Apollo.io
ZenLeads, Inc. d/b/a Apollo.io ·www.apollo.io· As of: 2026-08-03
Work through this tool with an AI
Our verdict
Addresses and sending from one source save time and a second subscription. That does not amount to an edge: the same database is open to every competitor from USD 49 a month, and whatever a customer feeds in grows into that same database under the data processing agreement. It does not work as a company-wide capability either, because what you buy is raw material, while the judgement about who is worth approaching stays in house. In Germany a second point applies that appears on no feature list. Section 7(2)(2) of the Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) requires prior express consent for advertising by email, business-to-business included, and a verified address does not replace that consent. Running the channel anyway buys reach and legal exposure in the same subscription. The tool does one job faster; it moves no position.
Evidence:Legal entity, address, data broker registration in four states, legitimate interest as the legal basis, three routes of data collectionOpen sourceRole split under Section 3(b), independent controllership when matching against the contact database, deletion or return within 90 days, 30 days' notice for new subprocessors, standard contractual clauses Modules 1 and 2Open sourceUse of customer data to grow the vendor's own contact database, perpetual licence to the lists produced for internal business use, credits expiring without rollover, fee based on credits purchased rather than used, mailbox scanning with an opt-outOpen sourcePlans, credits per seat per year, single sign-on only on the Organization plan, add-on prices, exporting consumes creditsOpen sourceModel providers in use, deletion at the model provider within 30 days, the training reservation with disclosure and consentOpen sourceISO 27001 and SOC 2 audited by A-LIGN, annual penetration tests, quarterly internal audits, report only through the sales teamOpen sourceProcessing in the United States, certification under the EU-US Data Privacy Framework covering two subsidiaries, retention without a deadline in the vendor's own database, suppression file after an objectionOpen sourceData broker registration with the California Attorney General since 1 July 2020Open sourceExposed database from July 2018 containing 126m unique email addressesOpen sourceSeries D of USD 100m at a USD 1.6bn valuation on 29 August 2023Open source
Who it fits
Solo
suitable
The free tier grants 900 credits per seat per year, released monthly, enough to inspect the database. Basic costs USD 49 per seat per month on annual billing. The price is affordable for one person. The duties travel along regardless: the notice required within one month under Article 14 GDPR to every contact approached is owed by the sender, and Apollo does not take it off their hands.
Mid-market
suitable
The package is cut for this size. Professional costs USD 79 per seat per month on annual billing and covers sequences, mailboxes, recording and reporting, which would otherwise be three subscriptions. The job in house is managing consumption, because credits expire at the end of the billing cycle and the fee follows the credits purchased rather than those used.
Enterprise
suitable with caveats
Single sign-on only arrives on the Organization plan, USD 119 per seat per month with a three-seat minimum. There is no public commitment on auditable access logs, processing takes place in the United States, and no European region is offered anywhere. What decides a procurement review is the data processing agreement itself: it expressly casts Apollo as an independent controller for matching against its own contact database, so the purchase cannot be mapped as pure processing on behalf of the customer.
Buy, switch or build
Off-the-shelf
Buy an established data vendor with documented provenance
ZoomInfo is the usual counterpart in large organisations, and for European procurement often Cognism, which explicitly markets the provenance of its German-language contacts as a feature. Corporates stay there because purchasing and data protection need a counterparty with a contact in Europe, named provenance for the records and negotiated audit rights. That is paid for with a multiple of the price and with terms measured in years rather than months.
AI-native
A workbench instead of a ready-made database
Clay keeps no database of its own; it queries several data providers in sequence and puts your own scoring logic on top. Entry sits at USD 167 a month against USD 49, and the sending layer is missing, so you buy that separately. In return it stays traceable why a company is on the list, and that reasoning belongs to you. What you give up is the convenience of searching and writing in the same interface, and you buy work rather than an outcome.
Build it yourself
Your own contact register with purchased addresses
A register in your own database, built with Claude Code, the model calls for classification and scoring routed through LiteLLM, the provider keys in Infisical, the scoring logic versioned in GitHub, the sending done through lemlist with storage in the European Union. Costed at EUR 900 a day and 10 to 15 person-days for a workable first version, the build lands between EUR 9,000 and 13,500, plus the cost of the addresses and ongoing operation; that calculation is an estimate. The point where this typically breaks is the database itself: addresses still have to be bought, so the build replaces the workbench and never the data source. Add deliverability as a discipline of its own, the Article 14 GDPR notification duty, which does not change, and the question of who maintains the register once the person who built it leaves.
