Zoom AI Companion for Contact Center and AI Expert Assist Security and Privacy

This Whitepaper relates to two AI-powered features available for Zoom Contact Center (ZCC) – Zoom AI Companion for Contact Center and Zoom AI Expert Assist – not to other AI products or services offered by Zoom. It describes security and privacy features as of the date of publication. The features described herein may evolve as we further develop AI capabilities.

Zoom CX

In this whitepaper, we’ll cover

Zoom AI for Customer Experience Products

Jump to

Our commitment to responsible AI

Jump to

Data flow and transmission to third parties

Jump to

Data processing, storage, and retention

Jump to

Content protected by Customer Managed Key

Jump to

Customer Experience Products AI Features

Jump to

Putting you in control of AI capabilities

Jump to

Data protection

Jump to

Secure development of generative AI features

Jump to

Generative AI Model Security

Jump to

Security Assessments

Jump to

Vulnerability Disclosure Program

Jump to

Zoom AI Compliance

Jump to

Changelog

Jump to

Zoom AI for Customer Experience Products

Zoom Contact Center licenses include Zoom AI Companion for Contact Center at no additional cost to the paid Zoom Contact Center services assigned to your Zoom account. This provides Zoom Contact Center users with a baseline level of individual AI-powered tools that are aimed at improving productivity. For Zoom Contact Center users, AI Companion for Contact Center summarizes customer conversations, generates follow-up tasks following engagements, and highlights live customer sentiment and speech analytics.

 

Zoom AI Expert Assist intelligently draws information from third-party systems, knowledge bases, and more to deliver real-time assistance, empowering your agents to provide their best support and resolve more complex issues. AI Expert Assist surfaces personalized information from CRMs and other custom apps directly in agent desktop to help agents, intelligently retrieves best responses from knowledge bases, suggests next-best actions for agents to take, and automates wrap-up with a one-click, post-call summary to save time and ensure consistent quality.

 

For supervisors, AI Expert Assist directs supervisor attention where it’s needed most by leveraging AI-driven analytics to automatically surface critical engagements. It detects sentiment shifts, signs of customer frustration, and agent behavior patterns—providing context to resolve issues efficiently. This saves supervisors from passively monitoring queues and empowers them to proactively reduce customer experience risks and improve CSAT.

 

Zoom Virtual Agent continues to advance enterprise self-service by enabling efficient, intelligent support across both voice and chat channels. Built on Zoom’s AI-first platform and designed with an agentic AI framework, virtual agents are enabled to operate with greater autonomy, so they can understand customer intent, make contextual decisions, and execute multi-step tasks with minimal human intervention.
Through Zoom AI Studio, businesses can configure and deploy tailored virtual agents using intuitive, natural-language-driven workflows. This helps reduce reliance on IT resources, shorten deployment timelines, and support a seamless, branded customer experience. By combining proactive issue resolution with intelligent task execution, Zoom Virtual Agent helps organizations improve operational efficiency and elevate the overall quality of customer service.

 

Zoom Workforce Management (Zoom WFM) provides a modern, AI-driven approach to workforce planning and scheduling. By leveraging intelligent forecasting, Zoom WFM enables organizations to accurately predict staffing needs, create optimized schedules efficiently, and make real-time adjustments based on fluctuating demand. The solution replaces manual, spreadsheet-based processes with an integrated system that streamlines operations and supports service-level adherence. Seamless integration with existing tools allows managers to maintain visibility and control across workforce planning activities. Zoom WFM is designed to reduce operational costs, enhance agent satisfaction, and improve service performance through efficient, fair, and data-informed scheduling practices.

 

Zoom Quality Management (Zoom QM) is designed to support quality assurance leaders in building scalable, data-driven programs that improve customer experience across communication channels. By automating interaction scoring and providing AI-powered insights, Zoom QM reduces reliance on manual review processes and helps identify performance gaps and coaching opportunities with greater consistency and precision. The solution delivers visibility into agent performance and integrates quality insights directly into coaching workflows, enabling more effective and efficient performance management. Native to the Zoom platform, Zoom QM helps organizations move beyond anecdotal feedback and toward actionable, real-time intelligence—supporting continuous CX improvement and aligning quality efforts with broader business goals.

