Trust Center
Welcome to the Zoom Communications' Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
At Zoom, we prioritize the security and privacy of our users. Our commitment to safeguarding your data is reflected in our comprehensive security measures and protocols. Explore our resources to learn more about how Zoom works tirelessly to maintain a secure and trustworthy environment for all your communication needs.
Trust Center Updates
PHP2Shell: CVE-2026-109618 and CVE-2026-109619
Zoom has been analyzing our products and services to identify and mitigate PHP vulnerabilities disclosed in CVE-2026-109618 and CVE-2026-109619. Addressing these vulnerabilities is a top priority for Zoom.
While Zoom’s core services and platform code does not use PHP, Workvivo does, and that PHP code has been patched with the PHP Group’s update released on October 21, 2026. We are still assessing third-party dependencies in our production environments where PHP may be used. Where additional affected systems due to third-party dependencies are found, Zoom will work with the relevant third party to have the update applied or will implement mitigations or compensating controls until remediation is complete.
This page will be updated as material information becomes available.
Updated Security Documentation - March 2026
Since the beginning of the year, Zoom has been busy publishing several updated security documents, including:
- Product and network layer penetration tests
- Zoom SOC 2 Type II report covering 10/16/2024 to 10/15/2025, along with the corresponding bridge letter
- Workvivo SOC 2 Type II report covering 1/1/2025 to 12/31/2025
- PCI Attestations of Compliance (AOCs) for Zoom Contact Center and Zoom Phone
- ISO 27001 certificate, which now includes Workvivo within its scope
- TX-RAMP Level 2 certification for Zoom Commercial (upgraded from Level 1)
We encourage you to explore our Trust Center for the most recent updates and documentation. Additional materials will be published in the coming weeks.
DISA provides expanded Impact Level 4 (IL4) Authorization to Zoom for Government
Zoom for Government has received authorization from the Defense Information Systems Agency (DISA) for Department of Defense (DoD) IL4 NIPRNet and internet-facing communications. This continues our previous DISA authority and Air Force Authority to Operate but now adds IL4 collaboration directly behind the DoD Boundary Connection Access Point or BCAP.
See the complete blog entry here
A legal and compliance guide to Zoom AI Companion
When you're thinking about integrating AI Companion into your organization, it's important to know about our data protection and privacy features and how they fit with your organization’s data governance requirements.
See the complete blog entry here
BSI recognizes the first DIN SPEC for video communication as a new product category of the IT Security Label
The German Federal Office for Information Security (BSI) has published a new product category "video conferencing services" for the IT Security Label. The BSI officially announced this new category in the Federal Gazette on Friday, March 15.
See the full article here