ZoomInfo states it hosts “in the U.S.” on AWS and Google Cloud, naming no region, yet its own Privacy Policy admits transferring data to “any other country,” while Apollo makes the same US claim without naming a region either and carries its own separate certifications, ISO/IEC 27001, SOC 2 Type II, and CASA Tier 2. Neither publishes FedRAMP, StateRAMP, GovCloud, or a HIPAA business associate agreement. Scope compared, criterion by criterion. Checked 7 September 2026.





ZoomInfo states it hosts “in the U.S.” across AWS and Google Cloud, naming no specific region for either, yet its own Privacy Policy admits transferring data to “any other country.” Its own certifications stop at SOC 2 Type II and ISO 27001, 27701, and 27017 — FedRAMP, StateRAMP, TX-RAMP, GovCloud, and a HIPAA business associate agreement are all absent.
Apollo also hosts in the US without naming a region, across AWS, Google Cloud, Databricks, Snowflake, and OpenAI. Its own certifications add ISO/IEC 27001, SOC 2 Type II audited by A-LIGN, and CASA Tier 2 — a Google-specific security assessment — though FedRAMP, StateRAMP, GovCloud, and a HIPAA business associate agreement are just as absent from its pages as from ZoomInfo’s.
ZoomInfo’s License terms put the sales and use tax burden on the customer, who must indemnify ZoomInfo, with an exemption available only through a certificate emailed to ar@zoominfo.com. Apollo’s own terms, at section 4(c)(iv), do the same, excepting only taxes on Apollo’s own net income — and neither company publishes a tax policy page, a list of states, or a per-state calculation.
ZoomInfo accepts card, ACH, wire transfer, check, and purchase orders through Bill.com, Ariba, or Coupa, with a W-9 available as a PDF and net-30 terms by default. Apollo bills net-30 in US dollars too, at the same one and a half percent monthly late interest, but restricts ACH to its Organization or Custom plans on request, and names no purchase order or W-9 path at all.
Neither ZoomInfo’s admission that data can move to “any other country” nor Apollo’s unnamed US region tells a buyer which country or region their own account’s data actually sits in. Both stop at the same kind of certification — SOC 2 Type II plus an ISO standard or two — and neither one extends that badge to FedRAMP, StateRAMP, or a signed HIPAA agreement.
Can't find what you're looking for ? Contact us here
jordan@bulldozer-collective.comGet access to playbooks and feedback from those who are shaping the next wave of marketing and AI.