Our commitment to responsible AI

Zoom is committed to developing AI responsibly, with security and privacy at the core of the generative AI capabilities it provides to its customers. AI Companion for Contact Center and AI Expert Assist are built on top of our current commitments to security and privacy across the Zoom platform. Zoom recognizes that generative AI brings an evolving set of risk considerations for its customers, and the company is committed to prioritizing transparency and customer choice as it brings generative AI features to market.
In line with these commitments, Zoom has announced that it does not use any customer audio, video, chat, screen sharing, attachments, or other communications-like customer content (such as poll results, whiteboard, and reactions) to train Zoom’s or its third-party artificial intelligence models.
Zoom provides controls at the account, queue, and user levels, enabling administrators with granular controls to determine when and where to incorporate AI Companion for Contact Center and/or AI Expert Assist into their ZCX workflow.  For example, admins can choose to limit capabilities to only a specific set of queues.

Data Flow

Data Flow and transmission to third parties

Data used by AI Companion for Contact Center and AI Expert Assist is sent from the user to Zoom-hosted and/or third-party generative artificial intelligence models.  Customer data in transit is encrypted between customers and Zoom, Zoom internal services, and between Zoom and its third-party models.  Customer data is also encrypted at rest within Zoom’s platform. Communications sent over the Public Switched Telephone Network (PTSN) are not encrypted until reaching a Zoom gateway.

Data Flow Diagrams

The following diagrams are examples of the data flow through Zoom systems and, where relevant, to third-party models:

Data Flow

Data Flow

Data Flow

Third-party subprocessors

As part of Zoom’s federated approach to AI, artificial intelligence models from third parties, such as Anthropic and OpenAI, may be used for certain AI Companion features alongside Zoom’s artificial intelligence models to provide high-quality results. Zoom uses the Perplexity service to provide web content search results for AI Companion.

 

Zoom requires its subprocessors to satisfy obligations equivalent to those outlined in Zoom’s Data Processing Agreement. Zoom’s subprocessors are subject to security assessments on at least an annual basis as part of Zoom’s third-party risk management program. Zoom’s third-party risk management controls are assessed by independent audit firms in many of its security certifications and attestations, which are available to customers on Zoom’s Trust Center.

Data processing, storage, and retention

Zoom does not use any customer audio, video, chat, screen sharing, attachments, or other communications-like customer content (such as recordings, transcripts, and survey results) to train Zoom’s or its third-party artificial intelligence models.
Zoom AI inside customer experience products must use certain content in order to provide the services. For instance, Zoom AI Companion for Contact Center, Zoom Virtual Agent and Zoom AI Expert Assist process chat messages or transcripts to provide engagement summaries.

Consistent with Zoom’s Privacy Statement, Zoom employees do not access or use customer content including audio, video, files, messaging, or email contents, or content generated by the Zoom CX AI products, unless authorized by the account owner hosting the Zoom product or service where the Customer Content was generated, or as required for legal, safety, or security reasons.

In general, Zoom stores and retains customer content and personal data for as long as required to engage in the uses described in its Privacy Statement, unless a longer retention period is required by applicable law. Zoom retains the content used to provide the service — as described herein — for up to 30 days to provide the service and for debugging purposes, and Zoom may also retain for a longer period content that is flagged for trust and safety purposes. In the context of data retention and processing, “trust and safety purposes” refers to measures taken to protect the safety and integrity of a service and its users. This involves retaining certain data for a period of time to help prevent abuse and misuse. Additional information on Zoom’s Trust and Safety processes may be found in Zoom's Safety Center. In addition, certain outputs may be stored in accordance with the customer’s retention settings or policies, as described in the tables below.
If any AI feature within customer experience products relies on a third-party artificial intelligence model, pursuant to Zoom’s contracts, the third-party model provider may retain content used to provide the service for trust and safety purposes within the U.S. for up to 30 days, unless a longer retention period is required by applicable law.
The next section summarizes the models used for Zoom CX products as of the publication date of this whitepaper, and the specific storage and retention settings for the content used to provide each feature.

 

IMPORTANT NOTE: Zoom offers a Zoom–hosted Models Only option, which means that data will not be sent to third-party models for processing. To enable this feature please reach out to your account team or log a support ticket.

