Is Zoom Secure in 2026? Encryption, Risks and Safer Settings

Is Zoom secure? For most business meetings, yes: Zoom encrypts audio, video and screen sharing in transit with AES-256-GCM, and its end-to-end encryption (E2EE) is solid when you turn it on. The catch is that E2EE is off by default, and Zoom published 22 security bulletins between January and mid-October 2026, three rated critical.

So the honest answer depends less on the brand and more on three things: which encryption mode your meeting actually uses, how quickly your devices install updates, and whether your settings close the gaps attackers use in practice. This review walks through each of them with dates and sources, so you can decide whether Zoom is secure enough for your own meetings, from a weekly team call to a therapy session.

Table of Contents

• The Short Verdict
• How Zoom Encrypts Your Meetings
• Zoom's Security History: What Happened and What Changed
• The 2026 Vulnerability Record
• The Biggest Risks Sit Outside the App
• Privacy: Data Routing, AI and Certifications
• Is Zoom Secure Enough for Your Use Case?
• 10 Settings That Make Zoom Safer
• Where Meeyra Fits
• Frequently Asked Questions

The Short Verdict

Zoom in 2026 is a very different product from the Zoom of early 2020, when "zoombombing" made headlines and researchers found weak encryption. Most of the structural problems from that period were fixed. What remains is the normal risk profile of any widely used desktop app: frequent vulnerability patches, social engineering that abuses legitimate features, and privacy questions about where data goes.

The short version: for everyday business, the answer to "is Zoom secure" is yes, as long as you keep it updated and configure it deliberately. For conversations where even the provider must not be able to listen, you need E2EE switched on and verified, and you have to accept the features you lose with it.

How Zoom Encrypts Your Meetings

Zoom offers two encryption modes, and understanding the difference answers most "is Zoom secure" questions.

Standard (enhanced) encryption is what every meeting uses unless you change it. Audio, video and shared content travel between your device and Zoom's servers encrypted with AES-256-GCM, the upgrade Zoom made its standard on May 30, 2020. The encryption keys, however, are generated and managed by Zoom's infrastructure. That protects you from someone sniffing traffic on café Wi-Fi, but it means the content is decrypted inside Zoom's cloud, where features like cloud recording, live transcription and AI summaries work.

End-to-end encryption moves key generation to participants' devices. According to Zoom's own documentation, encrypted data relayed through its servers is then "indecipherable by Zoom, since Zoom's servers do not have the necessary decryption key." Since May 2024, meetings in which every participant runs app version 6.0.10 or later automatically use a post-quantum variant designed to resist "harvest now, decrypt later" attacks. If you want a refresher on the concept itself, see our explainer on what end-to-end encryption means in video calls.

Zoom's support documentation (updated August 2026) lists what E2EE switches off: cloud recording, Zoom Whiteboard, Zoom AI features, streaming, live transcription, polling "and more." That trade-off is not a Zoom weakness; it is how E2EE works on any platform. A server that cannot read the media cannot transcribe, translate or record it either.

Two details are worth knowing. First, a green shield in the meeting window shows the encryption type, and in an E2EE meeting the host can click it and read a security code aloud so participants confirm it matches. Second, anyone who dials in by phone or connects through a SIP/H.323 room system is not covered by E2EE, which Zoom marks with a "partial encryption" symbol.

Zoom's Security History: What Happened and What Changed

Zoom's reputation problems are mostly from 2019 and 2020. Here is the timeline, with the fixes that followed.

The FTC order matters more than it looks. It was criticized at the time for including no money, but it obliges Zoom to run a comprehensive information security program and to submit to independent assessments every two years until 2041. In practice, that means outside auditors keep checking the very area where Zoom once overpromised.

Zoom also pays outside researchers to find bugs. By April 2024 it had paid more than $10 million in bug bounties since 2019, including over $2.4 million in 2023 alone for more than 1,000 valid reports.

