Zoom 5.0 fixed the vendor layer; configuration and records stayed yours

The week

On April 22, 2020, Zoom announced version 5.0 of its video meeting software, three weeks into a freeze on new features. That spring, offices had emptied almost overnight. An app that many executives had barely used in January was suddenly carrying board meetings, court hearings, classrooms and conversations with patients. In a matter of weeks it went from a convenient tool to something close to critical infrastructure, with all the scrutiny that comes with that role.

The scale of the shift was visible in the company’s own numbers. In an April 1 letter to users, Zoom’s chief executive wrote that daily meeting participants had grown from about 10 million in December 2019 to more than 200 million in March 2020. Most of that growth came from people and institutions that had never been through any procurement process with the company. Many had signed up with a work email address and a free account.

A month of scrutiny

The scrutiny was intense. As schools, government bodies and businesses piled onto the platform, there were widely reported incidents of uninvited participants dropping into meetings and disrupting them. At the end of March, the FBI’s Boston field office warned about the hijacking of teleconferences and online classrooms. It advised keeping meetings private, using passwords or waiting rooms, not posting links publicly and limiting screen sharing to the host.

Security researchers also questioned the company’s claims about encryption, the mathematical scrambling that keeps a conversation unreadable to anyone who intercepts it. On April 3, researchers at the Citizen Lab at the University of Toronto published an analysis of Zoom meetings. They reported that, in their tests, meetings used a single AES-128 key in a mode called ECB, shared by all participants. Zoom’s documentation had advertised AES-256. The researchers also found that encryption keys were sometimes sent through servers in China, even for meetings with no participants there. Zoom said that routing had happened in limited circumstances and changed it.

The ECB finding mattered to specialists for a concrete reason. ECB encrypts identical blocks of data in identical ways, so patterns in the original can survive into the scrambled version. It is a well-known weak choice for anything as repetitive as video.

Some organizations restricted the platform in April while they assessed the risks. New York City’s education department, the largest school system in the country, told its schools early that month to move away from Zoom. Other public bodies and companies issued their own limits. Each restriction pushed users toward other tools, often ones that had not been assessed either.

The company’s response

Zoom responded in steps. On April 1 it announced a 90-day freeze on new features so its engineers could concentrate on security and privacy. In mid-April it let administrators of paid accounts choose which regions’ data centers handled their meetings’ real-time traffic. Then, on April 22, 2020, it announced Zoom 5.0.

The release did three main things. It added support for AES 256-bit GCM encryption. AES is a widely trusted standard for scrambling data. “256-bit” describes the length of the secret key, and therefore how hard it is to guess. GCM is a way of using AES that also reveals whether anything was tampered with along the way. Zoom said the new encryption would be switched on across its system on May 30, after which only updated software could join meetings.

Second, it gathered a meeting’s security controls behind a single security icon, so a host under pressure could find them in one place instead of hunting through menus. Third, it changed the defaults, the settings a product ships with before anyone touches them, turning on waiting rooms and meeting passwords for many accounts. A waiting room holds arriving guests in a virtual lobby until the host lets them in. A password means that having the link is not, by itself, enough to join.

The announcement also cited more than 300 million daily meeting participants. Within days the company clarified that the figure counted participants, so one person joining several meetings counted several times. It did not count unique users. The correction was minor, but it fed a sense that the company’s public statements needed checking.

Guidance from the government side

Two days after the release, on April 24, the National Security Agency published guidance on selecting and safely using collaboration services for telework. It was written mainly for government employees and service members. It set out criteria such as end-to-end encryption, strong and testable encryption standards and multi-factor authentication, and compared commercial products against them. The NSA noted that its comparison relied on what vendors said about their products, not on its own testing.

Health care providers were working under a different signal. Since mid-March, the HHS Office for Civil Rights had said it would not penalize covered providers for good-faith use of non-public-facing video tools for telehealth during the emergency. That notice named Zoom among the acceptable products. It relaxed enforcement; it did not change what HIPAA required once the emergency ended.