Content protected by Customer Managed Key

Organizations with higher compliance needs can license Zoom Customer Managed Key (included in Enterprise Plus). That allows them to configure what types of assets get encrypted with their own key when stored permanently in the cloud. The list of potential assets depends on what Zoom services the organization uses. For example, If cloud meeting recordings are enabled and the meeting organizer is a licensed CMK user and records the meeting, the associated files are encrypted, even if some of the meeting attendees are not CMK users. While most services follow the same approach, there are some specifics which apply to certain services as described in the following list (with their Service ID as it appears in the encryption context). If you enable a CMK eligible feature for any of the customer experience products and enable CMK encryption for a related type of asset, then Zoom will encrypt all related assets including the AI generated ones, but if the feature uses a third-party model provider, that provider may only encrypt the data they receive with regular encryption.

 

For the latest CMK support information, please visit  Zoom Support Site.

Customer Experience Products AI Features

Below is a summary of each AI feature as of the publication date of this whitepaper. This includes the content used or generated by the feature, where the model provider processes and stores the content, and if applicable, the customer storage location and relevant retention settings and policies that apply in addition to the model provider’s 30-day retention period after providing the service.

AI Companion for Contact Center

Engagement preview Engagement preview Engagement summary Engagement summary Sentiment analysis Sentiment analysis Follow-up task Follow-up task

Engagement preview

Uses generative AI to summarize the customer’s previous conversation before the agent accepts the engagement.

Minimum recommended client version

5.16.0

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Engagement summary (output)

Model provider - Data processing/storage location

Engagement summary

Agents can see the AI-generated summary with keywords highlighted

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Engagement summary (output)

Model provider - Data processing/storage location

Sentiment analysis

Analyze customer sentiment in real time.

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Sentiment evaluation (output)

Model provider - Data processing/storage location

Follow-up task

Create action items for agents to follow up on after completing an engagement

Minimum recommended client version

N/A

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Follow-up tasks (output)

Model provider - Data processing/storage location

Customer storage location

Customer’s provisioned data center

Customer retention controls and additional information

Follow up tasks are stored until the engagement history is purged by authorized users

AI Expert Assist

Knowledge base retrieval Knowledge base retrieval Information retrieval Information retrieval Smart Notes Smart notes Recommended disposition Recommended disposition Auto translate for messaging Auto translate for messaging Next best action Next best action Sentiment analysis Top Engagement Escalation

Knowledge base retrieval

Automatically searches and displays the relevant knowledge base to the agent.

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Recommended knowledge article(s) (output)

Model provider - Data processing/storage location

Information retrieval

Retrieves relevant customer information from third-party systems.

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • List of intents (input)

Model provider - Data processing/storage location

Smart Notes

Create a concise summary of the agent's engagement with the customer.

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Summary note draft (output)

Model provider - Data processing/storage location

Customer storage location

Customer’s provisioned data center

Customer retention controls and additional information

Saved notes are stored until the engagement history is purged by authorized users

Recommended disposition

Automatically set the disposition of the engagement

Minimum recommended client version

N/A

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • List of disposition codes (input)
  • Recommended disposition (output)

Model provider - Data processing/storage location

Customer storage location

Customer’s provisioned data center

Customer retention controls and additional information

Dispositions are stored until the engagement history is purged by authorized users

Auto translate for messaging

Allow users automatically translate all inbound messages to their language and translate all outbound messages to consumers language

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Chat message text (output)

Model provider - Data processing/storage location

Next best action

Provides recommended actions to guide the Agents to maximizing business outcomes during customer interactions

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • List of intents (input)
  • Identified intent(s) (output)

Top Engagement Escalation

Supervisors can leverage artificial intelligence to automatically analyze and identify engagements that require immediate attention across multiple queues.

Minimum recommended client version

N/A

Content used or generated

  • Chat message text (input)

Model provider - Data processing/storage location

*Not Available for SA

Zoom Virtual Agent - Traditional Chat

Intent Intent Knowledge base Knowledge base Chatbot admin tasks Chatbot admin tasks Chatbot run time Chatbot run time Reporting Reporting

Intent

Using LLM to process intent tasks including:

  • Detection
  • Training phrase generation
  • Intent generation
  • Auto coach(Training phrase suggestion)
Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Admin Instructions in text format (input)
  • Intent Results (Output)

Model provider - Data processing/storage location

*LLM features Not Available for SA

Knowledge base

  • Answer Summary

Use LLM to generate query response from knowledge base articles

  • Query Generation

Use LLM to generate sample queries for coaching task

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Knowledge base articles (input)
  • Summary and Sample queries (Output)

