Zoom
Connect Zoom to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Zoom to collect communications platforms evidence with automated compliance tests, switched on per workspace.
| Category | Communications Platforms |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Zoom's guide | developers.zoom.us |
Connect with an API token
-
In Zoom:
- Sign in to your developer account on the Zoom App Marketplace (marketplace.zoom.us) as a user whose role has permission to view and edit Server-to-Server OAuth apps.
- Select the Developers link, select the plus sign next to Developer, and then select Build an app.
- Select Server-to-Server OAuth app and click Create.
- On the App credentials page, copy the account ID, client ID and client secret.
- Add information about your app (short description, company name, and developer contact name and email, which are required for activation).
- On the scopes page, choose Add Scopes and add the read-only admin scopes Safeguard needs for users, roles and account settings.
- Activate the app. If errors prevent activation, address them; no access token can be generated until the app is activated.
Where to find the other values:
- Account ID: The app's App credentials page in the Zoom App Marketplace shows the account ID.
- Client ID: The app's App credentials page shows the client ID.
- Access token (optional): Not shown in the UI. It is requested from Zoom's OAuth token endpoint with the account ID, client ID and client secret; it expires after one hour (3600 seconds), so the client secret is the better choice.
Zoom's public documentation does not cover every step.
The creating user needs role permissions to view and edit Server-to-Server OAuth apps and permissions for each scope added; admin-level scopes need admin-level role permissions. The exact scope names (user:read:list_users:admin, role:read:list_roles:admin, role:read:role:admin, account:read:settings:admin in the earlier draft) and whether the client secret stays visible were not on the fetched pages.
Source: developers.zoom.us, developers.zoom.us, checked 2026-10-07.
The permissions Safeguard needs:
user:read:list_users:admin,role:read:list_roles:admin,role:read:role:admin,account:read:settings:admin. Safeguard's compliance tests for Zoom need the credential on the API token tab: an OAuth connection cannot read everything they check. -
On Compliance › Connectors, open Zoom, click Connect, choose API token and fill in:
Field What to enter Account ID Optional. Client ID Optional. Client secret Optional. Stored encrypted and never shown again. Or, instead: Access token (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Zoom and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.5 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.4.2 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Communications Platforms connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks