Effective September 2021
ZSCALER
CODE OF CONDUCTIntroduction
At Zscaler (the “Company”), we believe that how we conduct ourselves is just as important as what we
do. We are committed to maintaining the highest standards of business ethics. This Code of Conduct (the“Code”) sets out our principles of behavior and doing business for all of our directors, officers,
employees, consultants, independent contractors, and other agents (collectively, “Representatives”). We
require all Representatives to read, understand, and follow this Code when performing services for or on
behalf of Zscaler. We expect all Representatives to personally uphold the rules and standards in this Codeand to ensure that anyone doing business on behalf of Zscaler is aware of, understands, and adheres to therules and standards in this Code.
While this Code and other Company policies address complex legal matters and provide detailed
procedures, you should keep the following 10 basic ethical principles in mind at all times.
We always act ethically and legally
We follow our own policies
We deal fairly with others
We create a place where people want to work
We respect others and value differences
We promote security and respect privacy
We protect our own IP and respect the IP of others
We keep sensitive information confidential
We keep accurate records
We work with partners and vendors who share our principles
If you feel that Zscaler or any Representative has failed to uphold these principles or has violated thestandards of this Code, you are obligated to notify your manager, the People and Culture Department
and/or the Legal Department.
You should report violations, because failure to report a known violation of this Code may itself be
considered a violation which may result in disciplinary action. You have a right to report violations of this1Effective September 2021
Code without fear of retaliation. Zscaler will not take any adverse action for making a good faith report ofa possible violation, or participating or assisting in good faith in the investigation of an alleged violationof this Code. If you feel that you have been the subject of retaliation for reporting a violation under thisCode or participating in an investigation, please immediately report the retaliation to your manager, thePeople and Culture Department and/or the Legal Department. You may also report the retaliation under
the Company’s Whistleblower Policy.
Compliance Areas for All Representatives

1.

Honest and Ethical Conduct. Zscaler promotes high standards of integrity by conducting ouraffairs in an honest and ethical manner. The affairs and reputation of the Company depend on
your honesty, fairness, and integrity. Unyielding personal integrity is the foundation of strong
corporate ethics.

2.

General Legal Compliance. Obeying applicable laws and regulations, both in letter and in spirit,
is a key element of this Code. Our success depends upon each Representative operating within
legal guidelines and cooperating with local, national, and international authorities. We expect you
to understand and comply with the legal and regulatory requirements applicable to your areas of
responsibility. You must comply with all applicable laws and regulations in the countries where
you perform company-related services or business.

3.

Dealing Fairly with Others. Zscaler’s reputation and success is based on strong relationships
with our customers, resellers, partners, regulators, suppliers, and others. To maintain these strong
relationships, we treat everyone in the manner that we would expect to be treated: with fairness,honesty, dignity and respect.

4.

Workplace Principles. Zscaler strives to foster a supportive workplace by adhering to thefollowing workplace principles:•

Zscaler respects, values and welcomes diversity in its workforce, customers, suppliers, andothers.

•Harassment or discrimination based on race, color, ethnicity, sex (including pregnancy,
childbirth, breastfeeding, or related medical conditions), gender (including gender identityand gender expression), religion (including religious dress and grooming practices), creed,marital status, age, national origin, ancestry, citizenship, physical or mental disability,
military and veteran status, genetic information, medical condition (including cancer andgenetic characteristics), sexual orientation, or any other protected class, characteristic, or
consideration made unlawful under applicable federal, state, or local laws, is illegal andprohibited.

•

Zscaler is committed to providing a workplace free of harassment and believes in respecting
the dignity of every employee. In turn, the Company expects every employee to show respect
for all of our colleagues, clients, customers, and vendors.

•

Threats or acts of violence against colleagues, customers, vendors or others are prohibited.
2

Effective September 2021•

5.

Zscaler has a no-tolerance policy for unlawful harassment or discrimination. No employee,
contractor, customer, vendor, or other person who does business with this organization (each,a “Person”) is exempt from the prohibitions within this policy, and inappropriate conduct byor toward any Person will not be tolerated.