Model provider - Data processing/storage location

*LLM features Not Available for SA

Chatbot admin tasks

  • Flow generation
  • Widget generation
  • LLM Collect input widget

Use LLM to complete administrative tasks

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Admin instructions in text format (input)
  • Bot flow and Widget (output)

Model provider - Data processing/storage location

*Not Available for SA

Chatbot run time

  • Use LLM to detect intent and Use LLM to generate response based on knowledge
  • Use LLM to gather user input in order to execute automatic workflow
Minimum recommended client version

N/A

Content used or generated

  • Chat message text (input)
  • Value for variables (output)

Model provider - Data processing/storage location

*LLM features Not Available for SA

Customer storage location

Customer’s provisioned data center

Customer retention controls and additional information

Follow up tasks are stored until the engagement history is purged by authorized users

Reporting

Use LLM to generate topics from user queries in query insights/ engagement logs for advanced analytics to identify opportunities to optimize performance

Minimum recommended client version

N/A

Content used or generated

Model provider - Data processing/storage location

*LLM features Not Available for SA

Customer Retention Controls and Additional Information (if applicable)

Topics are stored until the engagement history is purged by authorized users

Agentic Zoom Virtual Agent - Voice and Chat

Voice agent only Voice agent only Knowledge base Knowledge base Runtime Runtime Smart Notes Skills Reporting Reporting

Voice agent only

Voice Actor (TTS)

Minimum recommended client version

N/A

Content used or generated

  • Texts (input)
  • Voice Response (output)

Model provider - Data processing/storage location

  • OpenAI - US,EU
  • Eleven Labs - US,EU

Knowledge base

Use LLM to generate query responses from knowledge base articles

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Audio/Chat transcript (input)
  • Knowledge base articles (input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Runtime

Use LLM to analyze customer input and provide responses

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Transcript (input)
  • Virtual Agent Instructions (Input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Skills

Use LLM to invoke skills and follow the predefined instructions to auto complete tasks

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Transcript (input)
  • Skills/Tools Instructions (input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Reporting

Use LLM to generate topics from user queries in query insights, overview and knowledge bases and for engagement logs for advanced analytics to identify opportunities to optimize performance

Minimum recommended client version

N/A

Content used or generated

Customer Retention Controls and Additional Information (if applicable)

Topics are stored until the engagement history is purged by authorized users

Workforce Management

Short term forecast Short term forecast Long term forecast Long term forecast

Short term forecast

Generates a forecast model from historical contact center traffic data and uses this to predict future needs

Minimum recommended client version

N/A

Content used or generated

  • Historical interaction counts and average handle time (input)
  • Traffic Forecast and Staffing Recommendation (Output)

Model provider - Data processing/storage location

  • Facebook Prophet - US

Long term forecast

Generates a forecast model for 6-24 months in the future

Minimum recommended client version

N/A

Content used or generated

  • Historical interaction counts and average handle time (input)
  • Staffing requirements (Output)

Model provider - Data processing/storage location

  • Facebook Prophet - US

Quality Management

Speaker metrics Speaker metrics Interaction analytics Interaction analytics Ask anything Ask anything Auto QM Auto QM AI topic detection AI topic detection

Speaker metrics

Uses AI to analyze the agent’s speech patterns

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Speaker Metrics (output)

Model provider - Data processing/storage location

Zoom - Customer’s provisioned data center

Customer Retention Controls and Additional Information (if applicable)

  • Analytics are stored until the transcript/recording files are purged

Interaction analytics

Supervisors get an analysis of the interaction transcript giving summary, engagement/sentiment, next steps, callouts, and topics.

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Interaction Summary (Output)
  • Engagement and Sentiment (Output)
  • Next Steps (Output)
  • Topics (Output)

Model provider - Data processing/storage location

Customer Retention Controls and Additional Information (if applicable)

  • Analytics are stored until the transcript/recording files are purged

Ask anything

Use LLM to answer questions about conversation transcripts

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Ask Anything answers (output)

Model provider - Data processing/storage location

  • OpenAI - US
  • Anthropic - US,EU
  • ZMO - Available

*Not Available for SA

Customer Retention Controls and Additional Information (if applicable)

  • Analytics are stored until the transcript/recording files are purged

Auto QM

Use LLM to fill out scorecards based on interaction transcripts

Minimum recommended client version

N/A

Zoom-hosted models only (ZMO) eligible

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Scorecard response and justification (output)