These are simple ideas, and they matter precisely because most people never change the settings they are given. In banking, health care and government, Zoom 5.0 was welcome news. It also raised a question that was easy to miss amid the headlines: how much of the risk was actually the vendor’s to fix, and how much belonged to the organizations using it?

In April 2020, the debate about video conferencing security focused on one vendor. That obscured a more useful way of dividing up the responsibility. The security of a meeting depends on three layers: what the vendor builds, how the customer configures it, and what the customer must keep. Zoom 5.0 addressed the first. Banks, health systems and agencies owned the other two, whichever platform they used, and those two carried most of their compliance risk. Each layer calls for different questions, different owners and different evidence.

Video platforms work like a rented office. The landlord is responsible for the front-door locks, the fire alarms and the wiring. The tenant decides who gets a key, whether the conference room door is left open and where the files go at night. A landlord who upgrades the locks has done something worthwhile without changing who in the tenant’s firm is handing out keys, or what happens to the paperwork.

The analogy has limits. A landlord cannot change the tenant’s furniture, but a software vendor can and does change the product under its customers every few weeks. That makes the boundary between the layers move, and it is one reason the customer’s layers need their own routines rather than a one-time setup.

What follows starts with how a video meeting works, because the three layers only make sense once the plumbing is clear. It then takes each layer in turn and follows one hypothetical bank through all three. It closes by assigning each risk to an owner, listing what a well-run program has in place and setting out the questions that test it.

What actually happens when you join a video meeting

When you click a meeting link, the app on your laptop or phone captures your camera and microphone, breaks the sound and picture into small packets of data, and sends them over the internet. In most business platforms those packets do not travel directly to the other participants. They go to the vendor’s computers, usually called servers, in data centers in various parts of the world. The servers mix and forward the streams so that everyone sees and hears everyone else. Which data centers your traffic passes through, known as routing, attracted attention in 2020 because it determines whose computers handle your conversation and in which countries.

Encryption, and where the keys live

Encryption protects those packets on their journey. Data is scrambled with a key before it leaves your device and unscrambled by something that holds the matching key. There is an important distinction here that the 2020 debate brought into the open. With ordinary encryption “in transit,” the data is protected on the wire, but the vendor’s servers can unscramble it in the middle. With end-to-end encryption, only the participants’ devices hold the keys, so even the vendor cannot read the content.

The second is stronger, but it limits features that depend on the vendor seeing the content. Cloud recording, live transcription and joining by ordinary telephone all need a server that can read the stream. Neither model is wrong; they suit different meetings. A board session on a pending acquisition and a recorded training webinar call for different choices.

The mode of encryption matters as much as the key length. The weakness researchers found in early 2020 was partly about ECB mode, which leaks patterns. The 128-bit key was a smaller part of the problem. GCM, the mode Zoom moved to, adds a check that detects tampering. A security team gets more from asking which algorithm and mode are used, who generates the keys and who can obtain them, than from counting bits.

Meeting IDs, links and passwords

Most of the disruption that spring did not involve breaking any encryption. It involved getting into meetings. Many meeting IDs were short strings of digits, and researchers showed that automated tools could guess valid ones. Links were also posted on public websites and social media, sometimes by the organizers themselves.

Passwords closed much of that gap, but with a twist. To keep joining easy, many platforms can embed the password in the meeting link itself. That helps legitimate guests and does nothing against someone who obtains the full link. The protection depends on how the link is handled, which is a customer decision.

Clients, updates and the version problem

The software on each device matters too. Desktop apps, mobile apps, browser clients and conference-room systems each run their own version. Security fixes only take effect when devices update. Zoom’s plan to switch on its new encryption system-wide on May 30 meant older clients would stop working after that date.

