AI tools and client data

Is Zoom AI Companion safe for client data?

Short answer: Whether Zoom AI Companion is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Included with paid Zoom plans and on Business and Enterprise, Zoom says it does not train its models on what staff type, by default. Every fact on this page is Zoom's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Zoom’s own words

The summaries, questions and notes built into Zoom itself, which is why it is often the notetaker a practice already has without choosing one.

What you are askingIncluded with paid Zoom plansBusiness and Enterprise
Trains the vendor's models by defaultNo. Zoom says it does not use customer content to train its own or third-party AI models.“Zoom does not use any of your audio, video, chat, screen sharing, attachments, or other communications-like customer content” source, read The same statement, and Zoom extends it to the model providers it uses.“We do not allow third-party model providers to use your data to improve or train their models.” source, read
How to turn training offNot found in the pages we read.Not found in the pages we read.
How long data is keptZoom says the third-party models behind its AI features retain nothing, with trust-and-safety exceptions.“Zoom has zero data retention policies in place, which provide that they do not retain customer content” source, read Not found in the pages we read.
What an admin can see or controlNot found in the pages we read.An account administrator turns the AI features on or off.“Zoom provides account administrators and users with controls to manage AI features.” source, read
Single sign-onNot found in the pages we read.SAML 2.0, on a Business, Education or Enterprise account.“Zoom single sign-on (SSO) is based on SAML 2.0.” source, read
Business Associate AgreementNot found in the pages we read.Zoom signs BAAs, and ties the AI features to having one in place.“AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom.” source, read
Where the data is processedNot found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Zoom pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Zoom before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. Zoom publishes a BAA position for this product, which is where that conversation starts. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Zoom’s own documentation. Each one is a change somebody can make this afternoon.

  • Know that using an AI feature sends the meeting's speech to a model, which is the thing to decide about, not the summary.“AI features used in Zoom Meetings that provide summaries or answer questions generate speech-to-text data that will be sent to the relevant model” source, read
  • Ask which model provider is behind the feature you turn on; Zoom says it shares the relevant data with them.“Zoom's AI features may use third-party AI-model providers, and we will share relevant data with those third parties when you use the feature.” source, read

Questions we get asked

Is Zoom AI Companion safe for client data?

Whether Zoom AI Companion is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Included with paid Zoom plans and on Business and Enterprise, Zoom says it does not train its models on what staff type, by default.

Every fact on this page is Zoom's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Zoom train its models on what our staff type into Zoom AI Companion?

On Included with paid Zoom plans and on Business and Enterprise, Zoom says it does not train its models on what staff type, by default.

On Included with paid Zoom plans: No. Zoom says it does not use customer content to train its own or third-party AI models.

Zoom's own words: "Zoom does not use any of your audio, video, chat, screen sharing, attachments, or other communications-like customer content" (read 2026-11-02).

On Business and Enterprise: The same statement, and Zoom extends it to the model providers it uses. Zoom's own words: "We do not allow third-party model providers to use your data to improve or train their models." (read 2026-11-02).

How long does Zoom keep what we put into Zoom AI Companion?

On Included with paid Zoom plans: Zoom says the third-party models behind its AI features retain nothing, with trust-and-safety exceptions.

Zoom's own words: "Zoom has zero data retention policies in place, which provide that they do not retain customer content" (read 2026-11-02). On Business and Enterprise: Not found in the pages we read.

Can an administrator read what our staff typed into Zoom AI Companion?

An account administrator turns the AI features on or off. Zoom's own words: "Zoom provides account administrators and users with controls to manage AI features." (read 2026-11-02).

Will Zoom sign a Business Associate Agreement for Zoom AI Companion?

Zoom signs BAAs, and ties the AI features to having one in place. Zoom's own words: "AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom." (read 2026-11-02).

A signed BAA is between your practice and Zoom; we do not sign it for you, and we do not read a compliance badge as one.

How do we find out which version of Zoom AI Companion our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Zoom’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.