whats-best.ai
Search Sign in

Video Conferencing

Zoom

Rest of world Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Zoom Communications, Inc. · zoom.us

Compare with Microsoft Teams → Compare with Google Meet → Report an error on this page Is this your product? →

Read this page as one judge. Each weighs the same scores by what they care about.

The Security Officer

Weighted verdict

Wants to know what the vendor can see, and reads "encrypted" as a question rather than an answer. Asks which meetings get end-to-end encryption, what stops working when they do, who holds the keys, and who can walk into a meeting with a link.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Security Officer

The meeting itself

How this is scored

Whether the call works: participant capacity, video and audio quality under load, screen sharing, breakout rooms, moderation, and what happens on a bad connection.

0 — Small meetings only, no screen sharing worth the name, no moderation controls, and the call degrades without telling anyone.

3 — Standard meetings with screen sharing and mute-all, but low participant limits, no breakout rooms and no bandwidth adaptation stated.

5 — Meetings at the scale most teams need with screen sharing, breakout rooms, host moderation, and documented behaviour on constrained connections.

8 — Large meetings and webinars with published capacity limits, per-participant moderation and waiting rooms, layout control, simulcast or adaptive bitrate stated, and reliable behaviour on mobile networks.

10 — Scale and control are engineering claims the vendor stands behind: capacity published per plan and per region, selective forwarding with adaptive quality documented, live streaming, hardware-room support, and diagnostics an admin can read after a bad call.

Report an error

The Security Officer

Capacity is published per plan — 100 participants on Basic and Pro, 300 on Business, a large-meeting add-on reaching 5,000 and a 500-attendee webinar — and breakout rooms are documented down to roles, timers and per-room user limits, with meetings required to carry a passcode, waiting room or authenticated-only join. What the pages do not show is behaviour under strain: no adaptive bitrate or simulcast claim, no documented mobile-network reliability, and no diagnostics an admin can read after a bad call. Quality appears only as hardware gates — 1080p send demands an eight-core machine, GPU and "quality network connections". 2 6 7 10

Report an error

Encryption & meeting access

How this is scored

What is actually encrypted and against whom, plus who can get into a meeting. Judged on documented mechanism rather than on the word "encrypted".

0 — Transport encryption only, undocumented; meetings joinable by anyone with a link and no lobby.

3 — TLS in transit and encryption at rest, with the vendor holding all keys; access control is a passcode.

5 — The above plus a lobby or waiting room, host-controlled admission, per-meeting passcodes, and a clear statement that the vendor can technically access media.

8 — Optional end-to-end encryption for meetings with the trade-offs named (which features stop working), documented key handling, SSO-gated joining, and per-meeting access policies.

10 — End-to-end encryption available without surrendering the product — its cryptography documented or open source, key management explained, identity verification for participants, and the vendor stating plainly what it can and cannot see.

Report an error

The Security Officer

The captured pages mark end-to-end encryption unsupported on every browser for the web client, and the only mechanism documented is "TLS 1.2 and 256-bit AES-GCM Encryption" — with nothing on key handling or encryption at rest for recordings. Access control is the stronger story: at least one of a passcode, waiting room or authenticated-only join is required, the meeting API overwrites any request that tries to switch all three off, and on most account sizes that requirement is locked. But the privacy pages themselves record that account owners can read chat and even encrypted email content and that Zoom automatically scans shared files — so what the vendor can see is documented only in fragments, never as a plain statement about meeting media. 3 7 9 10

Report an error

Reach & accessibility

How this is scored

Whether everyone who needs to join can: browser without an install, dial-in, low bandwidth, guests without accounts, captions and keyboard operation.

0 — A desktop client is the only way in; guests must create an account.

3 — Browser joining exists but is degraded, guests can join by link, and there is no dial-in and no accessibility statement.

5 — Full-feature browser joining without an install, guest access by link, mobile apps, and a stated accessibility posture.

8 — Telephone dial-in with numbers listed, live captions, keyboard-navigable and screen-reader-tested interface, and documented low-bandwidth behaviour.

10 — Reach is designed for: browser parity with the client, dial-in across the regions the customer operates in, live captions and translation, a published accessibility conformance report, and a usable experience on a poor mobile connection.

Report an error

The Security Officer

Browser joining is solid: the web client claims feature parity, WebRTC video is supported across Chrome, Edge, Safari and iOS WebKit, live transcription and live translation are marked supported on every browser, and mobile send is documented down to OS versions. We found no public information on telephone dial-in, on joining as a guest without an account, or on any accessibility conformance statement, keyboard operation or screen-reader testing. Constrained connections appear only as requirements for reaching higher resolutions, not as a documented degraded mode. 9 10

Report an error

Recordings, retention & admin control

How this is scored

A recording is personal data about everyone in the room. Who may record, who is told, where it is stored, how long it lives, and what the works council can switch off.

0 — Anyone can record, storage location unstated, no retention rule, no admin policy.

3 — Host-only recording with a notification, but storage region unstated, retention manual, and no organisation-wide policy control.

5 — Admin policy over who may record, participant notification and consent prompt, stated storage region, and manual deletion that works.

8 — Automatic retention and deletion per policy, recordings encrypted at rest with access logged, transcription handled with its own retention rule, and attendance or analytics features that can be switched off for co-determination.

10 — Built for a works agreement: every recording, transcript and analytics feature independently switchable and documented, retention executed and evidenced, an audit trail of who accessed which recording, and no participant-level behavioural scoring at all.

