Zoom: security, or why market leaders choose Zoom

Given the recent security problems at other communication companies (WebEx, for example), we wanted to provide you with updated information about Zoom's security. Security is Zoom's highest priority. Zoom has created the most secure network with the most reliable security features for our customers.

In fact, many of the world's most trusted information security companies entrust their meetings to Zoom:

Zoom complies with the SOC2 standard, is TRUSTe certified for privacy and is an active participant in the EU-US Privacy Shield. Zoom also ensures HIPAA compliance and is going to sign a BAA.
Let's look at some of the key Zoom security features that your enterprise can trust:

1. A secure network

Good news! All meetings with Zoom are also protected by several layers of security with flexible controls.
• Cloud infrastructure: Zoom meetings are held on our highly reliable, scalable, secure infrastructure platform in the cloud. A distributed network of low-latency multimedia routers is located inside Zoom's communication infrastructure. All session data going out from the host's device and arriving at the participants' devices is switched dynamically — it is never stored permanently.

• Encryption: Zoom protects session content by encrypting the web communication channel at https://zoom.us. Zoom also supports SSL / TLS network-layer communication (port 443) between the Zoom application and the multimedia router, as well as NIST AES 256 application-layer encryption.

• Post-meeting security: after a meeting has ended, session information is not stored on Zoom's routers or on the device of any participant. If the meeting was recorded, the recording is located on the client's local computer or in Zoom's secure cloud, if that option was chosen.

2. Scheduling features

Here are some features you can access when you schedule a meeting in order to make it more secure:
• Password protection: password-protect your meetings by clicking “Require meeting password” and entering an alphanumeric password when you schedule your meeting. The password is filled in automatically in the calendar invitation. This means that only people who have the meeting ID and the password can join your meeting.

• “Join before host” settings: when scheduling, you have the option to allow participants to join before the host or not. If you do not select this option, no one will be able to join the meeting unless you are there to start it. This gives you more control over the meeting. Even if you choose “Join before host”, you will still get an email notification when someone joins before you.

3. Meeting features

The meeting host has a wide range of controls they can use to protect their meeting. For example:
• Lock the meeting. When you are in a meeting, click “Participants” at the bottom of the “Zoom” window. In the participants pop-up you will see a button labeled Lock Meeting. When you lock a meeting, new participants cannot join, even if they have the meeting ID and the password.

• Remove a participant. In the participants menu you can hover the mouse over a participant's name, and several options will appear, including “Remove”. Click it to remove the participant from the meeting. They will not be able to come back if you then click Lock Meeting.

• Waiting Room: protect participants' privacy by keeping some of them in your virtual Waiting Room while you finish your meeting with others. Follow these simple instructions.

• Attendee on hold: if you need a private moment, you can put an attendee on hold. The participant's video and audio connections will be turned off for a moment. Click the participant's video thumbnail and select Start Attendee On-Hold to activate this feature.
Other controls include blocking screen sharing, enabling / disabling participant recording, watermarked screenshots and disabling chat during the meeting.

4. Additional security options

Some enterprises have additional security requirements for video and web conferencing.
• Meeting Connector: Zoom Meeting Connector is a hybrid cloud deployment method that lets a customer deploy Zoom inside the company's internal network. Meeting administration is managed in the Zoom infrastructure, but the meeting itself is hosted on the company's internal network. All meeting traffic, including audio, video and content sharing, stays within the company's own network. This uses your existing network security settings for additional protection of your communications.

• Single sign-on (SSO): with single sign-on, a user signs in using your company's identity provider, such as Microsoft Active Directory, Centrify, Okta or Google, to access various applications. Zoom works with all single sign-on providers via SAML or OAuth, so you can easily assign who gets access to Zoom. Zoom also offers an API call to pre-provision users from any database. With Zoom you can map attributes in order to place a user in different groups with their own controls.