Zoom Sovereignty & Compliance Audit (EU, 2026)

Zoom Video Communications, Inc. is incorporated in the United States (San Jose, California).

**GDPR**: Zoom provides a Data Processing Addendum and has obtained various compliance certifications. Zoom offers EU data routing for meetings and webinars on paid plans, ensuring audio, video, and shared content are processed through EU data centres. However, some metadata and account data may still be processed in the US.

**CLOUD Act / Extraterritorial Access**: As a US company, Zoom is subject to CLOUD Act requests. Meeting recordings, chat transcripts, and metadata can be compelled by US authorities regardless of where they are stored. For organisations conducting sensitive board meetings, legal discussions, or strategic planning via Zoom, this represents material exposure.

**NIS2**: Organisations using Zoom for critical communications should assess whether disruption to or compromise of Zoom would impact essential service delivery under NIS2.

**DORA**: Financial entities should evaluate Zoom as part of ICT third-party risk assessment, particularly if used for client communications or internal decision-making processes.

**Vendor lock-in**: Zoom creates low to moderate lock-in. Video conferencing is relatively commoditised, and switching costs are primarily around user training and workflow adjustment rather than deep technical integration. Zoom Phone and Zoom Rooms deployments create higher lock-in.

**Auditability**: Zoom provides admin dashboards, usage reporting, and compliance archiving features on enterprise plans. End-to-end encryption (E2EE) is available for Zoom Meetings but with limitations—it disables some features and is not available for all meeting types.

**Lawful access exposure**: Meeting recordings stored in Zoom's cloud, chat messages, and metadata (who met whom, when, for how long) are all potentially accessible through legal process. Real-time interception of communications is a separate, more complex legal question.

**Switching cost implications**: Direct switching costs are low—alternative video conferencing tools are readily available. Indirect costs include user familiarity, calendar integrations, and Zoom-specific workflow automation.

European-headquartered video conferencing alternatives:

**Jitsi** (open-source, self-hostable): Fully open-source video conferencing deployable on EU infrastructure. Provides complete sovereignty when self-hosted. Trade-off: requires operational investment, fewer enterprise features, variable call quality at scale. Migration feasibility: easy.

**BigBlueButton** (open-source): Originally developed for education, increasingly used in enterprise. Self-hostable on EU infrastructure. Trade-off: education-oriented UX, requires hosting expertise. Migration feasibility: easy.

**Wire** (Switzerland/Germany): Enterprise messaging and video with end-to-end encryption. EU jurisdiction. Trade-off: smaller ecosystem, fewer participants per call. Migration feasibility: easy.

**Whereby** (Norway): Browser-based video conferencing with EU jurisdiction. Trade-off: limited enterprise features, smaller meeting capacity. Migration feasibility: easy.

**Nextcloud Talk** (Germany): Integrated into Nextcloud ecosystem. Self-hostable. Trade-off: video quality and features less mature than Zoom. Migration feasibility: easy.

Video conferencing is among the easier categories to migrate due to low lock-in and available alternatives.

**Fractional CTOs and technical advisors**: Zoom sovereignty is a frequent client question, particularly after high-profile security incidents. The low switching cost makes it an actionable recommendation.

**Engineering leaders**: Zoom's API and SDK integrations in custom applications create tighter coupling than standard meeting use. Assess these dependencies separately.

**Procurement and due diligence**: Zoom renewals should include sovereignty assessment, especially for organisations that conduct board meetings, legal discussions, or M&A conversations on the platform.