Zip

Zip's Integration ecosystem and Superagents pages document customer-tested native bi-directional connectors to ERP and P2P systems that push PO, invoice, transaction and supplier data, task integrations with CLM, GRC and ITSM tools, self-serve configuration, and an API library for custom integrations. The Superagents page lets the customer specify the actions agents can perform in Zip and in its integrations, and the June 2026 explainer has agents posting a PO to an ERP or triggering a payment through pre-built integrations, so agents take authenticated action in outside systems.

SourceZip, zip.com/capabilities/integration-ecosystem, /capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08

Superagents plan, take action and collaborate across the business to execute procurement work end-to-end, each coordinating Zip's underlying task agents, integrations and policy controls toward a broader goal.

The Procurement Superagent coordinates the people, decisions and vendor interactions for every purchase, and the Config Superagent adapts workflows over time. Customers configure agents through skills, actions, context and channels, and the platform's named workflow engine carries the approval routing. That is multi-step, multi-agent execution across teams and systems on a named runtime.

SourceZip, zip.com/capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08

Zip is the system of record for the customer's intake requests, supplier profiles, contracts, spend history, risk classifications and approvals: a maintained, persistent, queryable structure the agents reason over.

The Superagents page adds a Context layer of policies, playbooks and business rules that guide how agents decide, and the June 2026 launch post states that from the moment an employee requests a supplier the AI already has the intake data, supplier profile, spend category, risk classification and the company's legal playbook. No embeddings or index architecture is described; the grounding is the platform's own persistent records.

SourceZip, zip.com/capabilities/superagents and blog/introducing-zip-ai-superagents-mcp-ai-spend-automationread 2026-09-08

Granular action controls let the customer dictate what actions agents can take and when a human must approve, per the Superagents page. The FAQ states organizations can require approvals before agents take sensitive or high-impact actions, and the June 2026 explainer says teams decide which actions a Superagent completes autonomously and which require a human to review. Every action runs through the customer's existing approval workflows and policy guardrails in Zip's own workflow engine. Approval routing is the platform's core product, so the gate is native rather than borrowed.

SourceZip, zip.com/capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08

Zip's trust page documents both certifications and access controls. Attestations: SOC 1 Type 2 and SOC 2 Type 2 audits with reports available through the account manager or the Security Resource Center, ISO/IEC 27001:2022 with the Schellman certificate linked as a PDF, EU-US Data Privacy Framework participation, and NIST CSF, CIS and OWASP named as control frameworks.

Access: SSO with any SAML-based identity provider, SCIM for automated provisioning and deprovisioning, and role-based access permissions configurable by role, department and group for least privilege. The Superagents page adds role-based control over who can create, edit and interact with agents, and permission-aware agent action. The report download is gated but has a working request path.

SourceZip, zip.com/trust and /capabilities/superagentsread 2026-09-08

Agent actions are recorded with their reasoning and approvals. The Superagents page names complete visibility and auditability: monitoring agent performance and interactions while maintaining a rich audit trail with reasoning and a record of approvals.

The June 2026 explainer says each action is logged with the agent's reasoning and that observability dashboards let admins monitor engagement metrics and conversations. The trust page documents customer audit logs in the Zip dashboard for customer actions, with date, user, action and target.

A per-action record including the agent's reasoning and the approval that authorized it lets a team reconstruct why something happened. Retention period and export are not documented.

SourceZip, zip.com/capabilities/superagents, /trust and blog/what-are-zip-superagentsread 2026-09-08

Superagents keep no documented memory of their own with a stated scope and lifetime. Customer context, spend history and prior approvals live in the platform's own records, which are the application's data model: deleting that memory would delete the purchase record.

The Superagents page's Context (policies, playbooks, business rules) is configuration, and statements that Superagents learn your processes with every interaction and that the Config Superagent adapts workflows over time describe learning absorbed into the system, not memory a buyer can inspect. Conversation state in Slack, Teams and email threads is not documented either way.