The 2026 Vulnerability Record

A long list of patched vulnerabilities is not proof that a product is insecure; it partly shows that people are looking. Still, the numbers tell you how disciplined your update process needs to be.

Zoom's public security bulletin lists 22 advisories from January 20 to October 13, 2026: 3 critical, 17 high, 1 medium and 1 low. Most affect the Windows desktop client, VDI plugins or Zoom Rooms.

The July flaw is the one to remember. The NVD entry for CVE-2026-53412 carries a CVSS score of 9.8 with network attack vector, no privileges and no user interaction required, and Zoom's bulletin says it could let an unauthenticated attacker compromise accounts. Any Windows machine still running a Zoom Workplace version below 7.0.0 is exposed.

For individuals, keeping Zoom secure comes down to one habit: turn on automatic updates and restart the app when it asks. For IT teams, Zoom belongs on the same patch schedule as browsers and operating systems, including VDI images and meeting-room PCs, which are often forgotten.

The Biggest Risks Sit Outside the App

That is why "is Zoom secure" is only half the question. Most real-world Zoom incidents in the last two years did not break Zoom's encryption at all. They tricked people.

Fake installers. In March 2025, The DFIR Report documented a case where a fake Zoom installer ended in BlackSuit ransomware. The victim downloaded it from a lookalike domain; about nine days later, the attackers deployed ransomware across the network. Download the client only from the official site or your device's app store.

Remote control abuse. In April 2025, Trail of Bits described a campaign it called ELUSIVE COMET. Attackers posing as journalists or investors invited targets to a Zoom interview, asked them to share their screen, then renamed themselves "Zoom" and sent a remote control request that looked like a system prompt. The firm recommended that organizations handling sensitive assets disable remote control or use the browser client on high-risk machines.

Leaked links. Zoombombing has not disappeared; it just became quieter. Research on the 2020 wave found that most raids were organized by insiders who posted the link, so passcodes alone were not enough. Our guide on how to prevent Zoom bombing covers the twelve host settings that stop it.

Deepfake participants. In 2024, CNN reported that an employee of the engineering firm Arup transferred about $25 million after a video conference in which every other "colleague" was a deepfake. No meeting platform can detect that by default. Verify payment or credential requests through a second, known channel.

These attacks work on any video platform. They are covered in more depth in our 15-point video conferencing security checklist, which applies regardless of the tool you use.

Privacy: Data Routing, AI and Certifications

Security asks whether outsiders can get in. Privacy asks what the provider itself does with your data. For Zoom, four points matter.

Where your meetings travel. Since April 2020, paid account admins can choose which data center regions handle real-time meeting traffic, and Zoom's documentation says the mainland China data center is opted out by default. Free accounts get fewer controls, which is one reason regulated teams should not run sensitive work on them.

AI features. After the August 2023 backlash, Zoom amended its terms to state that it does not use customer audio, video or chat content to train its AI models without consent. AI Companion features such as meeting summaries are controlled by account admins. Because those features process meeting content on Zoom's servers, they are unavailable in E2EE meetings.

Certifications. Zoom's trust center lists ISO/IEC 27001, 27017, 27018 and 27701 certificates, a SOC 2 Type II report and a German BSI C5 attestation covering Meetings, Webinars, Team Chat, Phone, Rooms and AI Companion. These are vendor-reported, so ask for the current reports during procurement. Our guide to what SOC 2 and ISO 27001 actually prove explains what each document can and cannot tell you.

Healthcare. Zoom offers a Business Associate Agreement (BAA) for eligible healthcare accounts. A standard free or individual account is not the setup for patient data; see our HIPAA-compliant video conferencing guide for what a compliant telehealth setup needs.

Is Zoom Secure Enough for Your Use Case?

The right question is not "is Zoom secure" in the abstract, but whether its default or E2EE configuration matches what is at stake in your meeting.