Our advice
- Solo: Start on the free tier and settle the consent question before the first campaign.
- Mid-market: Buy Professional, review credit consumption monthly and write the Article 14 notice firmly into the process.
- Enterprise: Organization only, with logging settled in writing beforehand and the independent controller role talked through with data protection.
Who is behind it
Staying power: Established
The company has been in the market since 2015 and last raised capital publicly in 2023. For a procurement review one point weighs more than the funding position: Apollo is registered as a data broker in several US states, and the business consists of selling details about people who initially know nothing of it. The database left open in 2018 is long past and still describes the order of magnitude such a collection holds.
- Legal entity and seat: ZenLeads, Inc. d/b/a Apollo.io, 440 N Barranca Ave #4750, Covina, CA 91723-1722, USALegal entity, address, data broker registration in four states, legitimate interest as the legal basis, three routes of data collectionOpen source · As of 2026-08-03
- Years in market: founded in 2015 as ZenProspect, Y Combinator batch Winter 2016, trading as Apollo.io since 2018ycombinator.com/companies/1044Open source · As of 2026-08-03
- Funding: USD 100m Series D at a USD 1.6bn valuation on 29 August 2023, led by Bain Capital Ventures, around USD 250m raised in total per the vendor; no further round reported sinceSeries D of USD 100m at a USD 1.6bn valuation on 29 August 2023Open source · As of 2026-08-03
- Data broker registration: registered as a data broker with the California Attorney General since 1 July 2020, listed there at 101 Montgomery Street, Suite 400, San Francisco; further registrations in Oregon, Texas and Vermont per the vendor's own statementData broker registration with the California Attorney General since 1 July 2020Open source · As of 2026-08-03
- Documented incident: in July 2018 a database sat openly on the web without password protection; 126m unique email addresses from it were handed to Have I Been Pwned, recorded there with a breach date of 5 October 2018Exposed database from July 2018 containing 126m unique email addressesOpen source · As of 2026-08-03
- Security audit evidence: ISO 27001 and SOC 2 per the vendor, audited by the firm A-LIGN; the SOC 2 report is released only through the sales teamISO 27001 and SOC 2 audited by A-LIGN, annual penetration tests, quarterly internal audits, report only through the sales teamOpen source · As of 2026-08-03
Cost of leaving: Moderate
The data comes out and stays usable: the terms grant a perpetual licence to the lists produced, limited to your own internal business use and excluding resale. Exporting costs credits, so the way out of the system costs as well. What makes a switch genuinely hard sits in the data processing agreement: opt-outs and deletion requests notified by Apollo have to be applied to every record already exported, for as long as those records remain in house. That housekeeping continues long after the subscription has been cancelled. On top of that comes the deliverability of the connected mailboxes, which a new tool has to rebuild from scratch.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, but unfavourablepublicly available and incorporated through the terms, yet covers only the part where Apollo acts as a processorRole split under Section 3(b), independent controllership when matching against the contact database, deletion or return within 90 days, 30 days' notice for new subprocessors, standard contractual clauses Modules 1 and 2Open sourceThe agreement is openly available and forms part of the terms by reference. Its Section 3(b) splits the roles: for sequences, recordings and account data Apollo is a processor, while for its own contact database it is an independent controller. The same section goes on to state that Apollo also becomes an independent controller of customer data once that data is matched against the contact database, and that it then uses the data to enrich that database for all users. The sections on subprocessors, deletion and audit rights expressly do not apply to that part.As of 2026-08-03 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, but unfavourableUnited States, no European region offeredProcessing in the United States, certification under the EU-US Data Privacy Framework covering two subsidiaries, retention without a deadline in the vendor's own database, suppression file after an objectionOpen sourceThe privacy policy and the processing notice both name the United States as the place of processing. The trust portal lists Amazon Web Services and Google Cloud as subprocessors without naming a region. A selectable European storage location appears in none of the publicly reachable documents.As of 2026-08-03 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionlist publicly visible in the trust portal, without purpose and country per entrytrust.apollo.ioOpen sourceThe trust portal shows the subprocessors without a prior request, among them Amazon Web Services, Google Cloud, Databricks, Snowflake and OpenAI. Purpose and country of establishment are not given per entry. The data processing agreement promises notice 30 days before a new subprocessor starts; a customer who objects and reaches no agreement may terminate and receive a pro rata refund of prepaid fees. Silence within 30 days counts as acceptance.As of 2026-08-03 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedtransfer to the United States, covered by the EU-US Data Privacy Framework and standard contractual clausesProcessing in the United States, certification under the EU-US Data Privacy Framework covering two subsidiaries, retention without a deadline in the vendor's own database, suppression file after an