Conflicts of Interest. You must avoid conflicts of interest with respect to your performance ofservices for Zscaler. A conflict of interest occurs when your personal interests or activities (orthose of a person having a close personal relationship with you might influence your ability to act
in Zscaler’s best interests. The following are examples of situations that create an actual or
potential conflict of interest:•

Revealing confidential information to outsiders or misusing confidential information.

•

Accepting or offering gifts, excessive entertainment, favors, or payments that may be deemed
to constitute undue influence or otherwise be improper or embarrassing to Zscaler.

•

Participating in civic or professional organizations in a manner that might involve divulging
confidential information of Zscaler.

•

Initiating or approving personnel actions affecting reward or punishment of employees orapplicants where there is a family relationship or is or appears to be a personal or social
involvement.

•

Initiating or approving any form of personal or social harassment of employees.

•

Investing or holding outside directorship in suppliers, customers, or competing companies,
including financial speculations, where such investment or directorship might influence in any
manner a decision or course of action of Zscaler.

•

Borrowing from or lending to employees, customers, or suppliers.

•

Acquiring real estate of interest to Zscaler.

•

Improperly using or disclosing to Zscaler any proprietary information or trade secrets of any
former employer or other person or entity with whom obligations of confidentiality exist.

•

Unlawfully discussing Zscaler prices, costs, customers, sales, or markets with competingcompanies or their employees.

•

Making any unlawful agreement with distributors, resellers, partners, competitors, or any
other third party with respect to prices or market share.

•

Improperly using or authorizing the use of any inventions that are the subject of patent claimsof any other person or entity.

•

Engaging in any conduct that is not in the best interest of Zscaler.
3

Effective September 2021
Employees are required to obtain prior written approval from both the Chief Financial Officer andChief Legal Officer (or, in the case of either the Chief Financial Officer or the Chief Legal
Officer, prior written approval from the Board) prior to serving on the board of directors of any
for-profit entity. In no circumstances will an employee be permitted to serve as a director of acompetitor of the Company.
Employees are encouraged to serve as a director, trustee or officer of non-profit organizations intheir individual capacity and on their own time, but they must obtain prior approval from both theChief Financial Officer and Chief Legal Officer to do so as a representative of the Company or
any of its direct or indirect subsidiaries.
We expect our Representatives to be free from influences that conflict with the best interests ofZscaler. Even the appearance of a conflict of interest where none actually exists can be damaging
and must be avoided.
If you become aware of a possible or actual conflict of interest, disclose it immediately to yourmanager, the People and Culture Department, and/or the Legal Department (making a full reportof all pertinent facts and circumstances). The People and Culture Department and the Legal
Department will determine whether a conflict of interest exists and what, if anything, needs to bedone to resolve the issue.

6.

Anti-Corruption Compliance. Zscaler is strongly committed to complying with all applicableanti-corruption, anti-bribery, and anti-kickback laws. You must never offer or accept bribes or
kickbacks, and must not participate in or facilitate corrupt activities of any kind. Further, youmust never engage a third party who you believe may attempt to offer a bribe on behalf of
Zscaler. More information is available in Zscaler’s Anti-Bribery Policy.

7.

Export. Worldwide laws restrict the physical shipment of equipment and the transfer orelectronic transmission of software and/or technology to certain destinations, entities, andpersons. In many cases, laws require an import and/or export license or other appropriate
government approvals before an item may be shipped or electronically transmitted. Zscaler has a
responsibility to comply with all applicable import and export laws including, but not limited to,
U.S. Export Administration Regulations.

8.

Maintenance of Corporate Books and Records. Zscaler is committed to maintaining accurate
books, records, and accounts in relation to its business. Zscaler expects Representatives tomaintain (i) accurate and honest corporate, business, and accounting records in reasonable detail,and (ii) adequate accounting controls that prevent unauthorized activities or expenses. Zscaler
prohibits Representatives from using off-the-books accounts or other slush funds in relation to theCompany’s business and from disbursing any corporate funds or other corporate property without
adequate supporting documentation and authorization. You are also responsible for the timely
notification to senior management of financial and non-financial information that may be material
to the Company to ensure full, fair, accurate, timely and understandable disclosure in reports anddocuments that the Company files with government agencies or releases to the general public.
4

Effective September 2021
The making of false or misleading records or documentation is strictly prohibited. Records
should be retained or destroyed only in accordance with the Company’s document retention
policies.