For a household, that meant clicking “update.” For a hospital with locked-down clinical workstations, or an agency whose software must pass an approval list before installation, it meant a deployment project on a deadline. Organizations that managed their devices centrally could push the new version in days. Those relying on staff to update personal laptops could not be sure who would be able to join on May 31.

Settings and content

Then there are defaults and settings. A platform offers dozens of switches: who can share their screen, whether guests can join before the host, whether meetings can be recorded and where recordings are stored, whether chat can be saved. An organization with an enterprise account can set these centrally for everyone and lock them so individual users cannot change them. An organization that simply lets staff sign up on their own gets whatever the vendor shipped, multiplied by however many people did the signing up.

Finally, meetings produce content: recordings, chat messages, transcripts and shared files. In regulated industries, some of that content counts as a business record, with legal rules about keeping it. That content is where the third layer begins.

The vendor layer: encryption, routing and defaults

The vendor controls how traffic is encrypted, where it is routed, how keys are managed and what the product does out of the box. Zoom 5.0 improved encryption and tightened defaults. Those are real gains, and defaults matter because many users never change them. A vendor’s fixes, however, apply to every customer equally. They cannot reflect the specific obligations of a broker-dealer, a hospital or a court.

The questions and the evidence

For procurement and security teams, the questions about this layer are familiar: independent assessments, encryption design, data location, subprocessors and incident notification terms. A subprocessor is simply another company the vendor relies on to deliver its service, such as a cloud hosting provider, whose staff and systems may also touch your data. Incident notification terms set out how quickly the vendor must tell you if something goes wrong.

The evidence usually comes as a package. It typically includes an independent audit report such as a SOC 2 Type II, which tests whether stated controls operated over a period, and certifications such as ISO 27001. It may also include a summary of recent penetration tests and a written description of the encryption and key management design. A reviewer should read the exceptions and scope sections of those reports as closely as the cover page. A report that excludes the meeting service, or covers a different product line, proves little about the tool in use.

Which rules shape vendor review

The rules that frame vendor review differ by sector. Federal agencies generally need cloud services to hold a FedRAMP authorization at an appropriate impact level, which is why several vendors run separate government editions of their platforms. In 2020, banks worked under their regulators’ separate third-party risk guidance. The federal banking agencies later combined that guidance into a single interagency document in June 2023. Credit unions answer to the NCUA and their state supervisors, with similar expectations about knowing what vendors do with member data.

Health systems need a business associate agreement with any vendor that handles patient information, once normal HIPAA enforcement applies. State and local agencies may face state procurement rules, and, where a meeting would carry criminal justice information, the FBI’s CJIS Security Policy. Most video meetings do not involve such information, but a sheriff’s office or a court that uses video for certain proceedings should check before assuming so.

Assessing after the fact

In April 2020 many organizations had adopted platforms before asking any of these questions. That was understandable; staff had to keep working. The right response was to complete the assessment afterwards and record the result, instead of treating widespread use as approval. Where an assessment found gaps, the options were contractual commitments, compensating configuration, or restricting the platform to lower-risk uses. A regulator or auditor looking back will rarely criticize an organization for moving fast in a crisis. They are far more likely to ask why, months later, nobody had gone back to check.

A sensible after-the-fact review records three things. It records the date the tool entered use and who authorized it. It records the assessment, with its findings. And it records the decision with any conditions. One example is “approved for internal meetings; not for patient care until a business associate agreement is signed.” That short record is what an examiner will ask to see.

The vendor’s behavior as evidence

Some questions about this layer can only be answered over time. A vendor’s response to criticism, the speed of its fixes and the honesty of its public statements are evidence about how it will behave in the next incident. Recording those observations in the vendor file, alongside the formal assessment, gives the next renewal decision something more than a questionnaire to work from. Contract terms can reinforce this, with commitments to notify customers of material security changes and to support independent testing.

