Executive Summary
AI-generated analysis for Zoom
Zoom (zoom.us) is a globally recognized enterprise collaboration platform assessed at Risk Tier 3 (Moderate Risk) with a 99% confidence score. At a high data access level, this assessment reflects both Zoom's substantial compliance posture and several unresolved technical and transparency gaps that warrant attention before or during onboarding. Zoom presents a number of meaningful positive signals. The domain carries a clean threat reputation — not listed on SURBL, Spamhaus DBL, or any active malware blacklists — and Malware detection service reports no threats. Infrastructure exposure is minimal, with only standard web ports (80 and 443) observed and no known CVEs on the assessed IP. Zoom's published privacy policy explicitly commits that customer audio, video, chat, screen sharing, and attachments are not used to train AI models, which is a meaningful data protection signal for organizations deploying AI-assisted meeting features. Zoom's compliance page lists an extensive range of certifications including SOC 2 Type II, ISO 27001, ISO 27017, HITRUST, PCI DSS, FedRAMP Moderate, HIPAA, GDPR, CSA STAR, and Cyber Essentials — all vendor-attested and representing a credible, broad compliance program for an enterprise SaaS vendor. Several concerns require attention:
Key Findings
- The marketing site (zoom.us) received a HTTP security scanner grade of D (35/100), with multiple HTTP security headers absent, including Content-Security-Policy, HSTS, and X-Frame-Options. While the application domain (app.zoom.us) may differ, this gap is notable.
- All 10 certifications listed on Zoom's compliance page are vendor-attested only; no independent registry confirmation was returned for FedRAMP, HITRUST, ISO 27001, or PCI DSS during this assessment cycle. Compliance teams should obtain primary documentation directly.
- Historical archived media includes aged but meaningful incidents: a claimed breach with accounts alleged for sale (2024), NYC school bans due to privacy concerns (2020), and government bans citing security and geopolitical concerns (2020). These are downgraded for age but document Zoom's historical security scrutiny.
- Regulatory risk is emerging: Hacker News discussions with high community engagement (up to 1,149 points) document France's 2026 initiative to replace Zoom and other US-based tools for government use, signaling potential future deployment restrictions in regulated or government-adjacent environments.
- Zoom's published subprocessor page could not be automatically parsed, leaving third-party supply chain visibility incomplete for this assessment cycle. Overall, Zoom is a well-established, broadly compliant enterprise platform with a mature security program, but the combination of unverified certifications, a weak marketing-site security header score, historical security incidents, and active geopolitical regulatory signals places it at Tier 3. A conditional approval is appropriate, subject to receipt of current compliance documentation.
Independence Statement
All evidence in this report was independently sourced by ThirdProof from external data providers, public registries, and open-source intelligence without vendor participation or input.