Model provider - Data processing/storage location

  • OpenAI - US
  • Anthropic - US,EU
  • ZMO - Available

*Not Available for SA

Customer Retention Controls and Additional Information (if applicable)

  • Analytics are stored until the transcript/recording files are purged

AI topic detection

Use LLM to detect topics of conversation from agent/consumer interactions

Minimum recommended client version

N/A

Content used or generated

  • Chat message text (input)
  • Audio transcript (input)
  • Topic list (output)

Stored in - Zoom - Customer’s provisioned data center

Model provider - Data processing/storage location

  • OpenAI - US
  • Anthropic - US,EU
  • ZMO - Available

*Not Available for SA

Customer storage location

Customer’s provisioned data center

Customer Retention Controls and Additional Information (if applicable)

  • Analytics are stored until the transcript/recording files are purged

Agentic Zoom Virtual Agent - Voice and Chat

Voice agent only Voice agent only Knowledge base Knowledge base Runtime Runtime Smart Notes Skills Reporting Reporting

Voice agent only

Voice Actor (TTS)

Minimum recommended client version

N/A

Content used or generated

  • Texts (input)
  • Voice Response (output)

Model provider - Data processing/storage location

  • OpenAI - US,EU
  • Eleven Labs - US,EU

Knowledge base

Use LLM to generate query responses from knowledge base articles

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Audio/Chat transcript (input)
  • Knowledge base articles (input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Runtime

Use LLM to analyze customer input and provide responses

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Transcript (input)
  • Virtual Agent Instructions (Input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Skills

Use LLM to invoke skills and follow the predefined instructions to auto complete tasks

Minimum recommended client version

N/A

Content used or generated

  • Consumer message (input)
  • Transcript (input)
  • Skills/Tools Instructions (input)
  • Virtual Agent Responses (output)

Model provider - Data processing/storage location

  • Anthropic - US,EU
  • OpenAI - US

Reporting

Use LLM to generate topics from user queries in query insights, overview and knowledge bases and for engagement logs for advanced analytics to identify opportunities to optimize performance

Minimum recommended client version

N/A

Content used or generated

Customer Retention Controls and Additional Information (if applicable)

Topics are stored until the engagement history is purged by authorized users

Putting you in control of AI capabilities

Putting you in control of AI capabilities

Zoom is committed to providing transparency and choice when it comes to enabling and using ZCC features. Account administrators and users are provided with controls for both AI Companion for Contact Center and AI Expert Assist features. Zoom is continually working to enhance its platform and educate users on its new features. Currently, users will see certain in-product notifications, which may be updated over time.

  • Account administrator controls

    For AI Companion for Contact Center, account owners and administrators can control each feature at the account and queue levels. When enabled at the account level, all agents will have access to AI Companion for Contact Center features. If set at the queue level, only agents belonging to that queue will have access. 

    Similarly, AI Expert Assist can be controlled at the account and queue levels. Because AI Expert Assist is an add-on package requiring an additional license for Essentials and Premium plans, it can also be controlled at the user level on those accounts. Account owners and administrators can select which users can use AI Expert Assist by assigning licenses to individual agents.

Data protection

Customer data, including customer content, is encrypted in transit between customers and Zoom, where supported by the user’s connection method and as stated in Zoom's support articles, between Zoom services, and between Zoom and its third-party subprocessors, including its third-party AI model providers (e.g., OpenAI and Anthropic), using Transport Layer Security (TLS) 1.2 or AES 256-bit GCM. Customer data, including customer content, that is either generated by or used to provide the contact center AI features are encrypted at rest using a minimum Advanced Encryption Standard (AES) 256-bit encryption.

 

Access to customer data and content used to provide AI capabilities is role-based and restricted based on least privilege, in accordance with Zoom’s access control policies and standards. Controls are in place to prevent Zoom employees from accessing customer content, including meeting, webinar, chat, or email content (specifically, audio, video, files, in-meeting whiteboards, messaging, or email content), Zoom CX content, or any content generated or shared as part of other collaborative features (such as out-of-meeting whiteboards), unless authorized by the account owner or administrator of the account hosting the Zoom product or service where the customer content was generated, or as required for legal, safety, or security reasons. Zoom’s access to customer data and content is logged and monitored for suspicious activity or unauthorized access. Zoom’s data access controls are assessed by independent audit firms where indicated in our security certifications and attestations, available to our customers on Zoom’s Trust Center.