SourceZip, zip.com/capabilities/superagentsread 2026-09-08

The vendor's subprocessor list records Amazon Web Services as the cloud, storage and generative AI provider, with entity country USA and Germany. The trust page places transfers under the EU-US Data Privacy Framework with SCCs as fallback, and the product is a cloud service with a login at app.zip.com. No region list offered to customers, no customer environment option and no way to choose either is documented. The German AWS entry describes the vendor's own infrastructure footprint, not a residency option a customer can pick.

SourceZip, zip.com/subprocessors and /trustread 2026-09-08

The Superagents page names five Superagents with a description and video each (Intake, Procurement, Contract, AP, Config), and the June 2026 explainer says each is built on the 50-plus purpose-built task agents launched in June 2025, naming several (Renewal Assist, DORA Assessment, Data Validation, Adverse Media, AI Invoice Coding).

The navigation carries seven named core products (Intake-to-Procure, Procure-to-Pay, Supplier Onboarding, Sourcing, Risk Orchestration, AI Contract Orchestration, AI Procurement Concierge). Intake guidance, purchase coordination, contract review, AP operations and configuration tuning are distinct jobs, and none depends on another. Customers select these agents and configure them through skills, actions and context.

SourceZip, zip.com/capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08

Superagents are engaged in Slack, Teams, email and other channels to answer questions and take action without switching tools, and the June 2026 explainer adds Claude, ChatGPT and Copilot through Zip MCP. The Intake Superagent picks up purchase requests as employees submit them, the Contract Superagent moves contracts through review as they arrive, and the Renewal Assist task agent works from contract dates. So work starts from inbound requests, messages on named channels and dated events. Schedules and webhooks are not separately documented.

SourceZip, zip.com/capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08

Data is sent to foundational model providers listed on the subprocessors page, per Zip's trust page, and that list names Anthropic, OpenAI and Microsoft Azure for customers enrolled in AI-assisted features, and AWS and Google Cloud Platform for generative AI services. The trust page adds that only LLM providers with zero-data-retention agreements are used.

So the vendor uses several providers, but Zip chooses among them. The customer's control is enrolling in or opting out of AI functionality as a whole; no provider or model selector, admin routing control or per-workflow model setting is documented. Zip MCP being model-agnostic concerns which assistant calls Zip, not which model Zip runs.

SourceZip, zip.com/subprocessors and /trust (AI section)read 2026-09-08

The vendor's Integration ecosystem page describes a robust API library that lets customers build custom integrations using comprehensive API endpoints to extract, create and update Zip data. The API reference itself sits behind the customer login. Zip MCP, a procurement-native MCP implementation, lets Claude, ChatGPT and Copilot call Zip, so outside assistants can drive the platform. App Studio and Superagent skills are the customer building inside the platform rather than calling it from outside.

SourceZip, zip.com/capabilities/integration-ecosystem and /capabilities/superagentsread 2026-09-08

No customer-facing evaluation harness, scored test cases, release gate or controlled post-deployment experiment measuring the agents is documented. Three things come close without being evaluation. Drafts and versioning on the Superagents page (track changes to agent configuration, save as drafts, revert to previous versions) is change management with no test or verdict between draft and live.

LangSmith, on the subprocessor list to monitor, trace and evaluate AI-assisted features, is Zip's own internal engineering practice, not a tool the customer uses. The Config Superagent identifying process inefficiencies and adapting workflows over time optimizes the customer's process, not the agent.

SourceZip, zip.com/capabilities/superagents and /subprocessorsread 2026-09-08

Superagents take action in connected systems and, for repeatable steps such as posting a PO to an ERP or triggering a payment, use pre-built integrations to execute the action the same way every time. Execution runs through integrations rather than an agent operating an interface. Vendor research and the Adverse Media task agent gather external information, but no mechanism is documented. No browser, desktop or remote computer control is documented.

SourceZip, zip.com/capabilities/superagents and blog/what-are-zip-superagentsread 2026-09-08