objectionOpen sourceThe privacy policy names a certification under the EU-US Data Privacy Framework including the UK and Swiss extensions, covering the subsidiaries Zenleads Holdings LLC and Varsovia Holdings LLC. Standard contractual clauses and transfer impact assessments are named in addition. The data processing agreement incorporates both modules, Module 1 for transfers between independent controllers and Module 2 for processing, with Irish law governing the clauses. The entry in the official participant list could not be read during this review and should be checked there before procuring.As of 2026-08-03 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, tied to a conditionpassing data to model providers for training only after disclosure and consent, deletion there promised within 30 daysModel providers in use, deletion at the model provider within 30 days, the training reservation with disclosure and consentOpen sourceThe AI policy names OpenAI, Anthropic, Google, Perplexity and Assembly AI as the providers in use and commits to deletion of customer data there within 30 days. The commitment on training carries a condition and reads that Apollo passes customer data on for that purpose only after prior disclosure and consent. What is worded there is a reservation, and it sits on a policy page instead of in the contract. Separate from this is the in-house use: under the terms Apollo may use customer data to grow, enrich and verify its own contact database.As of 2026-08-03 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditiondeletion or return within 90 days of termination for customer data, no deadline for the contact databaseRole split under Section 3(b), independent controllership when matching against the contact database, deletion or return within 90 days, 30 days' notice for new subprocessors, standard contractual clauses Modules 1 and 2Open sourceFor customer data the data processing agreement promises deletion or full return within 90 days of termination, at the customer's election, with the usual carve-out for statutory retention duties. A different rule applies to Apollo's own database: the privacy policy names no period there and keeps the details for as long as they are useful in the product. Anyone who objects is added to a suppression file that is expressly kept on.As of 2026-08-03 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionISO 27001 and SOC 2 audited by A-LIGN, plus CASA Tier 2, without naming the standard version and scopeISO 27001 and SOC 2 audited by A-LIGN, annual penetration tests, quarterly internal audits, report only through the sales teamOpen sourceThe security page names both attestations along with the auditing firm and offers the certificates for download, the SOC 2 report only through the sales team. Which version of the standard was audited and which scope is covered does not appear on the publicly reachable pages. Annual penetration tests by a certified third party and quarterly internal audits are named in addition.As of 2026-08-03 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableunclearModel providers in use, deletion at the model provider within 30 days, the training reservation with disclosure and consentOpen sourceNeither the AI policy nor the security page nor the terms mention the AI Regulation. In practice the duty rests with the deployer anyway: whoever sends machine-generated outreach with this tool, or lets an AI assistant appear towards people, sets the disclosure under Article 50 of Regulation (EU) 2024/1689 themselves, which has applied since 2 August 2026. That needs no commitment from the vendor, but it does need a decision written into your own process.As of 2026-08-03 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourablean account activity log is mentioned, scope and retention left open publiclyRole split under Section 3(b), independent controllership when matching against the contact database, deletion or return within 90 days, 30 days' notice for new subprocessors, standard contractual clauses Modules 1 and 2Open sourceThe data processing agreement mentions an activity log in the account, but only as the channel through which Apollo announces opt-outs and deletion requests. What it records about access and changes, how long it is kept and whether it can be exported into your own systems appears on no publicly reachable page. The pricing page names advanced security configurations for the Organization plan without breaking them down. That makes evidentiary duties impossible to plan for in advance.As of 2026-08-03 |
What it really costs
Entry price
Free with 900 credits per seat per year, released monthly. Basic costs USD 49 per seat per month on annual billing with 30,000 credits per seat per year, Professional USD 79 with 48,000 credits, Organization USD 119 with 72,000 credits and a three-seat minimum. Two add-on packages, one for inbound and one for advanced dialling, cost USD 119 per team per month each. All figures exclude tax.Plans, credits per seat per year, single sign-on only on the Organization plan, add-on prices, exporting consumes creditsOpen source
As of 2026-08-03
What gets expensive
Credits are the second currency and they only run one way. An email address costs at most one credit, a verified phone number more. Exporting a contact out of the system consumes credits too, so the way out is part of the consumption. Under the terms the subscription fee follows the credits purchased rather than those used, it is neither cancellable nor refundable within the current term, and unused credits expire at the end of the billing cycle with no rollover. Overestimating demand means paying twice. The second jump sits in procurement: single sign-on starts on Organization, which lifts entry from USD 49 to USD 119 per seat per month with a three-seat minimum.
