Zoom
Video conferencing · zoom.com · last read 2026-11-09
Products Zoom names as its own: Zoom Workplace, ZoomMate, Meetings, Chat, Phone, Mail & Calendar, Scheduler, Whiteboard and 29 more
At a glance
- Is Zoom GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Zoom itself publishes, each answer linked to its source and the date we read it.
- Does Zoom have a data processing agreement (DPA)?
- Yes. Zoom publishes a data processing agreement at media.zoom.com. It gives between 7 and 30 days' notice before a new subprocessor is added, depending on the case; the terms tab gives each. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Zoom DPA is current?
- On 2026-11-09, Zoom's DPA at media.zoom.com printed “Zoom Global Data Processing Addendum (November 2024)”. Source and date
- Does Zoom have a SOC 2 report?
- Zoom states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Zoom's words: “SOC 2 Type 2 report covering Security, Availability, Confidentiality, and Privacy.” We read this on 2026-10-05. Source and date
- Is Zoom ISO 27001 certified?
- Zoom states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. We read this on 2026-10-05. Source and date
- Where is Zoom's trust center?
- Zoom publishes a page it calls “Trust Center” at zoom.com/en/trust. Its front page shows no request or sign-in step; documents further in may still have one. We read it on 2026-11-03. Source and date
- Does Zoom use your data to train AI models?
- For every plan (Zoom AI features): Customer audio, video, chat, screen sharing, attachments and other communications-like content not used to train Zoom's or third-party AI models. Source and date
- Does Zoom offer zero data retention?
- For every plan (Zoom AI features): Zero data retention policies with third-party generative AI model providers, with limited trust and safety exceptions. Source and date
- How does Zoom transfer personal data out of the EU?
- Zoom's agreement relies on the EU standard contractual clauses and the UK transfer addendum. Zoom is on the official Data Privacy Framework List (status: Active). Source and date
- Does Zoom offer EU data residency?
- An EU location exists but requires a paid plan or add-on. Plan it needs: Paid account; admins only. Source and date
- Who are Zoom's subprocessors?
- Zoom lists 24 third-party subprocessors; 23 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
- How do you report a security vulnerability to Zoom?
- Zoom publishes a security.txt at zoom.com naming https://www.zoom.com/en/trust/vulnerability-disclosure/submit-vulnerability-report or [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Zoom Communications, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 549300T9GCHU0ODOM055 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | zoom.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Zoom data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Paid upgrade | Paid account; admins only | support.zoom.com | 2026-09-18 |
EU: Page states Customer Content is stored in the US by default and that customers on PAID accounts may choose the storage location for some of it. Long-term file storage always stays in the home data-centre region, and region selection does not apply to Zoom Phone. Individual users cannot view or change the setting - admins only.
The same question for every vendor: where SaaS vendors store EU data.
Zoom's subprocessor list names AWS, Microsoft, Google and Oracle for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
24 third parties · 27 of the vendor's own group companies · 23 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | AU, BR, CA, EU, IN, JP, SG, TW, US | Cloud Service Provider |
| Anthropic | US | Intelligent Features Service Provider |
| Authzed, Inc. | US | Authorization / Permissions service (Developer tools) |
| Cloudflare | — | Content Delivery Network |
| Cloudflare | EU, US | Security |
| Eleven Labs Inc. | US, EU | Intelligent Features Service Provider (Text to Speech,Voice Cloning, Dubbing) |
| Google Cloud Platform | US, EU, UY, CL, TW, JP, SG | Cloud Service Provider, Intelligent Features Service Provider |
| MaestroQA | IE, US | Support Quality Assurance |
| Microsoft | CH | Cloud Service Provider. |
| Microsoft | AU, BR, CA, EU, IN, JP, SG, TW, US | Microsoft’s Azure AI Speech, Speech-to-Text service. |
