// Trust & Security Report
Zoom AI Companion
by Zoom Communications, Inc.
Zoom AI Companion and related AI products (ZoomMate agentic AI, My Notes AI note taker, AI Productivity Suite, Healthcare Clinical Notes, Zoom AI Studio) built on the Zoom Workplace unified communications platform
Certifications held
16
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.zoom.com“Zoom SOC 2 Type II report covering 10/16/2024 to 10/15/2025, along with the corresponding bridge letter”
Verify on trust.zoom.com“Zoom SOC 2 Type II report covering 10/16/2024 to 10/15/2025, along with the corresponding bridge letter”
Verify on trust.zoom.com“ISO 27001 certificate, which now includes Workvivo within its scope”
Verify on zoom.com“ISO 27001 Globally recognized security standard for implementing an ISMS ISO 27017 / 18 Globally recognized certification on privacy and cloud computing ISO 27701 Data privacy framework guiding with”
Verify on trust.zoom.com“Security Certifications and Attestations ISO/IEC 27001 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 SOC 2 Type 2 SOC 2 + HITRUST CSA STAR Attestation Cyber Essentials Cyber Essentials Plus ENS ISMAP”
Verify on zoom.com“place to comply with GDPR and other data protection/privacy regulations. Zoom’s ISO 27701 Compliance Zoom’s ISO 27701:2019 certification, which was issued on February 17, 2026, covers the following Zoom Zoom U”
Verify on trust.zoom.com“SO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 SOC 2 Type 2 SOC 2 + HITRUST CSA STAR Attestation Cyber Essentials Cyber Essentials Plus ENS ISMAP C5 IRAP ETDA GPA NRW FedRAMP Moderate GovRAMP DoD IL4 CJIS”
Verify on zoom.com“Meet Sign In Sign Up Free Compliance with HIPAA Zoom helps customers enable HIPAA compliant programs by executing a Business Associate Agreement (BAA) and safeguarding”
Verify on trust.zoom.com“Zoom for Government Platform Expands With Zoom AI Companion, Receives FedRAMP® JAB Authorization”
Verify on trust.zoom.com“IEC 27018:2019 ISO/IEC 27701 SOC 2 Type 2 SOC 2 + HITRUST CSA STAR Attestation Cyber Essentials Cyber Essentials Plus ENS ISMAP C5 IRAP ETDA GPA NRW FedRAMP Moderate GovRAMP DoD IL4 CJIS PCI DSS v4.0.1 FISC HDS TX”
Verify on zoom.com“BSI C5 listed as 'Security of cloud services that leverages internationally recognized security standards' under Commercial certifications.”
Verify on zoom.com“iRAP listed as 'Security controls assessment for Australian Government customers' under Commercial certifications.”
Verify on zoom.com“ISMAP listed as evaluating cloud service providers against Japanese government security requirements under Commercial certifications.”
Verify on zoom.com“HDS (Hébergeur de Données de Santé) listed as a French certification framework for secure hosting of health data under Commercial certifications.”
Verify on zoom.com“CJIS listed under Zoom for Government certifications as 'Compliance Assessment Report.'”
> Show 4 unconfirmed / not-held certifications
source: zoom.comNo public evidence found. ISO 42001 is not listed on the Zoom compliance page, trust center, or any vendor-domain blog post. Not mentioned in the AI Whitepaper security framework section.
source: trust.zoom.comNo public evidence found. Not listed on the Zoom compliance page or trust center.
source: trust.zoom.comThe vendor's pages state this for a different product or company, not for this product.
source: trust.zoom.comThe vendor's pages state this for a different product or company, not for this product.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
US default; EU data centers available for eligible paid accounts for meeting and webinar processing. AI Companion offers ZMO, ZM+, and Federated processing modes to support local hosting and data sovereignty requirements.
Zoom explicitly commits to not training on customer content. Privacy Statement states twice: 'Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content (such as poll results, whiteboard and reactions) to train Zoom's or its third-party artificial intelligence models.' During AI Companion use, content is processed by third-party LLM providers (including OpenAI and Anthropic) encrypted in transit; customers can opt into Zoom-hosted Model Only (ZMO) mode to avoid third-party LLM processing entirely. No tier difference in no-training commitment; applies to all account types.
// Security controls
Encryption in transit
TLS 1.2 minimum or AES-256 GCM between customers and Zoom, between Zoom services, and between Zoom and third-party AI model providers (OpenAI, Anthropic)
zoom.comEncryption at rest
AES-256 minimum for all customer content including AI Companion-generated data
zoom.comCustomer Managed Key (CMK)
Available as enterprise option; customers may supply own encryption key for content stored by Zoom
zoom.comEnd-to-end encryption
Available for Zoom Email (native email service) by default between Zoom Email users; optional for Zoom Meetings for paid accounts
zoom.comSubprocessor oversight
Subprocessors contractually obligated to meet Zoom DPA requirements and subject to annual security assessments as part of third-party risk management program
zoom.comEmployee data access controls
Zoom employees may not access or use Customer Content without authorization from the account owner or as required for legal, safety, or security purposes
zoom.com// Products & data scope
Data it handles: Meeting audio, video, transcripts, chat messages, whiteboards; processed by Zoom and optionally third-party LLM providers (OpenAI, Anthropic) for summarization, action items, and Q&A
Included at no extra cost for most paid Zoom plans. Covered under SOC 2 Type 2, ISO 27001, ISO 27701. HIPAA coverage requires BAA; explicit AI Companion scope under BAA should be confirmed with Zoom. FedRAMP JAB Moderate authorization for government use.
Data it handles: Meeting content, documents, calendar context; generates assets such as decks and documents using AI
Newer agentic product. Falls under Zoom AI Whitepaper security framework. Third-party LLM processing applies unless ZMO mode selected.
Data it handles: Virtual and in-person meeting audio, transcripts, and context
Available for virtual and in-person meetings and third-party platforms. No-training commitment applies. Encryption standards same as AI Companion.
Data it handles: Clinical conversation audio and transcripts for healthcare settings
Explicitly listed in ISO 27001 certificate scope. HDS certification relevant for French healthcare. BAA required for HIPAA compliance.
Data it handles: Customer-defined AI configurations and prompts
Listed in ISO 27001 certificate scope. Enterprise-tier product.
// What to watch
- HIPAA/AI Companion scope ambiguity: Zoom's HIPAA page confirms BAA availability and SOC 2 + HITRUST alignment but does not explicitly enumerate which AI Companion features are within BAA scope. Healthcare organizations must confirm AI feature coverage directly with Zoom before deploying in PHI contexts.
- Third-party LLM data flow: Customer content is routed to third-party AI model providers (OpenAI, Anthropic) during AI Companion processing. Although encrypted in transit (TLS 1.2 minimum / AES-256 GCM), customers who require data to remain exclusively on Zoom infrastructure must opt into ZMO mode, which is not the default.
- No ISO 42001 or CSA STAR AI: Despite a significant AI product portfolio, Zoom holds no publicly evidenced AI-specific governance certification (ISO 42001, CSA STAR AI). This is a gap compared to some competitors and relevant for AI-risk-conscious procurement.
- Terms of Service date: The base ToS shown is effective August 11, 2023. AI terms and the no-training commitment have been updated since then (Privacy Statement last updated February 2, 2026 contains the explicit no-training language). Procurement teams should confirm the current governing ToS version is signed.
// At a glance
Pricing model
Subscription (SaaS); AI Companion included at no extra cost for most paid Zoom Workplace plans. Free tier does not include AI Companion.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Zoom Communications, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.zoom.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.