Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document lists the outside companies that handle your data when you use Zoom, and sets rules for how those companies must protect it. Your live meeting traffic, cloud recordings, and transcriptions flow through major cloud providers like AWS and Google, and if you use Zoom's AI features, companies like OpenAI, Anthropic, Google Cloud, and AWS may also process your meeting content. Zoom contractually requires all of these sub-processors to follow the same data protection standards Zoom itself must meet.
This document establishes Zoom's sub-processor framework, identifying the third-party entities that process personal data on behalf of Zoom's customers and the contractual obligations governing those arrangements. Key cloud infrastructure providers—AWS, Google Cloud Platform, and Oracle—process real-time meeting and webinar traffic, cloud recordings, and transcriptions. When AI features are enabled, AI providers including AWS, Google Cloud, Anthropic, and OpenAI may process Customer Content and context. Zoom requires all sub-processors to satisfy obligations equivalent to those Zoom itself bears under its Data Processing Agreement, and to process personal data solely per Customer instructions as relayed by Zoom. Intra-group Zoom transfers are governed by a data transfer agreement incorporating EU Standard Contractual Clauses, and Stripe processes payment and transaction data for Zoom Events.
As an individual user, your real-time meeting traffic, cloud-saved recordings, and transcriptions are processed by third-party cloud providers including AWS, Google Cloud Platform, and Oracle. If AI features are enabled on your account, your Customer Content and context may additionally be processed by Anthropic, OpenAI, and Google Cloud. Payment and transaction data—including bank account and card details—is processed by Stripe for Zoom Events transactions. Zoom requires all sub-processors to handle personal data only according to Customer instructions and to meet equivalent data protection standards to those in Zoom's own Data Processing Agreement. Notice of new sub-processors is provided to the Customer's account owner to the extent required by contract, and updates are posted on Zoom's sub-processor page.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Zoom has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle All Zoom Group affiliates bound by intra-group data transfer agreement and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.