Google Meet vs Zoom

Google Meet

The evidence proves scale and nothing else: 100/150/500/1000 participants published per plan, 24-hour meetings, in-domain live streaming on Enterprise, a hardware add-on and noise cancellation. Not one word on screen sharing, breakout rooms, host moderation, or behaviour on a bad connection — capacity without documented controls doesn't clear the 5 anchor.

Zoom

Capacity is published per plan — 100 participants on Basic and Pro, 300 on Business, a large-meeting add-on reaching 5,000 and a 500-attendee webinar — and breakout rooms are documented down to roles, timers and per-room user limits, with meetings required to carry a passcode, waiting room or authenticated-only join. What the pages do not show is behaviour under strain: no adaptive bitrate or simulcast claim, no documented mobile-network reliability, and no diagnostics an admin can read after a bad call. Quality appears only as hardware gates — 1080p send demands an eight-core machine, GPU and "quality network connections".

Google Meet

Nowhere does the evidence state what is encrypted, who holds the keys, or who can get into a meeting — no TLS statement, no E2EE, no lobby, no passcode, no admission control for Meet at all. The only security-adjacent facts are Google-wide privacy machinery (transparency report, deletion process, complaint handling), which say nothing about a meeting; undocumented is the 0-1 floor.

Zoom

The captured pages mark end-to-end encryption unsupported on every browser for the web client, and the only mechanism documented is "TLS 1.2 and 256-bit AES-GCM Encryption" — with nothing on key handling or encryption at rest for recordings. Access control is the stronger story: at least one of a passcode, waiting room or authenticated-only join is required, the meeting API overwrites any request that tries to switch all three off, and on most account sizes that requirement is locked. But the privacy pages themselves record that account owners can read chat and even encrypted email content and that Zoom automatically scans shared files — so what the vendor can see is documented only in fragments, never as a plain statement about meeting media.

Google Meet

Nothing evidences how a single participant joins: no browser joining, no guest access by link, no dial-in, no captions, no accessibility statement anywhere in the evidence. The one adjacent fact is that Google collects mobile network and carrier data — that implies devices exist, not that anyone can reach a meeting; total silence on every element of the anchor is the floor.

Zoom

Browser joining is solid: the web client claims feature parity, WebRTC video is supported across Chrome, Edge, Safari and iOS WebKit, live transcription and live translation are marked supported on every browser, and mobile send is documented down to OS versions. We found no public information on telephone dial-in, on joining as a guest without an account, or on any accessibility conformance statement, keyboard operation or screen-reader testing. Constrained connections appear only as requirements for reaching higher resolutions, not as a documented degraded mode.

Google Meet

Recording appears from the Standard plan and attendance tracking on Plus, but the evidence never says who may record, whether participants are notified, or where recordings are stored; what exists is generic — domain admins can restrict deletion and privacy settings, and data can auto-delete after set periods — plus Vault retention tooling. Attendance tracking arrives with no evidenced off-switch, which is exactly what a works council will ask me about.

Zoom

Recording is host-controlled in the SDK with a contractual notification when recording is enabled, participants can request recording or be permitted to start it, a delete-after-a-set-number-of-days policy exists, and a bring-your-own-storage mode keeps the files in the customer's own S3 bucket with Zoom holding only metadata. For the works council the gaps are real: we found no public information on the storage region of Zoom-held recordings, on encryption at rest or access logs for recordings, on a separate retention rule for transcripts and AI summaries, or on switching off attendance analytics. Termination is handled — thirty days to retrieve content before deletion — but that is the end of the relationship, not the life of a recording.

Google Meet

Identity plumbing exists — Secure LDAP on Plus, Cloud Identity Premium and DLP on Enterprise — and a Meet Hardware add-on covers room systems, but no calendar integration is named, no SAML/OIDC or documented API appears, and deployment is cloud-only with no alternative evidenced.

Zoom

The developer surface is broad: meeting create-and-update APIs, a calendar API complete with access-control lists, webhooks for recording, transcript and summary events, OAuth with automatic token refresh, a downloadable OpenAPI spec with client libraries, and the Business tier carries SSO with managed domains. We found no public information on SCIM provisioning, room-system support, or any self-hosted or private-cloud deployment — every captured endpoint sits on the vendor's cloud — and the SSO mechanism is not named as SAML or OIDC. Embedding via SDK is well documented, but third-party app data rides under the app developers' own privacy policies rather than the meeting vendor's.

Google Meet

The pipeline found jurisdiction, ownership, residency and subprocessor exposure all unknown; the vendor is Google LLC of Mountain View, media routing is unstated, and subprocessors are described only as unnamed 'affiliates and trusted businesses or persons' processing on Google's instructions. Google Ireland is the designated EEA controller and an 'enterprise data regions' feature is named, but neither says where meeting media actually flows — one point, no more.

Zoom

The contracting entity is Zoom Communications, Inc., a US company with the Federal Trade Commission named as enforcer of its data-framework commitments; the EU-facing facts are a representative in Cork, standard contractual clauses and US Data Privacy Framework certifications — mechanisms for sending data out, not for keeping it in. We found no public information on where media and metadata are processed, and subprocessors appear only as unnamed third-party service providers for infrastructure and payment processing. Weighted heavily, as this buyer does, that is a US chain end to end with the geography of the traffic itself unpublished.

Google Meet

Three tiers are computable from the public page — EUR per user with monthly vs 16%-discount annual billing, participant caps of 100/150/500/1000, 24-hour meetings and pooled storage stated. But Enterprise is 'Contact sales', the Meet Hardware and Voice add-ons are 'sold separately' with no prices, and dial-in rates and VAT treatment are never mentioned — a solid 5 pushed to 6 on capacity disclosure.

Zoom

Headline per-host prices are public with billing period and VAT treatment stated — Pro at €13.33 /user per month billed annually excluding VAT, Business at €17.49 — alongside participant caps, 10 GB cloud storage per license, tier license counts, webinar capacity of 500, and terms that payments are non-refundable. Computing the real invoice still fails: we found no public information on dial-in rates, the large-meeting add-on is priced only "From €46.50 for 500 participants per month" with no figures up to 5,000, and cloud recording and the AI summary are each "a separate charge" whose rates sit behind a developer credit plan.