Someone also has to watch the vendor between renewals. Most large platforms publish security bulletins and release notes, and many offer status pages and advisory mailing lists. Assigning a named person to read them, and to log which bulletins required action, turns the vendor file into a living record. It also gives the configuration owner early warning of features that are about to arrive switched on.

Contracts can also secure the customer’s exit. A clause guaranteeing export of recordings, chat logs and account data in a usable format, within a set period after termination, keeps the records layer intact if the organization later changes vendors. Without it, years of recordings can become hostage to a renewal negotiation.

The trade-off in switching vendors

The obvious reaction to bad headlines was to ban the platform. Some organizations did, and a few reversed course within weeks. A ban has costs. Staff who still need to meet will use something, and the replacement may be less assessed than the tool it replaced. A bundled platform from an existing supplier can reduce the number of contracts, but it concentrates dependency on one vendor and does nothing for the other two layers. Switching makes sense when the vendor layer is unfixable for a given use. It rarely makes sense as a substitute for configuration and records work that every platform needs.

The configuration layer: settings the customer owns

Most of the disruptive incidents that spring involved meetings that were public, unauthenticated or shared on social media. “Unauthenticated” means nobody had to prove who they were to get in. Account-level settings could prevent many of them. Internal meetings could require a corporate sign-in. Screen sharing could be limited to hosts. Recording could be restricted to approved users and stored in a managed location. External participants could be held in a waiting room.

In regulated organizations, those settings should be centrally managed and locked where needed. Letting each user set their own policy produces as many policies as users. A workable model has a named platform administrator, a documented baseline, integration with the organization’s identity provider, and a periodic check that the baseline is still in force.

One baseline, or several

A single baseline is rarely enough. Most organizations need a few profiles, applied to groups of users. A health system might set one profile for clinical visits, one for internal staff meetings and one for public events such as community health forums. A county might separate internal meetings from public board meetings, which are often subject to open meetings laws. A bank might separate retail staff from licensed brokerage representatives, whose communications carry supervision duties.

Each profile settles the same short list of points:

• who can host, and whether participants must sign in;
• who can share screens, send files or use chat;
• whether meetings can be recorded, by whom, and where the recording goes;
• whether third-party apps may run inside meetings.

Public meetings often suit a webinar format, in which attendees can watch and listen but cannot share screens or speak unless promoted by a host. That format prevents most disruption without excluding the public.

Identity and the leaver problem

The identity provider deserves a word of explanation. It is the system that holds the official list of who works for you and lets them prove it, typically with a password plus a second check such as a code on their phone. When a meeting platform is connected to it, staff sign in with their work account rather than a separate username. Identity integration does double duty. It applies strong authentication, and it removes access automatically when someone leaves. Without it, a departed employee can keep a working account on a platform holding years of recordings, and nobody notices until something goes wrong.

Two mechanisms do most of that work. Single sign-on, usually through the SAML or OpenID Connect standards, routes every login through the identity provider. Automated provisioning, often through a standard called SCIM, creates and removes platform accounts as people join, move and leave. Single sign-on without provisioning still leaves orphaned accounts and stored content behind when people depart.

Most enterprise platforms also let an organization verify its email domain and bring accounts that staff created on their own into the managed account. In 2020 that step often surfaced hundreds of self-created accounts at a single institution. Each held its own settings and, sometimes, its own cloud recordings.

Drift, and how to check for it

Configuration also drifts. Meeting platforms ship new features often, and some arrive switched on: cloud recording, transcription, file transfer, or third-party apps inside meetings. An administrator who reviews release notes and sets each new feature before users discover it keeps the baseline meaningful. For a small organization this can be a short monthly checklist. The aim is to make sure someone with authority has decided, deliberately, whether each one is on or off, rather than to block every new capability.

