Does ZoomMate train on your meetings? Not on your content by default. On cost, the honest answer has two halves: your paid Zoom plan already includes real AI — unlimited meeting summaries and AI note-taking from Pro upward, and a metered amount even on free Basic — but ZoomMate itself, the agent product, is a paid add-on on top of that, and it requires a paid base plan.

Plain-English risk rating: 2 of 5

Renamed 5 September 2026: Zoom now calls this product ZoomMate. The page we cite as its home reads “Meet ZoomMate, your AI teammate”, and the old name does not appear anywhere on it. We read that page in a browser on 5 September 2026 and have renamed it throughout this profile. Two things we deliberately did not rename: the titles of the source documents at the foot of this page, because a citation has to say what the document actually says; and the 2023 breach history, because the product carried the old name at the time.

Plan detail re-verified 5 September 2026, and it had moved. We read Zoom’s ZoomMate pricing page in a browser rather than trusting the marketing page. Two things this profile previously told you are now wrong and are corrected below. First, ZoomMate is not included with your paid Zoom plan. It is a separate licence at NZ$27.67 per user per month, billed annually as a single upfront charge, carrying 2,200 AI credits per user per month. Second, the free tier is not empty. ZoomMate Basic comes with Workplace Basic and is metered rather than absent: summaries for three hosted meetings a month, in-meeting questions on three, three uses of AI note-taking, twenty AI queries, ten workflow runs, and agentic search across ten files and three meetings.

For a ten-person firm already paying for Zoom, putting ZoomMate on every seat is roughly NZ$3,300 a year on top of the Workplace subscription. The rating below has not been moved — price is not a privacy fact, and the training and retention positions are unchanged.

We over-corrected on 5 September, and we are correcting that too. Yesterday this page said ZoomMate is “no longer included in the Zoom plan you already pay for”. Reading Zoom’s Workplace pricing page the following day showed that too blunt. A Pro subscriber does get substantial AI without buying anything else — unlimited meeting summaries, unlimited in-meeting questions, unlimited AI note-taking, agentic search inside Zoom. What the paid ZoomMate licence adds is the agent layer: credits, custom agents, research and reach into third-party sources. So the accurate statement is narrower than the one we published: the AI is not all gone behind a paywall, but the agent product is. We would rather show you both corrections than quietly land on the right answer.

We are also withdrawing our own scope note of 3 September 2026. It said this rating covered a product that does not exist on Zoom’s free plan. That is not true today, and it may not have been true when we wrote it. Zoom’s page now lists ZoomMate Basic as included free with Workplace Basic — metered rather than absent: meeting summaries for three hosted meetings a month, twenty AI queries a month, three uses of AI note-taking, ten workflow runs. The paid tier is a separate ZoomMate licence carrying 2,200 AI credits per user per month. We cannot tell you whether Zoom changed this or whether we read it wrong, and we are not going to guess between those. The rating below has not been moved and is being re-checked.

ZoomMate has one of the better privacy postures among Embedded Productivity AI products as of mid-2026, but this conclusion rests on Zoom's published commitments after a substantial reputational scar. In August 2023, Zoom's terms of service were updated with language that appeared to grant Zoom rights to train AI models on customer audio, video, and chat content. The Verge and ABC News coverage triggered immediate backlash; within weeks, Zoom revised the language and committed publicly that "Zoom does not use any customer audio, video, chat, screen sharing, attachments, or other communications-like customer content (such as poll results, whiteboard, and reactions) to train Zoom's or its third-party artificial intelligence models."

As of mid-2026, that commitment has been maintained and is referenced consistently across Zoom's AI documentation. The risk picture is dominated less by training defaults and more by (a) the breadth of meeting content Zoom captures, (b) the deployment-option choice between Zoom-only models and Zoom + third-party models, and (c) Zoom's broader breach history affecting the platform underneath ZoomMate.

