Zoom 5.0 fixed the vendor layer; configuration and records stayed yours
Zoom’s April 2020 release improved encryption and tightened defaults after weeks of scrutiny. For banks, health systems and agencies, most compliance risk sat in two layers no vendor release could fix: how the platform was configured, and what meeting content had to be kept.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On April 22, 2020, Zoom announced Zoom 5.0. It added support for AES 256-bit GCM encryption, a security icon grouping meeting controls, and changes to defaults such as waiting rooms and meeting passwords for many accounts. The release came three weeks after the company announced a 90-day freeze on new features to focus on security and privacy. That freeze followed a surge in use by schools, government bodies and businesses, and widely reported incidents of uninvited participants disrupting meetings. Researchers had also questioned the company’s encryption claims and the routing of some traffic. Some organizations, including school districts and public bodies, had restricted use of the platform in April while they assessed the risks.
In April 2020, the debate about video conferencing security focused on one vendor. That obscured a more useful division of responsibility. The security of a meeting depends on three layers: what the vendor builds, how the customer configures it, and what the customer must keep. Zoom 5.0 addressed the first. Banks, health systems and agencies owned the other two, whichever platform they used, and those two carried most of their compliance risk. Each layer calls for different questions, owners and evidence.
The vendor layer: encryption, routing and defaults
The vendor controls how traffic is encrypted, where it is routed, how keys are managed and what the product does out of the box. Zoom 5.0 improved encryption and tightened defaults. Those are real gains, and defaults matter because many users never change them. A vendor’s fixes, however, apply to every customer equally. They cannot reflect the specific obligations of a broker-dealer, a hospital or a court.
For procurement and security teams, the questions about this layer are familiar: independent assessments, encryption design, data location, subprocessors and incident notification terms. In April 2020 many organizations had adopted platforms before asking them. The right response was to complete the assessment afterwards and record the result, instead of treating widespread use as approval. Where an assessment found gaps, the options were contractual commitments, compensating configuration, or restricting the platform to lower-risk uses.
Some questions about this layer can only be answered over time. A vendor’s response to criticism, the speed of its fixes and the honesty of its public statements are evidence about how it will behave in the next incident. Recording those observations in the vendor file, alongside the formal assessment, gives the next renewal decision something more than a questionnaire to work from. Contract terms can reinforce this, with commitments to notify customers of material security changes and to support independent testing.
The configuration layer: settings the customer owns
Most of the disruptive incidents that spring involved meetings that were public, unauthenticated or shared on social media. Account-level settings could prevent many of them. Internal meetings could require a corporate sign-in. Screen sharing could be limited to hosts. Recording could be restricted to approved users and stored in a managed location. External participants could be held in a waiting room.
In regulated organizations, those settings should be centrally managed and locked where needed. Letting each user set their own policy produces as many policies as users. A workable model has a named platform administrator, a documented baseline, integration with the organization’s identity provider, and a periodic check that the baseline is still in force. Identity integration does double duty. It applies strong authentication, and it removes access automatically when someone leaves.
Configuration also drifts. Meeting platforms ship new features often, and some arrive switched on: cloud recording, transcription, file transfer, or third-party apps inside meetings. An administrator who reviews release notes and sets each new feature before users discover it keeps the baseline meaningful. For a small organization this can be a short monthly checklist.
The records layer: what must be kept, and for how long
Meetings generate chat messages, recordings, transcripts and shared files. Depending on the sector, those can be regulated records. Broker-dealers must preserve business communications under SEC and FINRA rules, which can reach chat inside meeting tools used for business. Health care providers using video for patient care need a business associate agreement with the vendor once normal HIPAA enforcement applies, and must protect recordings as health information. Government agencies may be subject to public records and retention laws that cover recordings and chat.
The control is a decision for each platform about which content is captured, where it is stored, how long it is kept and who can reach it. Records management and compliance teams should make it with IT, not after IT. Disabling features that create records the organization cannot manage is a legitimate choice. So is enabling capture and archiving, if the organization can supervise and produce what it keeps. Leaving the choice to individual users is the one option that fails every test.
Retention needs mechanics as well as policy. Recordings should flow to a managed archive with legal hold capability, not sit in personal cloud folders. Chat logs need the same treatment. Supervision for broker-dealers means someone reviews the captured content against written procedures. For agencies, it means records officers can find and produce a recording when a public records request arrives. Each of these depends on the configuration decisions in the previous layer being enforced, not merely documented.
The records decision depends on the configuration layer, and both depend on knowing which platforms are in use. Many organizations in 2020 ran several meeting tools at once, adopted by different departments in the rush to remote work. Each extra platform multiplied the baselines to maintain and the archives to supervise. Consolidating to one or two approved platforms was often the cheapest way to make the other controls workable.
With hindsight
Zoom introduced optional end-to-end encryption later in 2020. In November 2020 the Federal Trade Commission announced a settlement with the company over allegations that it had misrepresented the strength of its encryption. The platform remained widely used in government, health care and finance, now usually under managed enterprise accounts.
The records layer proved the larger issue for financial firms. From late 2021, the SEC and the CFTC brought a long series of enforcement actions against financial firms for failing to preserve business communications sent through personal devices and messaging apps. Combined penalties ran well over a billion dollars. Those cases centered on texting and messaging apps rather than meeting platforms. They confirmed that regulators hold firms responsible for records created on any channel staff are allowed to use for business.