Checking can be mechanical. Most platforms expose their settings through an administrative interface or an API, so the current configuration can be exported and compared with the written baseline. A useful short set of measures covers four things. The first is the share of active accounts under the managed domain. The second is the number of locked settings that differ from the baseline. The third is the count of accounts still active after their owners left. The fourth is how long new features sat unreviewed. Those four numbers tell an auditor more than a policy document can.

The friction trade-off

Accessibility belongs in the baseline too. Federal agencies must meet Section 508 accessibility requirements for the technology they use, and many state and local bodies have similar duties. Captioning, keyboard navigation and dial-in options affect who can take part. Turning off telephone dial-in to tighten security, for example, can exclude people without reliable broadband. A baseline written only by security staff tends to miss these effects, so the people who run public services should review it before it is locked.

Every control adds friction for someone. Requiring sign-in is easy for staff and hard for patients, members of the public and clients. A waiting room slows the start of every meeting. Host-only screen sharing frustrates collaborative work. The answer is to set friction by meeting type, not to remove it everywhere. Patient visits can use a waiting room and a per-visit link instead of sign-in. Public meetings can use webinar mode. Internal meetings can require corporate sign-in, which costs staff almost nothing once single sign-on works.

The records layer: what must be kept, and for how long

Meetings generate chat messages, recordings, transcripts and shared files. Depending on the sector, those can be regulated records. Broker-dealers must preserve business communications under SEC and FINRA rules, which can reach chat inside meeting tools used for business. Health care providers using video for patient care need a business associate agreement with the vendor once normal HIPAA enforcement applies, and must protect recordings as health information. A business associate agreement is the contract, required under the federal health privacy law known as HIPAA, in which a vendor that handles patient information commits to protecting it. Government agencies may be subject to public records and retention laws that cover recordings and chat.

Who is bound by what

Precision matters here, because the rules differ sharply by type of firm. Broker-dealers are subject to SEC Rule 17a-4 and FINRA’s books-and-records and supervision rules. Registered investment advisers, including many wealth managers, have a separate SEC recordkeeping rule for advisers. A bank or credit union without a brokerage affiliate is not bound by 17a-4. It still has retention duties for particular records, litigation hold obligations and examiner expectations about documenting decisions. A bank with a brokerage subsidiary may face both sets of rules in the same meeting.

In health care, a recording of a patient visit is protected health information. If it is used to make decisions about the patient, it may also fall within the records a patient has a right to access. State medical record laws add their own retention periods. Federal agencies work under the Federal Records Act and National Archives guidance, and state and local bodies under their own public records and retention schedules. Organizations should check with counsel which of these reach meeting content in their case.

Making the decision

The control is a decision for each platform about which content is captured, where it is stored, how long it is kept and who can reach it. Records management and compliance teams should make it with IT, not after IT. Disabling features that create records the organization cannot manage is a legitimate choice. So is enabling capture and archiving, if the organization can supervise and produce what it keeps. Leaving the choice to individual users is the one option that fails every test.

Keeping too much is also a risk. Every stored recording is something to protect, to search in litigation and to disclose under a public records request. A retention schedule that deletes routine recordings after a set period, unless they are on hold or designated as records, limits that exposure. The schedule has to be written down and applied consistently to be defensible.

The mechanics of keeping

Retention needs mechanics as well as policy. Recordings should flow to a managed archive with legal hold capability, not sit in personal cloud folders. A legal hold is the ability to freeze specific records so they cannot be deleted while litigation or an investigation is under way. Chat logs need the same treatment. Supervision for broker-dealers means someone reviews the captured content against written procedures. For agencies, it means records officers can find and produce a recording when a public records request arrives. Each of these depends on the configuration decisions in the previous layer being enforced, with evidence to show it.

The plumbing is usually a connector from the meeting platform to an archive, either built into the platform’s compliance features or supplied by an archiving vendor. The archive applies retention labels, supports search and export, and logs who viewed what. A test of the whole chain is simple to describe and often revealing to run. Hold a meeting, send a chat, record it, then ask the compliance team to find all three in the archive a week later.