Recommended for

Sole proprietor: Corrected 5 September 2026 — this line said ZoomMate is included at no additional cost with eligible paid Zoom plans. It is not. ZoomMate is a separate licence at NZ$27.67 per user per month on top of your Workplace plan, though the metered free tier (ZoomMate Basic) may cover light use. Acceptable for general meeting summaries and transcript generation. Disclose to meeting attendees that ZoomMate is enabled before the meeting starts — this is both ethical practice and may be legally required in two-party-consent jurisdictions for recorded content.
Small team (2-10 people): Zoom Workplace Pro or Business with ZoomMate. Configure the deployment option (ZMO, ZM+, or Federated) based on your data residency and provider preferences — Zoom-only Models (ZMO) is the most privacy-conservative.
Regulated industry: Zoom for Healthcare (with BAA), Zoom for Government (FedRAMP authorised), or Zoom Workplace Enterprise with EU Data Boundary configuration. Disable ZoomMate for any meeting involving PHI or other regulated data unless your contracted Zoom configuration includes appropriate safeguards.
The honest answer for most 1-10 employee businesses using Zoom, corrected 5 September 2026: the privacy posture is genuinely strong, but ZoomMate is not included with your existing paid plan — it is a separate licence at NZ$27.67 per user per month, on top of Workplace, with a limited free tier. The right practice is: enable it, configure the deployment option deliberately (default to ZMO if your team does not need the additional models), and add a one-line disclosure to meeting invites that ZoomMate is active.

Data retention default

ZoomMate meeting summaries: Stored per host's account; retention configurable
Smart Recording transcripts: Standard Zoom recording retention applies
Model provider retention: zero. Zoom states it has Third-Party Zero Data Retention agreements in place, so third-party model providers do not retain customer content at all, with limited exceptions for trust and safety such as detecting and reporting child sexual abuse material. A previous version of this profile said 30 days. That was wrong, and wrong in Zoom’s disfavour; corrected 11 August 2026. Zoom-hosted Models Only (ZMO) removes third-party processing from the path entirely.
Customer content used by ZoomMate features: Used only to provide the service; not used for training
Account-level controls: Admins can configure which ZoomMate features are available per account, group, or user

Training opt-out

NO TRAINING ON CUSTOMER COMMUNICATIONS CONTENT BY DEFAULT. Zoom's public commitment since the August 2023 policy clarification: no customer audio, video, chat, screen sharing, attachments, or other communications-like content used to train Zoom's or third-party AI models.

The commitment applies to both Zoom's own AI models and the third-party model providers (Anthropic via AWS Bedrock for ZM+ deployments, OpenAI for some features) under Zoom's contractual arrangements with them.

Feedback prompts opt-in: If users send feedback on ZoomMate experiences, the feedback content (including the prompt sent) may be used to improve the product experience but not for model training. This is opt-in per feedback submission.

Zero Data Retention availability

Zoom-only Models (ZMO): Most privacy-conservative deployment option; no third-party processing
Zoom-hosted Models Plus (ZM+): Adds Anthropic Claude via AWS Bedrock under Zoom's existing cloud arrangements; processing stays under Zoom's technical control
Federated: Third-party models accessed directly. Zoom states its Third-Party Zero Data Retention policies apply to the model providers used in the federated approach, so those providers do not retain customer content, with limited exceptions for trust and safety such as detecting and reporting CSAM. Corrected 2 September 2026: this line previously said “standard 30-day retention applies”, which contradicted the correction published in the retention section of this same page on 11 August 2026. The page asserted both at once for three weeks. Verified against Zoom’s AI technical library (Models, Processing, Storage and Usage) and Zoom’s ZoomMate privacy and security page, both read 2 September 2026.
Customers can reach Zoom support to select their preferred deployment option based on data residency and compliance requirements

Plan tiers and pricing (as of early 2026)

