CERTIFICATE OF REGISTRATION

Information Security Management System - ISO/IEC 27001:2013
The Certification Body of Schellman Compliance, LLC hereby certifies that the following organization operates an Information
Security Management System that conforms to the requirements of ISO/IEC 27001:2013

Zscaler, Inc.
for the following scope of registration
The scope of the ISO/IEC 27001:2013 certificate is limited to the information security management system (ISMS) supporting
the Zscaler global cloud in the EMEA (Europe, Middle East and Africa), NA (North America), LATAM (Latin America), and APAC
(Asia-Pacific) regions for its Security as a Service platform, including operations employees, and inclusive of ISO/IEC 27701:2019privacy information management system (PIMS) requirements, control implementation guidance, and additional control set
as personally identifiable information (PII) processor and aligned with ISO/IEC 27017:2015 and ISO/IEC 27018:2019, and inaccordance with the statement of applicability, version 7.3, dated December 19, 2023.
which includes the following in-scope location(s) on page 2 of 2

Certificate Number: 1710585-13

Authorized by:

Ryan Mackie

Principal, Schellman Compliance, LLC
4010 W Boy Scout Blvd., Suite 600
Tampa, Florida 33607, United States
www.schellman.com

Issue Date

Original Registration Date

Expiration Date

Certificate Version

May 20, 2024

June 26, 2014

October 31, 2025

Version 13

CONDITIONS & LIMITATIONS:

Page 1 of 2

1. The aforementioned organization has a perpetual responsibility to maintain compliance with ISO/IEC 27001:2013 during the period of certification.
2. This certificate is subject to the satisfactory completion of annual surveillance audits by Schellman Compliance, LLC
3. ISO/IEC 27001:2013 compliance audits are not designed to detect or prevent criminal activity or other acts that may result in an information security breach. As such, this certification should not beconstrued as a guarantee or assurance that an organization is unsusceptible to information security breaches.
4. The information in this document is provided “AS IS”, without warranties of any kind. Schellman Compliance, LLC expressly disclaims any representations and warranties, including, without limitation, theimplied warranties of merchantability and fitness for a particular purpose.
5. This certificate is the property of Schellman Compliance, LLC and is bound by the conditions of contract. The authenticity of this certificate can be validated by contacting Schellman Compliance, LLC
6. Certificates against the ISO/IEC 27001:2013 version of the standards will expire on October 31, 2025 if not transitioned to the ISO/IEC 27001:2022 version per the IAF MD 26 requirements. Once transitioned,
the certificate will revert to the original expiration date of June 23, 2026.

Certificate Number: 1710585-13

In-Scope Location(s)Location

Function / Role

120 Holger Way
San Jose, California 95134
United States

Corporate headquarters and main location of the ISMS

CONDITIONS & LIMITATIONS:

Page 2 of 2

1. The aforementioned organization has a perpetual responsibility to maintain compliance with ISO/IEC 27001:2013 during the period of certification.
2. This certificate is subject to the satisfactory completion of annual surveillance audits by Schellman Compliance, LLC
3. ISO/IEC 27001:2013 compliance audits are not designed to detect or prevent criminal activity or other acts that may result in an information security breach. As such, this certification should not be
construed as a guarantee or assurance that an organization is unsusceptible to information security breaches.
4. The information in this document is provided “AS IS”, without warranties of any kind. Schellman Compliance, LLC expressly disclaims any representations and warranties, including, without limitation, theimplied warranties of merchantability and fitness for a particular purpose.
5. This certificate is the property of Schellman Compliance, LLC and is bound by the conditions of contract. The authenticity of this certificate can be validated by contacting Schellman Compliance, LLC
6. Certificates against the ISO/IEC 27001:2013 version of the standards will expire on October 31, 2025 if not transitioned to the ISO/IEC 27001:2022 version per the IAF MD 26 requirements. Once transitioned,
the certificate will revert to the original expiration date of June 23, 2026.