The second-order effect of switching chat off

Disabling chat has a known side effect. Staff who need to send a quick message during a client call will use something else, often their own phone. A firm that switches off an archivable channel without offering an approved alternative may push business conversations into texting and personal messaging apps. Those are exactly the channels that later drew the heaviest enforcement. The records decision therefore has to look at the whole set of channels staff use, not one tool at a time.

The records decision depends on the configuration layer, and both depend on knowing which platforms are in use. Many organizations in 2020 ran several meeting tools at once, adopted by different departments in the rush to remote work. Each extra platform multiplied the baselines to maintain and the archives to supervise. Consolidating to one or two approved platforms was often the cheapest way to make the other controls workable.

One bank, three platforms, three layers

Consider a hypothetical regional bank with a small brokerage arm. In March 2020 its staff, like everyone else’s, went home. The retail team started using one meeting platform because a branch manager already had an account. The brokerage advisors picked another because clients asked for it. Head office used a third, bundled with its email system. Within a month, the bank had three platforms, a few hundred individual accounts, and no single view of any of them.

The vendor layer, in a few weeks

When headlines about meeting security appeared, the bank’s first instinct was to ask whether its main vendor was safe. That was the vendor layer, and it was a fair question. The security team pulled the vendor’s independent assessment reports, reviewed its encryption design and data locations, and noted how quickly and candidly the vendor had responded to criticism. That took a few weeks and produced a clear file.

The team also checked the contracts. Two of the three platforms were on click-through terms accepted by individual staff, with no negotiated notification or data-export commitments. Moving them onto enterprise agreements was a procurement task with a clear owner and a deadline.

Configuration and records, over a quarter

The harder work was the other two layers. On configuration, the bank found that many meetings had no password, that any participant could share their screen, and that some advisors were saving recordings to their personal laptops. It appointed one administrator per platform, connected each platform to its identity provider, wrote a one-page baseline and locked it. Verifying its email domain pulled dozens of self-created accounts into central management.

On records, the compliance team realized that brokerage advisors had been using meeting chat to discuss client trades. Those messages were business communications the firm had to preserve. Nobody had been capturing them. The team worked with counsel on what the gap meant for the firm’s obligations, and documented the remediation.

The bank made three decisions. It consolidated to two platforms. It switched off chat on the platform it could not archive, and switched on capture and archiving on the one it could. And it sent every advisor a short note explaining what had changed and why, including which channel to use for quick client messages. Nothing here depended on what any vendor shipped; all of it would have been needed even with a flawless vendor.

The same pattern elsewhere

A public-sector version of the story looks similar. Say a county board begins holding public meetings by video, and the county clerk then receives a public records request for the chat from one of those meetings. Whether the county can answer depends entirely on whether anyone decided, in advance, where chat was stored and for how long.

A health system’s version turns on agreements and locations. A clinic that began video visits on a free account in March 2020 was within the federal enforcement relief at the time. Its exposure was later. If recordings existed, they were patient information sitting on an account without a business associate agreement and outside the health system’s retention controls. Moving clinical video onto a contracted, managed account, or onto a telehealth module integrated with the electronic health record, resolved both problems. A small ambulatory network with no records staff had less capacity to do this than a large system, which is an argument for choosing tools that keep recordings off by default.

Putting each risk with its owner

The three-layer view is useful because it puts each risk with the person who can actually manage it. The vendor layer belongs to procurement and the security team, and it is mostly managed through due diligence and contracts. The configuration layer belongs to IT, with a named owner and a baseline that someone checks. The records layer belongs to compliance, legal and records management, working with IT.

Where the money and reputation are

The money and reputation at stake are concentrated in the second and third layers. A meeting disrupted by an uninvited guest is embarrassing; a meeting where a stranger hears confidential client or patient information is a privacy incident with notification duties. A brokerage that cannot produce chat messages a regulator asks for faces enforcement, whichever platform those messages lived on. A hospital that stores patient video on a service without the right agreement in place has a compliance problem it created itself. An agency that cannot find a recording in response to a public records request has a trust problem with the people it serves.