What you are buying	Price (NZD, excl. VAT)	AI you get
Workplace Basic	Free	Metered: meeting summaries for 3 hosted meetings a month, 20 AI queries a month, AI note-taking (My Notes) 3 uses a month, AI help me write 3 docs a month
Workplace Pro	NZ$24.99/user/month, billed annually	Unlimited meeting summaries, unlimited in-meeting questions, unlimited AI note-taking, basic AI queries, agentic search, workflows in Zoom, 8 custom summary templates a month
Workplace Business	NZ$30.42/user/month, billed annually	All of Pro; the step up is meetings, whiteboards, SSO and compliance rather than AI
Workplace Enterprise	Contact sales	All of Business
ZoomMate add-on	NZ$27.67/user/month billed annually, or NZ$33.20 billed monthly	2,200 AI credits per user per month; custom agents, agentic search across third-party sources, deep research, workflows beyond Zoom, AI Productivity Suite, Voice Translator

Read by eye from Zoom’s own pricing pages on 5 and 6 September 2026, which presented prices in New Zealand dollars. Zoom states that all add-ons require a paid base plan, so ZoomMate sits on top of Pro or above. Every plan is billed annually as a single upfront charge; monthly figures are the annual total divided by twelve, shown for comparison.

Corrected 5 September 2026. This paragraph previously said ZoomMate is bundled into eligible paid plans rather than sold as a per-seat add-on, and drew a contrast with Microsoft 365 Copilot on that basis. Zoom’s own ZoomMate pricing page now sells it per user. We read it in a browser on 5 September 2026: the paid tier is NZ$27.67 per user per month, billed annually, carrying 2,200 AI credits per user per month. So the structural contrast with Microsoft 365 Copilot no longer holds — both are now per-seat AI licences on top of the base product. What Zoom still has that Copilot does not is a free metered tier.

Jurisdiction

Primary processor: Zoom Video Communications, Inc., San Jose, California, USA
Cloud infrastructure: Multi-cloud (AWS, Oracle Cloud Infrastructure, Microsoft Azure, Google Cloud)
Third-party AI subprocessors: Anthropic (via AWS Bedrock), OpenAI for certain features
EU Data Boundary available for qualifying customers
Zoom for Government runs on AWS GovCloud with FedRAMP Moderate authorisation

Breach history (public incidents)

August 2023 — Terms of Service language controversy and reversal

The initial August 2023 ToS update included language broad enough to suggest Zoom could train AI on customer audio, video, and chat content. The Verge and ABC News covered the change; within weeks, Zoom reversed and committed publicly that no customer communications content would be used for training. The incident is more relevant as a transparency case study than as a breach — it demonstrates how easily privacy-relevant terms can shift and how few users actually read updates.

Sources: ABC News (August 2023); All About Cookies analysis; Basil AI policy review (February 2026)

Note on broader Zoom platform breach history: The April 2020 "Zoombombing" wave and the routinely-uncovered vulnerabilities in Zoom client software during 2020-2022 are the baseline platform context. Zoom has substantially invested in security since (Bug Bounty Program, end-to-end encryption for meetings, multi-cloud regional residency), and the 2023-2026 period has been notably quieter for Zoom-specific platform incidents. The risk picture for ZoomMate is dominated by ordinary Zoom-account-compromise risk amplified by AI summarisation — a compromised Zoom account now exposes both the call history and the AI-generated summaries.

Note on prompt-injection in transcripts: As ZoomMate processes meeting content, the same class of indirect prompt injection that affected Microsoft 365 Copilot (EchoLeak) applies in principle. A meeting participant could craft spoken content designed to manipulate ZoomMate's summary or follow-up actions. We are not aware of a publicly-disclosed Zoom-specific exploit of this class as of May 2026, but the category-level risk is present.

What this means in plain English for SMB owners

Three honest takeaways:

The privacy posture is genuinely better than most embedded AI products — but ZoomMate is no longer included with your existing paid plan. Corrected 5 September 2026: this line previously said there was no additional per-user cost. There is: NZ$27.67 per user per month, billed annually, with a limited free tier below it. What has not changed is the rest — no training on your content by default, and a deliberate deployment-option architecture that lets you choose data residency.