| MongoDB | US | Developer Database Platform |
| OneTrust | US | Data Subject Requests Portal, Cookie Preference Center |
| OpenAI | US, EU | Intelligent Features Service Provider |
| Oracle | MX, US, SA | Cloud Service Provider |
| Perplexity | US | Intelligent Features Service Provider |
| Qualtrics | DE, US | Feedback, Reviews, and Survey Responses |
| Sendbird | EU, US | Chat Functionality for Workvivo Customers (Optional) |
| SendSafely | US | Encrypted file transfer service |
| ServiceNow | DE, US | Cloud-based Customer Service Platform |
| Stripe | US | Payment Processing (Zoom Events) |
| Suki AI | US | Intelligent Features Service Provider |
| Sumit-AI | EU, US | AI Speech, Speech-to-Text service |
| TaskUS | PH, HR | Support Providers |
| Twilio | US, EU | Notifications |
Zoom's own group companies listed as subprocessors (27)
| Company | Country | Purpose |
|---|---|---|
| Bonsai Technologies Inc. | US, FR | — |
| Brighthire, Inc. | US | — |
| Keybase, LLC | US | — |
| Saasbee Inc. (Hefei) Ltd. | CN | — |
| Saasbee Software (Hangzhou) Co., Ltd. | CN | — |
| Solvvy, LLC | US | — |
| Workvivo Limited | IE | — |
| ZM Services India Private Ltd. | IN | — |
| Zoom Arabia Communications Company | SA | — |
| Zoom Communications, Inc. | US | — |
| Zoom Middle East and North Africa Regional Headquarters Company | SA | — |
| Zoom Software (Hangzhou) Co., Ltd. | CN | — |
| Zoom Software (Wuhan) Co., Ltd. | CN | — |
| Zoom Video Communications (Hong Kong) Limited | HK | — |
| Zoom Video Communications (Shanghai) Co., Ltd. | CN | — |
| Zoom Video Communications (Suzhou) Inc. | CN | — |
| Zoom Video Communications Korea, LLC | KR | — |
| Zoom Voice Communications, Inc. | US, HK | — |
| ZVC Canada, Ltd. | CA | — |
| ZVC France SAS | FR | — |
| ZVC Germany GmbH | DE | — |
| ZVC India Pvt. Ltd. | IN | — |
| ZVC JAPAN K.K. | JP | — |
| ZVC Netherlands B.V. | NL, NO | — |
| ZVC Singapore Pte. Ltd. | SG | — |
| ZVC UK Ltd. | GB | — |
| ZVC- Australia Pty Ltd. | AU | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · media.zoom.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 business days before the new subprocessor starts processing, by email to the address the customer enters on the subprocessor webpage |
| Notice of new subprocessors | In an emergency about Service availability or security, no prior notice is required; notice within 7 business days after the change |
| Notice of new subprocessors | In an emergency concerning availability or security, no prior notice; notice within 7 business days after the change |
| Notice of new subprocessors | Notice of changes to subprocessors to customers who subscribe to updates at https://explore.zoom.us/en/subprocessors/; no advance period stated |
| If you object to one | Customer may object in writing within 15 business days of notice. Zoom chooses how to cure: cancel, take corrective steps, stop providing the affected Service aspect, or offer alternatives. If no subprocessor objection is made, the subprocessor is deemed accepted |
| If you object to one | If no alternative is provided or agreed, either party may terminate the affected portion(s) of the Agreement within 30 days, with prior written notice; fees owed up to the termination date remain due |
| If you object to one | Object in writing within 15 business days of notice; Zoom chooses how to cure (drop the subcontractor, take corrective steps, or stop providing the affected Service); if no alternative is agreed, either party may terminate the affected portion on 30 days' written notice; no objection means the subcontractor is deemed accepted |
| Obligations passed to subprocessors | By contract or other legal act, data protection obligations consistent with the Addendum and in accordance with GDPR requirements |
| Breach notification | without undue delay after a confirmed Personal Data Breach (at Zoom or a subprocessor) |
| Deletion when the service ends | Following completion of the Services, at Customer's choice, deletes the specified Customer Personal Data (or enables Customer to delete it) and any existing copies per Zoom's data retention and deletion policy; where deletion is impracticable or legally prohibited, informs Customer, blocks further processing and continues to protect the data |