There is also a cost dimension that is easy to underestimate. Every platform an organization tolerates adds a baseline to maintain, an administrator to staff, an archive to buy and a set of records to supervise. Allowing departments to choose their own tools feels cheap at first. Over a year, those extra baselines, administrators, archives and reviews usually make it the more expensive option.

The evidence each owner should hold

Each owner should be able to produce a small set of documents on request. Procurement and security should hold the assessment, the contract and the notes on vendor behavior. IT should hold the baseline, the latest configuration export and the record of feature decisions. Compliance and records should hold the retention decision, the archive test results and, for broker-dealers, evidence of supervisory review. An internal audit team can test all three in a few days if the documents exist. If they do not, the gap itself is the finding.

The strongest objections

Three objections deserve a direct answer. The first is that the vendor layer is where catastrophic risk lives. A platform-wide breach could expose every customer at once, and no configuration would prevent it. That is true, and it is why vendor assessment stays on the list. Yet the documented harms of that spring were mostly disruptions of unprotected meetings, and the largest penalties that followed concerned records. Frequent, organization-specific failures add up to more exposure than rare platform-wide ones.

The second objection is that end-to-end encryption everywhere would remove the problem. It would remove some vendor-layer risk. It would also break cloud recording and archiving, which some firms are required to have. For a broker-dealer, an unarchivable channel used for business is itself a compliance failure. Encryption choices belong to the records owner as much as the security team.

The third objection is that a single bundled suite from an existing supplier removes the need for all this. Consolidation helps, and the argument here favors it. But a bundled suite still has settings to lock and records to keep. It reduces the number of times the work must be done; it does not remove the work.

Approved, assessed, locked and archived

The organizations that handled this well had a short list of things in place:

• A short list of approved collaboration platforms, each with a named owner.
• A completed and recorded security assessment for each, including notes on how the vendor behaves when things go wrong.
• Enterprise contracts covering incident notification, data location and export of content at exit.
• A written configuration baseline, with profiles for different meeting types, enforced centrally and tied to the identity provider, so joining and leaving the organization automatically controls access.
• A deliberate decision, made jointly by compliance, records and IT, about which content each platform captures, where it goes and how long it stays.
• A routine, even a monthly checklist, for reviewing new features before they reach users.
• A periodic end-to-end test showing that a recording and a chat message can be found in the archive.

The failures are equally recognizable:

• Treating a vendor’s security announcement as the end of the matter, when it only addresses the first layer.
• Treating widespread adoption as approval, so that a tool used by half the organization has never been formally assessed.
• Leaving recording, chat and storage settings to individual users.
• Writing a policy but never checking whether the platform’s actual settings match it.
• Switching off an archivable feature without offering an approved alternative, so staff move to personal messaging.
• Assuming that because a platform is used for “just meetings,” it creates no records.

Who owns the settings and the records

The questions below cut across all three layers. Each has a named owner, and each answer should be backed by a document rather than a recollection.

1. Which video and chat platforms are our people actually using for work today, including ones adopted by individual departments?
2. Are our meeting settings set centrally and locked, or can each user change them?
3. Is every platform connected to our identity provider, so that access ends automatically when someone leaves?
4. Which meeting content, if any, counts as a business, health or public record for us, and who decided?
5. If a regulator, auditor or member of the public asked for a specific meeting’s chat from last month, could we find and produce it, and does anyone know where it is stored?

The answers do not depend on any single vendor’s next release. Vendors will keep improving their products, which is welcome. Even so, the parts of meeting security that determine whether an organization stays on the right side of its regulators were always going to be the organization’s own.

