vendors/zuora/security","last_verified_at":"2026-09-17T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"pci-dss","framework_name":"PCI DSS","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Visa Global Registry of Service Providers as of 17 Sep 2026.","kind":"attestation","status_text":"Listed on the Visa Global Registry as PCI DSS validated through 2027-08-31","issued_at":"2009-09-25","expires_at":"2027-08-31","period_start":null,"period_end":null,"auditor":"Schellman Compliance, LLC.","impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"visa_grsp","url":"https://certreports.com/vendors/zuora/pci-dss","evidence":[{"source_type":"registry","source_name":"Visa Global Registry of Service Providers","url":"https://www.visa.com/splisting/","fetched_at":"2026-09-17 15:59:56.641985+00","content_hash":"b64fb2fad3d4122e8fbeb43000a6c5d4f09ae732c30b518c32920b5a82270f9d","wayback_url":null,"quote":"Zuora, Inc.: PCI DSS, assessor Schellman Compliance, LLC., valid through 2027-08-31","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"expired","state_label":"Expired","sentence":"Certificate expiry unknown date passed; no renewal found as of 17 Sep 2026.","kind":"listing","status_text":"Inactive","issued_at":"2016-10-20","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/zuora/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6432","fetched_at":"2026-09-17 15:49:35.027226+00","content_hash":"1c60d83db2ccf39bb0deafe081d7f6b93a40437d0dd7aa420ed34b7a368c4365","wayback_url":null,"quote":"Zuora, Inc.: Inactive","confidence":1}]}],"brief":{"summary":"Zuora is listed in the Visa Global Registry as PCI DSS validated through 31 Aug 2027, as of 17 Sep 2026. The Visa Global Registry shows Zuora's PCI DSS validation was originally issued on 25 Sep 2009, with Schellman Compliance, LLC. named as the assessor, as of 17 Sep 2026. Zuora's EU-US Data Privacy Framework certification is listed as inactive in the registry as of 17 Sep 2026. The Data Privacy Framework registry shows the certification was originally issued on 20 Oct 2016, as of 17 Sep 2026. No public evidence was found for SOC 2 or ISO/IEC 27001 as of 17 Sep 2026.","bullets":["Listed in Visa Global Registry as PCI DSS validated through 31 Aug 2027; assessor Schellman Compliance, LLC.","EU-US Data Privacy Framework certification listed as inactive (expired), originally issued 20 Oct 2016.","No public evidence found for SOC 2 or ISO/IEC 27001."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 12:39:27.970458+00"},"legal_docs":[],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-20T01:14:34.140Z"}