9.

Protection and Proper Use of Company Assets. You are expected to protect Zscaler’s assets
and ensure their proper use. Theft, carelessness, and waste have a direct impact on Zscaler’s
finances. Company property, such as office supplies, computer equipment, buildings, products,
rental or other equipment, and intellectual property must only be used for legitimate businesspurposes. You may not use Zscaler’s name, any brand name or trademark owned or associatedwith Zscaler, or any Zscaler letterhead stationery for any personal or other purpose, unless such
purpose is approved in advance by Zscaler in writing.

10.

Corporate Opportunities. Except as otherwise set forth in the Company’s certificate ofincorporation and bylaws, employees owe a duty to the Company to advance the Company’sbusiness interests when the opportunity to do so arises. Employees are prohibited from taking or
directing to a third party to take, a business opportunity that is discovered through the use of
corporate property, information or position, unless the Company has already been offered theopportunity and turned it down. Employees are further prohibited from competing with theCompany directly or indirectly during their employment with the Company and as otherwise
provided in any written agreement with the Company.

11.

Confidentiality. As a Zscaler Representative, you may learn of and must keep strictly
confidential any information about Zscaler or its employees, customers, vendors, or partners thatis non-public, confidential or proprietary. This includes business, marketing and service plans,
financial information, ideas, databases, software code, product plans, customer lists, pricing
strategies, personnel data, and similar types of information. More information is available in the
Confidential Information and Invention Assignment Agreement or employment agreement
between you and Zscaler.

12.

Privacy. Many countries have privacy laws that set requirements for the appropriate handling of
personal data (essentially any information from which a person can be identified). Each Zscaler
employee has a responsibility to comply with Zscaler’s privacy and information security
requirements when personal data is collected, stored, processed, transmitted and shared. Moreinformation is available in Zscaler’s Privacy Policy.

13.

Media/Public Discussions. It is Zscaler’s policy to disclose material information concerning
Zscaler to the public only through specific limited channels to ensure that all those with aninterest in Zscaler will have equal access to information. All inquiries or calls from the press or
financial analysts regarding Zscaler must be referred to Zscaler’s Chief Marketing Officer.

14.

Insider Trading. All Zscaler Representatives are subject to Zscaler’s Insider Trading Policy,
which explains our ethical obligation to protect and properly use “material non-public
information.” As a Zscaler Representative, you may acquire important information regarding5

Effective September 2021
Zscaler or other public companies, which could affect the market price of a security and has notbeen made public. You are obligated (a) to keep this “material non-public information”
confidential, (b) not to trade on the basis of this material non-public information, and (c) not togive trading advice concerning Zscaler or other public companies when you are aware of material
non-public information. Our Insider Trading Policy provides more information on theseobligations and other restrictions on securities trading. The rules relating to insider trading arecomplex, and a violation of our policy or insider trading laws can carry severe consequences,including termination of your employment and criminal prosecution resulting in imprisonment.

15.

Third Parties. Zscaler will not work with third parties who have a history or reputation forengaging in unethical or illegal practices or would otherwise cause Zscaler to be viewed in anegative light.

16.

No Retaliation. Any Zscaler Representative who observes possible unethical or illegal conduct
is encouraged to report his or her concerns. Reprisal, threats, retribution or retaliation against any
person who has in good faith reported a violation or suspected violation of law, the Code of
Conduct or other Company policies, or against any person who is assisting in any investigation orprocess with respect to such a violation, is prohibited. Any Zscaler Representative involved inretaliation will be subject to serious disciplinary action by Zscaler. Furthermore, Zscaler could be
subject to criminal or civil actions for acts of retaliation against employees who “blow thewhistle” on U.S. federal securities law violations and other federal offenses. If you feel that you
have been the subject of retaliation for reporting a violation under this Code or participating in an
investigation, please immediately report the retaliation to your manager, the People and Culture
Department and/or the Legal Department. You may also report the retaliation under theCompany’s Whistleblower Policy.