What it displaces
- Separate subscriptions for a contact database, sequence sending and call recording
- Manual address research through company websites and network profiles
- Contact lists in spreadsheets that nobody maintains after three months
Interfaces
- CSV import and CSV export
- Connections to Salesforce and HubSpot
- API for enrichment, with wider use only on the custom plan
- Browser extension for Chrome
- Mailbox connection for Google and Microsoft, other providers only on paid plans
- MCP connection
Matching methods
- Predictable Revenue / Cold Calling 2.0The method separates research, first contact and closing into distinct roles, and Apollo supplies the research stage with the address base and filters without which such a team never fills its first list.
- Warm Outreach EngineThe method needs a repeatable loop of list, sequence and follow-up in one place, and those three steps sit in the same interface here.
- Lead Scoring: Best Leads to Best ClosersRouting by win probability presupposes that attributes exist per contact at all, and Apollo supplies those attributes along with its own scoring function straight from the database.
Sources
- 1.Legal entity, address, data broker registration in four states, legitimate interest as the legal basis, three routes of data collection (opens in a new tab)apollo.io/privacy-policy/processing-notice · As of 2026-08-03
- 2.Role split under Section 3(b), independent controllership when matching against the contact database, deletion or return within 90 days, 30 days' notice for new subprocessors, standard contractual clauses Modules 1 and 2 (opens in a new tab)apollo.io/dpa · As of 2026-08-03
- 3.Use of customer data to grow the vendor's own contact database, perpetual licence to the lists produced for internal business use, credits expiring without rollover, fee based on credits purchased rather than used, mailbox scanning with an opt-out (opens in a new tab)apollo.io/terms · As of 2026-08-03
- 4.Plans, credits per seat per year, single sign-on only on the Organization plan, add-on prices, exporting consumes credits (opens in a new tab)apollo.io/pricing · As of 2026-08-03
- 5.Model providers in use, deletion at the model provider within 30 days, the training reservation with disclosure and consent (opens in a new tab)apollo.io/ai-policy · As of 2026-08-03
- 6.ISO 27001 and SOC 2 audited by A-LIGN, annual penetration tests, quarterly internal audits, report only through the sales team (opens in a new tab)apollo.io/product/security · As of 2026-08-03
- 7.Processing in the United States, certification under the EU-US Data Privacy Framework covering two subsidiaries, retention without a deadline in the vendor's own database, suppression file after an objection (opens in a new tab)apollo.io/privacy-policy · As of 2026-08-03
- 8.Data broker registration with the California Attorney General since 1 July 2020 (opens in a new tab)oag.ca.gov/data-broker/registration/186881 · As of 2026-08-03
- 9.Exposed database from July 2018 containing 126m unique email addresses (opens in a new tab)haveibeenpwned.com/breach/Apollo · As of 2026-08-03
- 10.Series D of USD 100m at a USD 1.6bn valuation on 29 August 2023 (opens in a new tab)apollo.io/… · As of 2026-08-03
- 11.ycombinator.com/companies/1044 (opens in a new tab)As of 2026-08-03
- 12.trust.apollo.io (opens in a new tab)As of 2026-08-03
Last reviewed: 2026-08-03 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.