| Getting your data back | Following completion of the Services, at Customer's choice, returns the specified Customer Personal Data to Customer |
| Requests from data subjects | Promptly notifies Customer of a data subject request received directly and advises the data subject to submit it to Customer, who is responsible for responding; assists Customer through appropriate technical and organisational measures |
| Audit | Annual independent third-party review (SSAE, SOC 2 Type II); copy of SOC 2 Type II report provided on customer request within 30 days; bridge letter on request |
| Audit | Customer may audit, review, or assess Zoom no more than once every 12 months, at Customer's sole cost and expense, subject to reasonable requirements and written agreements (CCPA State Law Exhibit) |
| Audit | Customer relies on Zoom's third-party SOC 2 Type II report (copy within 30 days of request, bridge letter on request); no right to audit unless granted by applicable law, except after a Security Breach with material business impact to Customer — audit within scope of the Services, at least 30 days' notice, Zoom approves any third party involved |
| Audit | ISO 27001 / SOC 2 Type II third-party audit reports available on request; customer may have an audit by a mutually agreed auditor at its own request and cost, no more than once a year (extra audits after a Zoom data breach or if ordered by a Supervisory Authority); on-premise audits limited to two weeks |
| Audit | On reasonable request, Zoom provides reasonable information in its possession needed to show compliance |
| Audit | Zoom conducts third-party audits and assessments per Sections 10.1 and 10.2 of the Addendum (US state law exhibit) |
| Audit | audit by an independent, suitably qualified third-party auditor; start date, duration, scope and controls agreed in advance; on-premise audits not to exceed two weeks; conducted under recognized international auditing standards |
| Transfer impact assessment | Zoom performs a case-by-case assessment of whether supplementary measures are needed for onward transfers to third countries |
| Transfer impact assessment | Zoom will follow EDPB and applicable data protection law requirements on completing a data transfer impact assessment (DTIA) |
| Processing on your instructions | Zoom acts on Customer's instructions as Processor: it processes Customer Personal Data as set out in the Agreement, Annex I, and any other documented instruction from Customer that Zoom acknowledges as an instruction |
| Confidentiality of staff | All persons authorised to process Customer Personal Data and Customer Content are made aware of its confidential nature and have committed to confidentiality (e.g., confidentiality agreements) or are under an appropriate legal obligation of confidentiality |
| Security measures | processes all Customer Personal Data in compliance with the Security Measures referenced in Section 6 of the Addendum |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Zoom Global Data Processing Addendum (November 2024)
at media.zoom.com
Last updated 2024-11
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Zoom's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans Zoom AI features | Training on your data | Not used Customer audio, video, chat, screen sharing, attachments and other communications-like content not used to train Zoom's or third-party AI models | library.zoom.com | 2026-10-28 |
| All plans Zoom AI features | Zero data retention | With its model providers Zero data retention policies with third-party generative AI model providers, with limited trust and safety exceptions | library.zoom.com | 2026-10-28 |
| All plans Zoom AI features | Model providers | Anthropic | library.zoom.com | 2026-10-28 |
| All plans Zoom AI features | Model providers | OpenAI | library.zoom.com | 2026-10-28 |
Assurance
Does Zoom have a SOC 2 report?
Zoom states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-10-05.
- Claimed “SOC 2 + HITRUST SOC 2 Type 2 report that includes controls relevant to HITRUST”
- Claimed “SOC 2 Type 2 report covering Security, Availability, Confidentiality, and Privacy”
Source: zoom.com, 2026-10-05
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Zoom ISO 27001 certified?
Zoom states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. We read this on 2026-10-05.