17.

Questions. All questions or concerns regarding this Code should be directed to our Chief Legal
Officer as follows:
Robert Schlossman
Chief Legal Officerrschlossman@zscaler.com

Nothing in this Policy is intended to prevent any employee from reporting information to federal
or state law enforcement agencies when an employee has reasonable cause to believe that theviolation of a federal or state statute has occurred. A report to law enforcement agencies may bemade instead of, or in addition to, a report directly to the Company.

18.

Certification. From time to time, Zscaler may require you to certify your receipt, review, andunderstanding of this Code.
6

Effective September 2021

19.

Amendment, Modification and Waiver. Any amendment or waiver of any provision of theCode of Conduct must be approved in writing by the Board, or any committee of the Board towhich such authority has been delegated, and promptly disclosed pursuant to applicable laws andregulations. Any waiver or modification of the Code of Conduct for the Company’s principal
executive and senior financial officers will be promptly disclosed to the Company’s stockholders
if and as required by applicable law and/or the rules of the applicable stock exchange.

Compliance Areas for the Chief Executive Officer and Senior Financial Officers
In addition to being bound by all other provisions of the Code of Conduct, the Chief Executive Officer(“CEO”) and senior financial officers are subject to the following additional specific policies:
1.

Accurate Disclosure. The CEO and all senior financial officers are responsible for full, fair,accurate, timely and understandable disclosure in any public filings or other public
communications made by the Company which contain financial information. Accordingly, it is
the responsibility of the CEO and each senior financial officer promptly to bring to the attentionof the Chief Legal Officer any material information of which he or she may become aware that
affects the disclosures made by the Company in any public filing or other public communications
which contain financial information.

2.

Significant Deficiencies in Internal Controls. The CEO and each senior financial officer shallpromptly bring to the attention of the Chief Legal Officer and the Audit Committee any
information he or she may have concerning (a) significant deficiencies in the design or operationof internal controls which could adversely affect the Company’s ability to record, process,summarize and report financial data or (b) any fraud, whether or not material, that involves
management or other employees who have a significant role in the Company’s financial
reporting, disclosures or internal controls.

3.

Material Misstatements. The CEO and each senior financial officer shall promptly bring to theattention of the Chief Legal Officer and the Audit Committee any information he or she may haveconcerning a material misstatement in any reported financial information of the Company, inparticular any material over or understatement of the Company’s assets, liabilities, revenues,
expenses, and/or cash flows.

4.

Reporting Violations of Code. The CEO and each senior financial officer shall promptly bringto the attention of the Chief Legal Officer and the Audit Committee any information such officer
may have concerning any violation of the Code of Conduct, including any actual or apparent
conflicts of interest between personal and professional relationships, involving any management
or other employees who have a significant role in the Company’s financial reporting, disclosuresor internal controls.

5.

Violations of Securities Laws. The CEO and each senior financial officer shall promptly bringto the attention of the Chief Legal Officer and the Audit Committee any information such officer
may have concerning evidence of a material violation of the securities or other laws, rules orregulations applicable to the Company and the operation of its business, by the Company or any
agent thereof.

6.

Actions in Response to Violations. The Board shall determine, or designate appropriate persons
to determine, appropriate actions to be taken in the event of violations of the Code of Conduct orof these additional procedures by the CEO and the Company’s senior financial officers. Suchactions shall be reasonably designed to deter wrongdoing and to promote accountability foradherence to the Code of Conduct and to these additional procedures, and shall include written
7Effective September 2021
notices to the individual involved that the Board has determined that there has been a violation,
censure by the Board, demotion or re-assignment of the individual involved, suspension with orwithout pay or benefits (as determined by the Board) and potential termination of the individual’s
employment. In determining what action is appropriate in a particular case, the Board or suchdesignee shall take into account all relevant information, including the nature and severity of theviolation, whether the violation occurred once or repeatedly, whether the violation appears tohave been intentional or inadvertent, whether the individual in question had been advised prior to
the violation as to the proper course of action and whether or not the individual in question had
committed other violations in the past.

8