Zoom AI Companion

Zoom states it does not use audio, video, chat, screen sharing, attachments or other communications-like customer content to train its own or third-party AI models.

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

OpenAI is registered as an Intelligent Features Service Provider that may process customer content and context when AI features are enabled, in the US and EU under SCCs.

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

Not found in the public sources scanned — ask the vendor directly.

Confirm in writing: Ask the vendor to state this in writing before signing.

Zoom's privacy statement says plainly that it does not use audio, video, chat, screen sharing, attachments or other communications-like customer content to train its own or third-party AI models.

This is the question buyers ask first, and Zoom has public history on it. The commitment is stated without a tier carve-out or a settings condition, which is stronger than most comparable vendors offer — and being in the privacy statement, it is the version Zoom is held to.

OpenAI and Anthropic are both registered as Intelligent Features Service Providers that may process customer content and context, with processing locations and SCCs stated.

Naming model providers in the subprocessor register puts them inside the DPA's change-notification machinery, so the AI supply chain can be tracked through the agreement rather than by watching a webpage.

Zoom publishes AI Companion whitepapers ("AI Companion security and privacy", "AI Companion data privacy lifecycle") and a legal and compliance guide, none of which were retrievable here. The evidence above is organisation-wide and applies to AI Companion, but nothing product-specific was collected.

The organisation-wide no-training commitment is the load-bearing one and it covers the product. What is missing is AI Companion's own retention periods, human-review practice and admin controls — needed to operationalise a deployment, not to decide whether the posture is sound.

Question for vendor: Please provide the AI Companion data privacy lifecycle whitepaper, covering retention periods and whether any human review of AI Companion content occurs.

The register conditions each AI provider's processing on AI features being enabled, so content reaches OpenAI or Anthropic only on a customer decision.

It supports a staged rollout: AI processing can be held off while governance approval is obtained, without leaving the platform.

The vendor's own materials name OpenAI as the model provider, but DNS, certificate, or HTTP evidence points to Google in that role instead.

A supply-chain claim that doesn't match what is technically observable is a disclosure question worth raising directly, not assuming either side is wrong.

Question for vendor: Can you confirm whether OpenAI or Google is the actual model provider?

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft Azure as a platform provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Microsoft Azure appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Intercom as a application builder. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Intercom appears to be involved as a application builder: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.