On the same list Zoom also names ISO/IEC 27017 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| BSI C5 · C5 | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| CAIQ | Claimed | Workvivo | zoom.com | 2026-10-05 |
| CJIS | Claimed | Zoom for Government; Compliance Assessment Report | zoom.com | 2026-10-05 |
| CSA STAR Level 2 · CSA | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| UK Cyber Essentials Plus · CyberEssentialsPlus | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| DODIL4 · DoDIL | Claimed | Zoom for Government | zoom.com | 2026-10-05 |
| ENS | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| Japan’s FISC · FISC | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| FedRAMP Moderate · FedRAMP | Claimed | Zoom for Government | zoom.com | 2026-10-05 |
| Gov-RAMP · GovRAMP | Claimed | Zoom for Government | zoom.com | 2026-10-05 |
| HDS | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| HECVAT | Claimed | Assessments and standards | zoom.com | 2026-10-05 |
| ISMAP | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| ISO 27001 · ISO27001 | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| ISO 27017 / 18 · ISO27017 | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| ISO 27701 · ISO27701 | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| ETDA | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| gpaNRW | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
| MASA | Claimed | Commercial; mobile applications in Taiwan | zoom.com | 2026-10-05 |
| SOC Type 2 | Claimed | Workvivo; SOC 2 Type 2 report covering Security, Availability, and Privacy | zoom.com | 2026-10-05 |
| SIG | Claimed | Assessments and standards | zoom.com | 2026-10-05 |
| SOC 2 + HITRUST · SOC2T2 | Claimed | Commercial; SOC 2 Type 2 report that includes controls relevant to HITRUST | zoom.com | 2026-10-05 |
| SOC 2 Type 2 · SOC2T2 | Claimed | Commercial; report covering Security, Availability, Confidentiality, and Privacy | zoom.com | 2026-10-05 |
| TX-RAMP · TXRAMP | Claimed | Commercial certifications and attestations | zoom.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Zoom | Active | HR data, non-HR data | 2026-12-19 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Zoom | Active | HR data, non-HR data | 2026-12-19 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Zoom | Active | HR data, non-HR data | 2026-12-19 | 2026-10-05 |
| ENS certificates of conformity (CCN, Spain) | Los sistemas de Información que soportan los servicios de la Plataforma Zoom ((Meetings, Team Chat, Phone, Mail and Calendar, Scheduler, Docs, Whiteboard, Clips, Tasks, Notes, Rooms , Workspace Reservation, Visitor Management, Contact Center, Virtual Agent, Workforce Engagement Management - Workforc… · Zoom Video Communications Inc. | certified | ENS ALTA | 2028-04-17 | 2026-10-18 |
| FedRAMP Marketplace (US) | Zoom for Government · Zoom Video Communications, LLC | FedRAMP Authorized | Moderate | — | 2026-10-04 |
| Global LEI Index (GLEIF) | ZOOM COMMUNICATIONS, INC. · ZOOM COMMUNICATIONS, INC. | ISSUED | US-DE | 2026-11-24 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-02, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-26, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- Data Privacy Framework List (US): checked 2026-11-02, 3 entries under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-02, 1 entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-02, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- FedRAMP Marketplace (US): checked 2026-11-02, 1 entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-02, no entry under ZVC Netherlands B.V.; Zoom; Zoom Communications, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| VDI client | 9 months | Declared | unknown | support.zoom.com | 2026-10-11 |
| Zoom Rooms | 9 months | Declared | unknown | support.zoom.com | 2026-10-11 |
| Zoom Workplace app | 9 months | Declared | unknown | support.zoom.com | 2026-10-11 |
Vulnerability reporting: zoom.com, [email protected] (security.txt, expires 2029-12-31; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Products
- Zoom Workplace
- ZoomMate
- Meetings
- Chat
- Phone
- Mail & Calendar
- Scheduler
- Whiteboard
- Clips
- Hub
- Video Management
- Rooms
- Workspace Reservation
- Signage
- Visitor Management
- Workvivo
- Revenue Accelerator
- Webinars & Events
- Bonsai
- BrightHire
- Contact Center
- AI Expert Assist
- Workforce Management
- Quality Management
- CX Insights
- My Notes
- Virtual Agent
- AI On-Prem
- Canvas
- Slides
- Sheets
- Paper
- Video SDK
- Co-Browse
- Realtime Media Streams
- Zoom Apps
- Meeting SDK
As Zoom's own list names them. Each fact on this page comes from the document cited beside it; a product named here is not necessarily covered by every one of those documents. Source: zoom.com, 2026-10-29.
Documents
Where is Zoom's trust center?
Zoom publishes a page it calls “Trust Center” at zoom.com/en/trust. Its front page shows no request or sign-in step; documents further in may still have one. We read it on 2026-11-03. Open zoom.com/en/trust
- Name “Zoom Trust Center”
Source: zoom.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai-2 | Public | full | 200 | 2026-10-28 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| products | Public | full | 200 | 2026-10-29 |
| subprocessors | Public | full | 200 | 2026-09-18 |
| tia-2 | Public | full | 200 | 2026-10-20 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-09-18 | EU data location Terms not stated → Paid upgrade Minimum plan set to Paid account; admins only Note rewritten | we read a better page | support.zoom.com |
Every reviewed change across the registry, newest first: vendor changes.