Secure development of generative AI features

Zoom’s secure software development lifecycle (SDLC) is a set of practices and processes designed to integrate security into each phase of the software development lifecycle. Zoom’s secure software development controls are assessed by independent audit firms as indicated in Zoom’s security certifications and attestations, which are available to customers on Zoom’s Trust Center. Zoom Contact Center AI features follow Zoom’s standard secure SDLC process, which includes the following:

Zoom’s Engineering Security team is engaged during the design phase when a feature is being conceptualized so that key security controls can be built into the requirements. Security design reviews, which include threat analysis, are performed to identify potential threats and mitigations. Zoom maintains vulnerability remediation standards governing the remediation or mitigation of security vulnerabilities identified during the security design review.

Peer code reviews are a key element of Zoom’s secure software development lifecycle and are enforced in Zoom’s software development platform. In addition to peer code reviews, high-risk areas identified during the security design review require secure code reviews.

Zoom utilizes static analysis security testing (SAST) tools to scan its source code for coding errors and common security vulnerabilities, including Open Web Application Security Project’s (OWASP) Top 10 and National Vulnerability Database (NVD). Zoom maintains vulnerability remediation standards governing the remediation or mitigation of security vulnerabilities identified through static analysis testing.

Zoom utilizes dynamic analysis security testing (DAST) tools to identify common security vulnerabilities, including OWASP’s Top 10 and NVD. Zoom maintains vulnerability remediation standards governing the remediation or mitigation of security vulnerabilities identified through dynamic analysis testing.

Where open source software (OSS) is used, the OSS package must undergo Zoom’s third-party code review process, which includes a set of OSS evaluation criteria and scanning for common security vulnerabilities. Zoom maintains vulnerability remediation standards governing the remediation or mitigation of security vulnerabilities identified through third-party OSS scanning tools.

Security approval is required for deployment of new products and features, including Zoom AI Companion for Contact Center and Zoom AI Expert Assist. Zoom has a dedicated Release Security Assurance function responsible for scanning Zoom client builds prior to release. The final Zoom client build scans are designed to identify potential vulnerabilities or malicious content, and the build is digitally signed to maintain its integrity and authenticity.

Generative AI model security

In addition to the steps outlined in Zoom’s secure SDLC above, models hosted by Zoom are subject to security reviews to assess security threats specific to generative AI models. The generative AI model review includes commonly known LLM model vulnerabilities, in line with OWASP’s Top 10 for LLMs and other secure AI frameworks. Vulnerabilities identified in the generative AI security reviews must be remediated in accordance with Zoom’s vulnerability remediation standards.

 

Zoom’s third-party subprocessors are subject to security assessments on at least an annual basis as part of Zoom’s third-party risk management program. Zoom’s third-party risk management controls are assessed by independent audit firms as indicated in Zoom’s security certifications and attestations, which are available to customers on Zoom’s Trust Center.

Security assessments

Zoom has a dedicated offensive security team that performs ongoing vulnerability research and red team exercises across Zoom’s platform, including Zoom AI Companion for Contact Center and Zoom AI Expert Assist features. In addition to Zoom’s dedicated offensive security team, penetration tests are performed by an independent third party on at least an annual basis.

Vulnerability disclosure program

Zoom believes that the independent security research community can provide key contributions to the security of Zoom’s products. Zoom maintains a vulnerability disclosure program as well as a Bug Bounty program through HackerOne that incentivizes security researchers to responsibly report potential security vulnerabilities so Zoom can fix them and help keep its users safe.

Zoom CX AI Compliance

Zoom CX AI adheres to the same security and compliance requirements as the primary Zoom AI product within which it is incorporated. Both Zoom CX and AI Companion are ISO 27001, ISO 27701, and ISO 27017/18 certified and are also included within the scope of Zoom’s SOC 2 Type 2 report, available on Zoom’s Trust Center.

Changelog

Version

Published on

Change type

Change

V. 1.0

4/2024

V. 2.0

7/29/2025

Add

Global cluster information (availability/restriction)
Workforce Management (WFM)
Quality Management (QM)
Zoom Virtual Agent (ZVA)
Customer Managed Key (CMK)

V. 2.0

7/29/2025

Updated

Visual design