If a meeting requires both strict E2EE and live transcription or translation, no platform can deliver both in the same session. Decide which property matters more before the call starts.

10 Settings That Make Zoom Safer

These Zoom-specific controls make Zoom secure against the gaps described in the sections above.

1. Turn on automatic updates and confirm Windows clients run Zoom Workplace 7.0.0 or later.
2. Enable end-to-end encryption at the account level, then choose it for sensitive meetings.
3. Verify the security code out loud at the start of E2EE meetings.
4. Disable remote control requests if your team does not need them.
5. Require authenticated users so only signed-in accounts from approved domains can join.
6. Keep passcodes and the waiting room on, and admit people by name.
7. Restrict screen sharing to the host and turn off file transfer in chat.
8. Review AI Companion and recording settings so summaries and recordings are opt-in, with consent.
9. Set data center regions on paid accounts to match your compliance needs.
10. Install only from the official site or app store, and treat unexpected "update" prompts in a browser as phishing.

Where Meeyra Fits

Meeyra takes a different approach that some teams prefer, so here is an honest comparison of the security model rather than a sales pitch.

Meeyra runs in the browser, so guests join from a link without installing anything. That removes the fake-installer risk for participants, though it does not remove phishing. Media is encrypted in transit with DTLS-SRTP, the WebRTC standard. Meeyra is not end-to-end encrypted in the strict sense: its server processes audio in real time to deliver AI translation in 42+ languages, the same trade-off described above. Audio is not stored; when translation is on, a text transcript is saved so the meeting summary can be generated. Hosts can switch participants' microphones, cameras, chat, translation and screen sharing on or off.

Meeyra does not offer cloud recording or a waiting room, so it is not a drop-in replacement for every Zoom workflow. If multilingual meetings are your main need, compare the details on our security page and our Zoom alternative overview, or see how Meeyra stacks up in our roundup of the best Zoom alternatives.

Frequently Asked Questions

Is Zoom safe from hackers?

Zoom's encryption is not the weak point; outdated clients and social engineering are. In 2026 Zoom patched three critical flaws, including CVE-2026-53412 (CVSS 9.8) in Windows clients before version 7.0.0, so keeping the app updated is the single most effective protection.

Is Zoom end-to-end encrypted by default?

No. Default Zoom meetings use AES-256-GCM encryption in transit with keys managed by Zoom's servers. End-to-end encryption must be enabled by the account owner or host, and it then disables cloud recording, live transcription, AI features and polling.

Can Zoom see or hear my meetings?

In a default meeting, Zoom's infrastructure can technically decrypt the content, which is what makes cloud recording and AI summaries possible. In an end-to-end encrypted meeting, the keys stay on participants' devices, so Zoom's servers cannot decrypt audio or video.

Is Zoom secure for therapy and telehealth?

Zoom can be used for telehealth when the provider has a Business Associate Agreement with Zoom on an eligible healthcare plan. A free or standard individual account is not a HIPAA-compliant setup, regardless of the encryption settings.

Is Zoom safe to download?

Yes, if you download it from Zoom's official website or your device's app store. Fake installers on lookalike domains have delivered ransomware, as documented in a March 2025 incident report, so never install Zoom from a link sent in an email or chat.

Is the Zoom web client safer than the desktop app?

The browser client has a smaller attack surface and cannot be used for remote control tricks that rely on desktop permissions. However, it cannot join end-to-end encrypted meetings, so the right choice depends on whether E2EE or a locked-down device matters more.

Does Zoom use my meetings to train AI?

Zoom's terms, amended in August 2023, state that it does not use audio, video or chat content to train its AI models without customer consent. Account admins control whether AI Companion features are enabled and whether content is shared for product improvement.

Keeping Zoom secure in 2026 is achievable for most organizations, provided you treat it like any critical software: patched quickly, configured deliberately and backed by training against social engineering. If your meetings depend on real-time translation instead, you can create a free Meeyra account and test it with your own team in a browser.