With hindsight

Zoom kept its promises on the vendor layer at a steady pace. It acquired Keybase, a secure messaging company, in May 2020 to build end-to-end encryption. In October 2020 it began offering optional end-to-end encryption, the stronger form of protection in which only the participants’ devices hold the keys. As expected, turning it on disabled features that depend on the vendor reading the stream, such as cloud recording.

The regulators and the courts

In November 2020 the Federal Trade Commission announced a settlement with the company. The FTC alleged that Zoom had claimed 256-bit encryption while using a lower level. It also alleged that recordings had sat unencrypted on Zoom’s servers for up to 60 days before moving to encrypted storage. A further allegation concerned software installed on Mac computers that bypassed a browser safeguard. The order required a comprehensive information security program, with independent assessments every other year for 20 years. The commission approved it by a 3–2 vote; the two dissenting commissioners argued it did too little for affected users.

Private litigation followed a similar path. In 2021 Zoom agreed to pay $85 million to settle a consumer class action over privacy and meeting disruptions, and a federal court granted final approval in April 2022. The class excluded enterprise and government accounts. Both outcomes concerned the vendor layer, and both came after the company had already made most of the technical fixes.

Managed accounts became the norm

The platform remained widely used in government, health care and finance. It now usually ran under managed enterprise accounts, set up and controlled centrally by the organization rather than by individual staff. Organizations did not abandon the tool; they took ownership of how it was set up. The vendor kept improving, and the customers learned that improvements on the vendor’s side were necessary but never sufficient.

For health systems, the transition had a firm date. The HHS Office for Civil Rights ended its telehealth enforcement discretion when the public health emergency expired on May 11, 2023, with a 90-day transition that ran to August 9, 2023. After that, providers needed business associate agreements and normal HIPAA safeguards for the video tools they used with patients. Organizations that had moved clinical video onto contracted, managed accounts years earlier had little to do. Those still relying on accounts set up in the spring of 2020 had a deadline.

The records layer proved the larger issue

For financial firms, the records layer proved the larger issue. In December 2021, the SEC announced that JPMorgan’s broker-dealer had admitted widespread recordkeeping failures and agreed to a $125 million penalty. In September 2022 the SEC charged 16 Wall Street firms in a single sweep, and the CFTC brought parallel cases. By the time it announced its results for fiscal 2024, the SEC said the initiative had charged more than 100 firms and produced more than $2 billion in penalties.

Those cases centered on texting and messaging apps rather than meeting platforms. They confirmed that regulators hold firms responsible for records created on any channel staff are allowed to use for business. They also showed the second-order effect described above. Business moved to whatever channel was convenient, and firms were judged on whether they had captured it.

The rules themselves also moved. In October 2022 the SEC amended Rule 17a-4 to let broker-dealers keep electronic records under an audit-trail approach, as an alternative to the older write-once format. That made modern cloud archives easier to use. It did not reduce the duty to capture the records in the first place.

New features, same three layers

The lesson reaches beyond video conferencing. Every new collaboration tool, whether a messaging app, a shared workspace or an AI meeting assistant that produces transcripts and summaries, arrives with the same three layers. In August 2023, Zoom revised its terms of service after public criticism, stating that it would not use customers’ audio, video or chat content to train its AI models without consent. The episode showed how quickly a vendor-layer question about data use can become a customer-layer question about what to switch on.

AI summaries also create new content that may count as a record. A transcript or summary of a client call is a business communication for a broker-dealer and potentially part of the patient record for a clinic. Organizations that had a working records decision for chat and recordings could extend it to transcripts in weeks. Those that never made one faced the same question again, with more content at stake.

The vendor will publish its security story. The organization still has to decide how the tool is configured and which records it creates, and then prove that those decisions are enforced. The firms that ran into trouble were rarely undone by a vendor’s weakness. They were undone by channels their own staff used for business that nobody had brought under control. A leader who asks, for every new tool, “who owns the settings, and who owns the records?” is asking the questions that turned out to matter most.