Zoom AI Vendor Risk Profile
Video communications platform offering AI Companion for meeting summaries, smart recording chapters, real-time transcription, email and chat composition, and workflow automation across Zoom Workplace.
Risk overview
Risk score: 27/100
Risk tier: Moderate
Safety rating: 73/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 28/100 |
| IP Exposure | 31/100 |
| Jurisdiction | 13/100 |
| Security | 30/100 |
| Regulatory Compliance | 40/100 |
| Transparency | 35/100 |
| Business Stability | 11/100 |
| Dependency Chain | 28/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Recommended
Zoom AI Companion benefits from Zoom's post-2020 investment in enterprise security and compliance. It ships without retention of meeting content, with HIPAA BAA coverage for healthcare, and with FedRAMP Moderate via Zoom for Government. The AI Companion is bundled at no extra cost with eligible paid plans, which is unusual in the AI vendor market.
Bottom line: Bundled AI Companion plus mature compliance stack makes this a low-friction recommendation for Zoom customers.
Strengths
- No training on audio, video, chat, or screen-sharing content
- AI Companion included at no additional charge on eligible paid plans
- HIPAA BAA available with Zoom for Healthcare covering AI features
- Full compliance stack: SOC 2 Type II, ISO 27001/27017/27018/27701, FedRAMP Moderate
- No content retention after AI feature generates output
Concerns
- 2020-era security incidents (Zoombombing, encryption claims) still color perception despite since-improved controls
- AI Companion quality trails specialized meeting intelligence tools like Gong and Otter on depth
- Consumer and free-tier Zoom has weaker data handling than paid enterprise plans
Best for
- Enterprises already standardized on Zoom wanting bundled meeting AI at no added cost
- Healthcare organizations needing HIPAA-eligible meeting summarization
- Public sector workloads on Zoom for Government requiring FedRAMP coverage
- Organizations wanting AI features without a separate vendor procurement
Avoid if
- You need deep revenue-intelligence AI (Gong is stronger)
- Your primary collaboration platform is Microsoft Teams or Google Meet
Citations
- Data Handling — Data Retention Period
Zoom AI Companion does not retain meeting content after the AI feature generates output; admins configure retention for meeting summaries separately.
- Data Handling — Hipaa Baa Available
Zoom offers HIPAA Business Associate Agreements and Zoom for Healthcare plans with BAA coverage including AI Companion features.
- Data Handling — Trains On User Data
Zoom does not use audio, video, chat, screen sharing, attachments, or other customer content to train Zoom or third-party AI models.
- Ip Profiles — User Owns Outputs
Customer retains all ownership rights in Customer Content, including AI Companion outputs derived from Customer Content.
- Jurisdiction Profiles — Incorporation Country
Zoom Communications, Inc. is a Delaware corporation headquartered in San Jose, California (SEC Form 10-K).
- Security Compliance — Fedramp Authorized
Zoom for Government holds FedRAMP Moderate authorization and is on the StateRAMP authorized list.
- Security Compliance — Iso 27001
Zoom holds ISO/IEC 27001, 27017, 27018, and 27701 certifications.
- Security Compliance — Soc2 Type2
Zoom maintains SOC 2 Type II attestation covering Zoom Meetings, Phone, Team Chat, and AI Companion.