Zoom Workplace

1 Residency and jurisdiction Score 1 · Weak

Rubric condition applied: "Residency is claimed but not committed in the contract, or processing relies on third countries with an adequacy decision as the only safeguard." Zoom offers something real and opt-in: paid EEA customers can select certain Meetings, Webinars and Team Chat data for EEA storage in Frankfurt. Two readings hold the score at 1. The commitment is a settings selection rather than a contract clause, and the covered list is partial by design: Account Data and Diagnostic Data are excluded and remain in the US regardless of the selection, and selected data may transit network links in non-opted data centres. Above the selection sits the same reach as the rest of the default stack: Zoom's own transparency report lists the CLOUD Act as a channel through which content can be demanded. The residency option exists, is documented, and changes the score's frame rather than its level.

2 Encryption and key control Score 2 · Partial

Rubric condition applied: "Encryption at rest and in transit with vendor-held keys; no customer rotation and no access transparency." Default Zoom meetings run on 256-bit AES-GCM with keys generated and managed by Zoom's servers. The end-to-end encryption option is genuine: with E2EE enabled, Zoom's servers become oblivious relays and never see the keys. It is opt-in per meeting, and enabling it disables the features organisations buy the product for: cloud recording, live transcription, breakout rooms, polling, join-before-host. The recorded meeting, the artefact that matters most to a compliance file, cannot be end-to-end encrypted. The option is recorded; its cost in functionality is part of the evidence.

3 Exit terms Score 2 · Partial

Rubric condition applied: "Export available but partial, in proprietary or lossy formats, or with fees and retention that impose real cost." The contract gives the customer 30 calendar days after termination to retrieve Customer Content, after which it is deleted under scheduled protocols; recordings survive a cancelled paid subscription for the same 30 days. The exports exist but are per-item or per-API: recordings download individually in standard formats, chat exports are bounded, and bulk retrieval at organisational scale means custom scripting against the API, which practitioners have resorted to publishing for each other. Two clauses tell the tenor of the relationship: Zoom may terminate the agreement "for any reason or no reason" on 30 business days' notice, and the Terms of Service disclaim responsibility for retention of any data at all. Thirty days to get your record out, by script if you are large, is a workable exit with real cost. Level 2.

4 Transparency record Score 2 · Partial

Rubric condition applied: "Material enforcement with full remediation on record." Zoom carries no GDPR sanction. It does carry the FTC's November 2020 complaint and order, which found that Zoom misrepresented the degree of encryption protecting user content and deployed a persistent local web server bypassing browser protections, and which binds the company to a security programme, risk assessments and independent audits for twenty years. Not GDPR, and not a European action, but a regulator's finding on the product's central security claim, and the criterion scores the record rather than the jurisdiction. Remediation is on record, and the transparency reporting that followed, semi-annual since December 2020 with a published Government Requests Guide and a documented challenge policy, is stronger than the product's reputation from that era suggests. Level 2 stands; the remediation is recorded beside it.

5 Ownership and ultimate control Score 1 · Weak

Rubric condition applied: "Third-country parent with a clear compulsion pathway and no ring-fencing." Zoom Communications is a US company headquartered in San Jose, the CLOUD Act pathway applies, and there is no structural ring-fencing of EU customer content. The vendor's own transparency report is the corroborating document: it lists the CLOUD Act as a request channel and publishes what it processes under it.

6 Citizen protection in the contract Score 3 · Demonstrated

Rubric condition applied: "AI training and sale barred by default, with narrow opt-in exceptions bounded in the contract." The current commitment is clean and emphatic, in bold in the Terms of Service: Zoom does not use audio, video, chat, screen sharing or other communications-like Customer Content to train its or third-party AI models. The history matters as much as the clause: a March 2023 update granted a perpetual licence over customer content for machine learning, and it took a public backlash and two revisions to arrive at the current text. Service Generated Data, the telemetry and diagnostics, remains owned by Zoom. Level 4 fails on material change: the terms change on publication, and the customer accepts by continuing to use the service. Level 3, with the episode recorded as the reason the clause exists.

7 Environmental impact Score 1 · Weak

Rubric condition applied: "No public disclosure; participation in the EU Code of Conduct on Data Centre Energy Efficiency or an equivalent commitment only." As at the capture date, Zoom publishes no power usage effectiveness figure, no per-facility efficiency data and no renewable procurement disclosure, and no participation in the Code of Conduct was identified. The product runs on colocation facilities and public cloud, so its efficiency rests with the hosters rather than the vendor, which is a statement about disclosure, not about the underlying performance. This is the score most likely to move on reply: if Zoom has published efficiency data the review missed, the ledger takes it.

8 European sustainability Score 1 · Weak · weakest link applied

Proxy A, money flow: 1. Rubric condition applied: "A nominal EU presence exists for sales only." No EU operating entity of scale was identified in public filings as at the capture date; the EMEA hub is London, and the continental offices are sales and support. Proxy B, capability: 2. Rubric condition applied: "EU staff provide support only, with all engineering elsewhere." Zoom maintains a dedicated EU support team processing support data in the EEA; engineering and product direction sit outside the EU. Proxy C, continuity: 4. Audited FY2026 accounts show a viable business on any reading: 4.87 billion dollars of revenue, 1.9 billion of net income, 7.8 billion in cash, and no withdrawal of a communications category service without a supported migration path was found in Zoom's published notices as at the capture date. The weakest link is money flow, and the criterion scores 1.

The league table now has its spread. Microsoft 365 holds 2.3, Conditional; Zoom Workplace holds 1.6, Dependent. The difference is not attitude but structure: a contract-level residency commitment versus a settings toggle, enforcement history of different weight, a transparency cadence of different depth, and a European footprint measured in support desks rather than engineering.

The relationship is workable, and the conditions are stated. A European organisation can use Zoom today with its recordings exportable, its AI-training clause in bold, and a vendor whose accounts are beyond argument. The conditions sit where they sat for the productivity suites: the residency that covers some data types and never others, keys held by the vendor unless every meeting toggles the option that disables the features the organisation bought, a thirty-day window to get the record out, and an environmental profile with nothing published to check. None of that is fixed by a settings page. It is fixed, if it is fixed at all, by contract, by key custody, by a rehearsed exit, and by European alternatives strong enough to price the risk.

A reader expecting a higher verdict should ask which criterion they would score differently and on what evidence. A reader expecting a lower one should note that the two conditions propping the score at all, the export window and the bolded AI clause, are exactly the terms the public backlash of 2023 wrote into the contract. Scrutiny moves terms. That is the review's point.

Right of reply issued 14 October 2026 to Zoom Communications, Inc., press relations and the Trust Center, with the draft scores, this evidence ledger and the rubric applied. No reply was received by the close of the window on 28 October 2026. Per method rule 4, publication proceeds and the non-response is noted here. The scores stand unchanged.

None to date. Draft dated 1 October 2026; issued for right of reply 14 October 2026; published 2 November 2026.

AltLibre has no financial relationship with Zoom. AltLibre previously published a page on European alternatives to Zoom; it was retired from the site on 25 September 2026 and is superseded by this review. No advisory client is reviewed under this method while an engagement lasts.

This review is published under CC BY-SA 4.0 by AltLibre. Method: the Sovereignty Scorecard, version 1.1.

← The Sovereignty Scorecard