The August 2023 ToS incident is the reason to take Zoom's published commitments seriously rather than blindly. A vendor that has been publicly caught with overly-permissive language and reversed it under scrutiny is, in practice, more likely to be careful about future updates than one that has never been tested. But the same vendor could quietly update terms again — watch for material changes.

Disclose ZoomMate to meeting attendees before the meeting starts. This is both ethical practice and may be legally required in all-party consent jurisdictions (California, Washington, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire and Pennsylvania) when recordings or transcripts are generated, and their law may reach your call if a participant is sitting in one of them. Corrected 3 September 2026: this previously listed "the EU under GDPR" among the all-party consent jurisdictions. The GDPR is a lawful-basis regime rather than an all-party consent rule — consent is only one of its six bases, and often not the one an organisation relies on. New Zealand works the same way: under s216B(2) of the Crimes Act 1961 a participant may lawfully record, while the Privacy Act 2020 separately requires you to tell people what you are collecting and why. A one-line disclosure in the meeting invite plus a verbal notice at the start is the baseline practice.

Where your content actually goes

Zoom’s “federated” approach means ZoomMate does not run on one model. Zoom names the providers it uses, and several are vendors rated separately in this database:

Zoom-hosted models, Anthropic and OpenAI for general ZoomMate features.
Perplexity for certain web search results.
ElevenLabs to generate audio for Zoom Clips AI Avatars.
Google Gemini for Whiteboard image generation.
AWS (Amazon Rekognition) to moderate generated virtual-background images.

This is not a criticism — the zero-retention and no-training commitments extend to these subprocessors, and Zoom requires obligations equivalent to its own Data Processing Addendum. But it is worth knowing that enabling one product can route content to five companies, and that Zoom says the models in the federation can change at any time. If your policy names approved vendors, a federated product means the list underneath you moves. Choosing Zoom-hosted Models Only (ZMO) removes third-party processing from the path; ZM+ keeps Anthropic via AWS Bedrock. Customers must contact Zoom support to find out their current default and to change it.

It reaches further than Zoom meetings now

Three developments matter for a small business deciding what is in scope:

ZoomMate can attend meetings on other platforms. With a calendar integration it joins Google Meet and Microsoft Teams calls to produce summaries. Your Zoom AI can therefore be recording a meeting that is not on Zoom.
My Notes transcribes system audio, using voice-activity detection to offer a note when it hears a meeting — including in-person conversations and third-party apps. Hosts can end My Notes transcription for individual participants or everyone from the Participants panel.
ZoomMate on the web (ai.zoom.us) can connect Google Drive, OneDrive and both calendar systems. Once connected, that content is indexed and stored by Zoom. Uploaded local files are held seven days.

One detail worth knowing before it surprises you: meeting-summary emails are delivered via Twilio SendGrid, which takes random content samples of emails and retains them for seven days for anti-fraud purposes, processed in the US. If summaries of sensitive meetings are emailed rather than linked, that is a real, if small, exposure — and admins can choose to send a link instead of the full text.

Sources

Zoom AI Companion Security and Privacy whitepaper: https://www.zoom.com/en/products/ai-assistant/resources/privacy-security/ (whitepaper last updated 30 March 2026; verified 2026-08-11)
Zoom AI Companion data residency options blog: https://www.zoom.com/en/blog/ai-companion-data-residency-options/ (March 2026)
Zoom AI Companion for Contact Center privacy: https://www.zoom.com/en/products/ai-assistant/resources/privacy-security/zoom-contact-center/ (verified 2026-05-24)
ABC News: Zoom reverses policy about using customer data for AI training (August 2023)
Basil AI: Zoom AI Companion Privacy Policy review (February 2026)
University of Colorado Anschutz: Zoom AI Companion Security Features (educational institution deployment guide)
All About Cookies: Zoom AI Training analysis (September 2023, updated)

Related on AI Leakage

Compare all 29 AI tools in the risk directory — see how ZoomMate stacks up against the rest, tier by tier.
Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
Shadow AI vs AI leakage — why even approved tools like ZoomMate can leak data.
Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.