Zuora, Inc.

United States · www.zuora.com · 31 vendors

Zuora, Inc. is an American enterprise software company that provides a leading monetization suite for businesses. Its cloud-based platform helps companies launch and manage subscription-based services by automating recurring billing, collections, quoting, revenue recognition, and subscription metrics. The company's solutions are designed to support the complexities of recurring revenue models for various industries.

Resilience scores

Disruption prediction

Zuora, Inc. has an estimated 10% probability of disruption in the next 6 months.

16 of Zuora, Inc.'s 31 vendors monitored for disruptions.

Technology vendors

Services catalogue

6 services in catalogue across 4 categories; runs on 31 sub-vendors.

Insights

Last updated 2026-08-11 · revision 14

31 direct vendors, 326 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Zuora exhibits very high migration readiness, primarily driven by its highly modern, cloud-native, and flexible technology stack. The internal tech stack, built on Amazon Web Services (AWS), Kubernetes, Docker, and Kafka, signifies an architecture that is inherently portable, scalable, and designed for microservices. The use of open standards like REST APIs and GraphQL, coupled with an event-driven architecture and low-code workflow automation, further enhances its flexibility and reduces technical barriers to migration or re-platforming. Zuora's sophisticated approach to data residency, offering EU, UK, and APAC deployment options and actively managing compliance with GDPR, UK GDPR, and other international data protection laws (e.g., awareness of China PIPL, India DPDP Act), demonstrates a strong capability to adapt to diverse regulatory and contractual data localization requirements during any migration. The company's robust financial health, evidenced by consistent revenue growth, provides the necessary resources to fund and execute complex migration initiatives. Zuora's comprehensive regulatory compliance (SOC 2, ISO 27001, PCI DSS, etc.) means that established processes and controls are already in place, streamlining compliance aspects of a migration. The primary weakness is the 'Vendor Lock-in Risk: Unknown'. While the tech stack suggests a low dependency on proprietary, tightly coupled vendor solutions, the explicit lack of information on vendor lock-in means this cannot be fully assessed. However, the implied geographic diversity of vendors (6 unique countries) from the provided data, despite the 'Total Vendors: 0' anomaly, suggests a diversified supply chain that would generally ease migration complexities rather than hinder them.

Compliance

10 in-scope frameworks identified; showing 3.

PIPL — Assessment Required

PIPL is potentially applicable if Zuora processes personal information of Chinese residents or has operations in China. Risk is High because: (1) PIPL has extraterritorial reach similar to GDPR, applying to processing of Chinese residents' personal information outside China; (2) PIPL imposes strict data localization requirements for 'important data' and critical information infrastructure operators; (3) cross-border data transfers require security assessments, standard contracts, or certification; (4) penalties can reach ¥50M RMB (~$7M) or 5% of annual revenue; (5) it is unclear whether Zuora has Chinese operations or processes Chinese personal data at scale. Assessment is required to determine applicability.

Evidence: https://www.zuora.com/privacy/, https://www.cac.gov.cn/, https://www.zuora.com/company/about-us/

PCI DSS (source) — Compliant

PCI DSS is applicable to Zuora because its platform includes payment processing capabilities (Zuora Payments product) that handle credit card and payment data for enterprise customers. Risk is Medium because: (1) Zuora processes payment card data on behalf of its customers, creating PCI DSS obligations; (2) a breach of payment data could result in significant fines from card brands, loss of payment processing privileges, and reputational damage; (3) however, Zuora has maintained PCI DSS compliance as a commercial necessity for its payments business. PCI DSS v4.0 compliance deadline (March 2025) adds additional compliance pressure.

Evidence: https://www.zuora.com/trust/, https://www.zuora.com/products/payment-solutions/, https://www.pcisecuritystandards.org/assessors_and_solutions/service_providers

NIS2 (source) — Assessment Required

NIS2 Directive (EU) 2022/2555 may apply to Zuora as a 'digital provider' — specifically as a cloud computing service provider or online marketplace — which falls under the 'Important Entities' category. Zuora's SaaS platform processes critical financial and billing data for 1,000+ enterprises globally, including EU-based entities. The risk is Medium because: (1) Zuora clearly exceeds the size thresholds (50+ employees, €10M+ turnover); (2) cloud computing service providers are explicitly listed under NIS2 Annex II; (3) however, NIS2 applicability depends on whether Zuora has an EU establishment or provides services to EU essential/important entities, which requires formal legal assessment. Non-compliance with NIS2 can result in fines up to €7M or 1.4% of global annual turnover for Important Entities.

Evidence: https://www.zuora.com/trust/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555, https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive-new

Financials

Three-year financials

Financial Resilience Score: 6/10

Zuora demonstrates moderate financial resilience anchored by a strong recurring revenue model, with approximately 90-92% of revenue derived from subscriptions and multi-year contracts providing high revenue visibility. The company serves a blue-chip enterprise customer base including Zoom, Ford, Siemens, Box, and General Motors, with over 400 customers generating annual contract value above $250K. Its balance sheet has historically been supported by $400M+ in cash and marketable securities, along with convertible senior notes providing additional cushion. However, the company has persistently generated GAAP operating losses through FY2024, with non-GAAP profitability heavily dependent on stock-based compensation add-backs. Revenue growth has decelerated meaningfully from 41% in FY2019 to 11% in FY2024, below SaaS peer benchmarks, and dollar-based retention has softened to 107-110%. The February 2024 take-private transaction by Silver Lake and GIC at approximately $1.7 billion provides patient capital backing but likely added leverage to the balance sheet, with post-close capital structure not publicly disclosed. Competition from Stripe Billing, SAP, Salesforce Revenue Cloud, Chargebee, and Oracle remains intense.

Key strengths: Recurring subscription revenue represents ~90-92% of total revenue, Blue-chip enterprise customer base with 400+ customers above $250K ACV, Historical cash and marketable securities of $400M+, Improving non-GAAP operating margin trajectory FY2022-FY2024, Silver Lake and GIC ownership provides patient capital post-2024, Category leadership in subscription billing/monetization software, No single customer exceeds 10% of revenue

Risk factors: Persistent GAAP operating losses through FY2024, Revenue growth deceleration from 41% to 11% over five years, Non-GAAP profitability dependent on stock-based compensation add-backs, Softening dollar-based retention rate (107-110%), Intense competition from Stripe, SAP, Salesforce, Chargebee, Oracle, Potential added leverage from take-private transaction, Reduced financial transparency post-privatization, Exposure to enterprise IT spending cycles

Revenue by geography

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report