Parent Company
Zoom Video Communications (US)
CLOUD Act Status
✗ Exposed
Canadian Data Residency
✗ Not Available
Encryption
⚠ E2EE Optional (limited)
TIA / PIA Required
Yes — Law 25 & POPA
AI Companion
Processes via US infra

Is Zoom CLOUD Act exposed for Canadian organizations?

Yes. Zoom Video Communications Inc. is incorporated in Delaware (NASDAQ: ZM) and headquartered in San Jose, California. Zoom became essential infrastructure during the pandemic and remains embedded in Canadian organizations' daily operations. It is fully subject to the CLOUD Act — US authorities can compel Zoom to produce data regardless of where participants are located.

Zoom does not offer Canadian data residency on any plan tier. All data — meeting metadata, recordings, transcripts, chat logs — is stored on US infrastructure. The one meaningful technical safeguard is end-to-end encryption, but it comes with significant limitations that most organizations don't fully understand.

Regulatory Analysis

▾

CLOUD Act exposure

Zoom Video Communications is Delaware-incorporated and fully within CLOUD Act scope.

🍁
Your Meetings
Video, audio, chat
Recordings, transcripts
🏢
Zoom Video Comm.
Delaware, USA
NASDAQ: ZM
⚖️
US Legal Process
CLOUD Act · Subpoena
Metadata always exposed

End-to-end encryption: what it actually protects

Zoom offers optional E2EE for meetings. When enabled, meeting content is encrypted on each participant's device and Zoom's servers cannot access it. This is a genuine safeguard. But E2EE has significant limitations: it is not enabled by default, administrators must turn it on, and participants must opt in per meeting. When E2EE is active, cloud recording, live transcription, breakout rooms, polling, and meeting reactions are all disabled. If a meeting is cloud-recorded, E2EE cannot apply.

For compliance: E2EE protects live meeting content from a CLOUD Act order. But it does not protect meeting metadata (who joined, when, duration), chat messages, cloud recordings, transcriptions, or AI-processed data. The metadata alone — which reveals who your organization meets with and how often — may constitute personal information under PIPEDA and Law 25.

Zoom AI Companion

Zoom AI Companion provides meeting summarization, smart recording highlights, and chat assistance. These features process meeting content through AI models on US infrastructure. AI Companion and E2EE are mutually exclusive — you cannot use both simultaneously. When AI Companion processes a meeting with Canadian participants, the content transits through US infrastructure regardless of any other settings.

Quebec Law 25

Quebec organizations must complete a Transfer Impact Assessment for Zoom. The TIA should document the dual nature: E2EE-enabled meetings have meaningful content protection, but metadata, recordings, transcripts, and AI processing remain fully exposed. Upper Harbour provides compliance-ready TIA documentation starting at $99.

Alberta POPA

Alberta public bodies using Zoom must complete a PIA. BC public bodies were temporarily permitted to use Zoom during COVID-19 under a ministerial order — under the permanent FIPPA framework, a PIA is required. The PIA Research Tool generates these answers automatically.

Zoom Phone

For organizations using Zoom Phone, Zoom also retains call records, voicemail content, and SMS messages — all stored on US infrastructure and subject to US legal process. This extends the exposure beyond meetings to telecommunications.

Zoom is one of 753 tools in the Upper Harbour Sovereignty Index. Video conferencing is just one layer — Slack, Jira, and Dropbox may also be exposed. Map the full picture.

Map your entire SaaS stack to parent jurisdictions and CLOUD Act exposure in 10 minutes.
Map Your Stack →

Alternatives & Comparison

▾
ToolOwnershipCLOUD ActCDN ResidencyE2EE
ZoomUS (Delaware)ExposedNoOptional (limited)
Microsoft TeamsUS (Microsoft)ExposedAvailableAvailable
Google MeetUS (Alphabet)ExposedAvailableNo
Jitsi MeetOpen sourceSelf-hostedFull controlYes

Based on Upper Harbour Sovereignty Index data. March 2026.

Key finding: All major cloud video platforms are US-incorporated. Microsoft Teams offers Canadian data residency that Zoom does not. For maximum sovereignty, self-hosted Jitsi Meet on Canadian infrastructure provides full control with E2EE. No major Canadian-headquartered video conferencing platform exists.

💬Questions about Zoom and Canadian compliance?

We help organizations assess jurisdictional risk across their SaaS stack. Book a call or send us a message.

Book a Call → Email Us →

Mitigation Options

▾
  • Enable E2EE for sensitive meetings: The strongest available safeguard. Accept the feature trade-offs (no cloud recording, no AI Companion, no breakout rooms) for meetings involving regulated personal information.
  • Disable AI Companion for sensitive contexts: AI Companion processes meeting content through US infrastructure. Disable it for meetings involving health data, legal matters, or confidential client information.
  • Use local recording only: Avoid cloud recording for meetings with sensitive content. Local recordings stay on your device and are not subject to Zoom's data handling.
  • Restrict Zoom Phone for sensitive calls: If using Zoom Phone, establish policies about what categories of calls should use alternative channels.
  • Document the dual posture: Your TIA should note both the genuine E2EE protection and the metadata/recording/AI exposure. This is a more nuanced assessment than most tools require.

Bottom line: Zoom's E2EE is a real mitigation — unusual among US SaaS tools. But it's opt-in, limited, and doesn't cover the most common use case (recorded meetings with AI features). For most organizations, the practical path is documenting the exposure, using E2EE for sensitive meetings, and restricting AI features where privacy matters most.

Frequently Asked Questions

▾

Is Zoom subject to the US CLOUD Act?

Yes. Zoom Video Communications is Delaware-incorporated (NASDAQ: ZM). All data — metadata, recordings, transcripts, chat — is subject to US legal process.

Does Zoom offer Canadian data residency?

No. Zoom does not offer Canadian data residency on any plan tier. All data is stored on US infrastructure.

Does Zoom's E2EE protect against the CLOUD Act?

Partially. E2EE protects live meeting content — Zoom cannot access it. But metadata (participants, timing, duration), chat messages, cloud recordings, and AI-processed data remain fully exposed. E2EE must be enabled per-meeting and disables many features.

Can I use Zoom AI Companion with E2EE?

No. AI Companion and E2EE are mutually exclusive. You cannot use both simultaneously. AI Companion processes content on US infrastructure.

Do I need a TIA for Zoom under Law 25?

Yes. Zoom is US-incorporated with no Canadian data residency. A TIA is required for any Quebec organization using Zoom that processes personal information in meetings.

Methodology: This assessment is based on Zoom's SEC filings, vendor documentation, published security practices, and the Upper Harbour classification methodology. Data verified March 2026. Updated quarterly. Part of the Canadian Technology Sovereignty Index.