Report an error

The Security Officer

Recording is host-controlled in the SDK with a contractual notification when recording is enabled, participants can request recording or be permitted to start it, a delete-after-a-set-number-of-days policy exists, and a bring-your-own-storage mode keeps the files in the customer's own S3 bucket with Zoom holding only metadata. For the works council the gaps are real: we found no public information on the storage region of Zoom-held recordings, on encryption at rest or access logs for recordings, on a separate retention rule for transcripts and AI summaries, or on switching off attendance analytics. Termination is handled — thirty days to retrieve content before deletion — but that is the end of the relationship, not the life of a recording. 4 11 12

Report an error

Integrations & deployment

How this is scored

Calendar, identity and the wider stack — plus, in this category, whether the product can be run on the customer's own infrastructure at all.

0 — No calendar integration, no SSO, no API; cloud-only with no alternative.

3 — One calendar integration and basic SSO, no API worth building on, cloud-only.

5 — Calendar integration for the major suites, SAML or OIDC SSO, a documented API for scheduling, and room-system support.

8 — The above plus SCIM provisioning, embedding via SDK, webhooks for meeting events, and either a self-hosted option or a documented private-cloud deployment.

10 — Deployment is the customer's choice: a genuine on-premises or private-cloud option with the same features, open protocols or open source, embeddable SDKs, and identity integration that does not require the vendor's directory.

Report an error

The Security Officer

The developer surface is broad: meeting create-and-update APIs, a calendar API complete with access-control lists, webhooks for recording, transcript and summary events, OAuth with automatic token refresh, a downloadable OpenAPI spec with client libraries, and the Business tier carries SSO with managed domains. We found no public information on SCIM provisioning, room-system support, or any self-hosted or private-cloud deployment — every captured endpoint sits on the vendor's cloud — and the SSO mechanism is not named as SAML or OIDC. Embedding via SDK is well documented, but third-party app data rides under the app developers' own privacy policies rather than the meeting vendor's. 2 3 7 13 14

Report an error

European sovereignty

How this is scored

Where media and metadata are processed, who the contracting entity is, which subprocessors carry the traffic. Independently sourced by the sovereignty pipeline; scored here as this buyer weighs it — which in this category is heavily.

0 — Non-EU vendor and contracting entity, media routed through unstated regions, subprocessors unnamed.

3 — EU data residency for storage while media relays or metadata remain non-EU, or the contracting entity sits outside the EU.

5 — EU hosting and an EU contracting entity, but parts of the chain — relays, analytics, support tooling, transcription — are non-EU without an explained safeguard.

8 — Media and metadata processed in the EU on named infrastructure, EU contracting entity, complete subprocessor list published, any non-EU processing named with its legal basis.

10 — Sovereign end to end and evidenced: media never leaves the EU, every subprocessor European, certification published, and an on-premises option that removes the question entirely.

Report an error

The Security Officer

The contracting entity is Zoom Communications, Inc., a US company with the Federal Trade Commission named as enforcer of its data-framework commitments; the EU-facing facts are a representative in Cork, standard contractual clauses and US Data Privacy Framework certifications — mechanisms for sending data out, not for keeping it in. We found no public information on where media and metadata are processed, and subprocessors appear only as unnamed third-party service providers for infrastructure and payment processing. Weighted heavily, as this buyer does, that is a US chain end to end with the geography of the traffic itself unpublished. 1 3 4

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the annual invoice for their host count — including the capacity, dial-in and recording storage they actually need — from public pages alone.

0 — No public prices at all; every tier is a sales conversation.

3 — A per-host headline exists, but participant caps, dial-in minutes or recording storage are unpriced or unmentioned.

5 — Per-host prices public with billing period stated and capacity limits given, but at least one commonly needed piece (webinar capacity, dial-in, storage) sits in an unpriced add-on.

8 — Every tier and add-on priced publicly with per-host maths, capacity limits, dial-in rates, storage allowances, minimum term and VAT treatment stated.

10 — Complete price computability: a calculator producing the annual invoice for a given host count, meeting size and recording volume, including overage and per-region dial-in.

Report an error

The Security Officer

Headline per-host prices are public with billing period and VAT treatment stated — Pro at €13.33 /user per month billed annually excluding VAT, Business at €17.49 — alongside participant caps, 10 GB cloud storage per license, tier license counts, webinar capacity of 500, and terms that payments are non-refundable. Computing the real invoice still fails: we found no public information on dial-in rates, the large-meeting add-on is priced only "From €46.50 for 500 participants per month" with no figures up to 5,000, and cloud recording and the AI summary are each "a separate charge" whose rates sit behind a developer credit plan. 2 4 11 12

Report an error

European sovereignty — proven facts

0 of 4 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Ownership Not determined — uncited Report an error
Data residency Not determined — uncited Report an error
Subprocessors Not determined ⚠ unverified — uncited Report an error

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Zoom? Tell us Report an error on this page

Sources (14)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage zoom.us Checked 15 Sep 2026 Details →
  2. 2 Pricing zoom.us Checked 15 Sep 2026 Details →
  3. 3 Privacy policy explore.zoom.us Checked 15 Sep 2026 Details →
  4. 4 Terms of service www.zoom.com Checked 30 Sep 2026 Details →
  5. 5 The meeting itself — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  6. 6 The meeting itself — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  7. 7 Encryption & meeting access — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  8. 8 Encryption & meeting access — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  9. 9 Reach & accessibility — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  10. 10 Reach & accessibility — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  11. 11 Recordings, retention & admin control — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  12. 12 Recordings, retention & admin control — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  13. 13 Integrations & deployment — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →
  14. 14 Integrations & deployment — found from sitemap developers.zoom.us Checked 1 Oct 2026 Details →