Technology Stack
Describe in detail the technology stack used by your application. This should include:
- Programming languages and frameworks
- Third-party libraries, SDKs, and dependencies (with versions, if possible)
- External and internal APIs the app uses or exposes
- Any infrastructure or platforms the app relies on (e.g., cloud services, databases, hosting providers)
We require this information to accurately assess the security posture of your app during the review process.
Architecture Diagram
Provide an architectural diagram of your application, along with additional flow diagrams where applicable. This should illustrate:
- All services and components that interact with Zoom
- Databases, servers, and third-party applications essential for your app's functionality
This information is required to help us understand your app's design and assess its security posture during the review process.
Application Development
To obtain approval to share the Authorization URL, you must provide the following security documentation:
Required documentation
- Secure Software Development Lifecycle (SSDLC) documentation.
- Static Application Security Testing (SAST) scan results.
- Dynamic Application Security Testing (DAST) scan results.
- Your application's Privacy Policy.
SAST and DAST results must be provided as screenshots or official scanner-generated output. Custom-written summaries are not accepted as scan evidence.
In addition, you must submit any three of the following five security artifacts:
- Executive summary of a penetration test.
- Security policy.
- Incident management and response policy.
- Vulnerability management procedures.
- Infrastructure/dependency management policy.
Your application must also support TLS 1.2 or higher.
These supporting documentation requirements apply for Authorization URL approval. They are not prerequisites for submitting an app for Marketplace publication, although apps submitted for publication remain subject to the standard Marketplace review and security requirements.