Zoom Security Policy

Interpretation

Words with capitalized first letters have meanings defined under the following conditions. The definitions have the same meaning whether written in singular or plural.

Definitions

For the purposes of this Zoom Security Policy:

• Application or Service means the Arena web application, the Arena Zoom Marketplace app, and related APIs operated by Position², Inc.
• Company (referred to as "the Company", "We", "Us" or "Our") refers to Position², Inc., operating Arena.
• Zoom Data means any data, content, or metadata obtained from Zoom via OAuth, Zoom APIs, webhooks, or the Zoom Marketplace app.
• Zoom Connection means an authorized OAuth or Server-to-Server credential that lets Arena call Zoom APIs on your behalf.
• Secret Token means the Zoom webhook secret used to validate inbound Zoom event signatures.
• Website refers to Arena, accessible from https://thearena.ai
• You means the individual accessing or using the Service, or the entity on behalf of which such individual is accessing the Service.

This policy covers security controls for:

• The Arena Zoom Marketplace app (user OAuth)
• Zoom Server-to-Server OAuth credentials you paste into Arena
• Zoom API requests Arena makes for workflows you enable
• Zoom webhook endpoints that start Arena workflows
• Storage of Zoom tokens, webhook secrets, workflow configuration, and execution logs

It does not cover Zoom's own products, accounts, or infrastructure. Report issues in Zoom's systems to Zoom under Zoom's disclosure process.

Zoom Marketplace OAuth

The Arena Zoom app uses Zoom user OAuth. You authorize Arena in Zoom; Arena never asks for your Zoom password. Access is limited to the scopes shown on Zoom's consent screen and listed in the Zoom setup guide.

We request only the scopes required for meetings, invitations, past participants, and cloud recordings. We do not request unused or unimplemented scopes.

Arena workspace access

Zoom connections live in an Arena workspace. Only members with permission to that workspace can use or remove the connection. Role-based access (RBAC) and least-privilege apply: a viewer cannot add or disconnect Zoom.

Server-to-Server OAuth

If you use a Zoom Server-to-Server app instead of the Marketplace app, you supply the client ID, client secret, and account ID. Those credentials are stored encrypted and used only to mint short-lived Zoom access tokens for workflows you configure. They are not interchangeable with the Marketplace OAuth app.

Reconnect and uninstall

You can rotate access with Reconnect without deleting workflows. Disconnect in Arena or Remove in Zoom deletes stored tokens. After uninstall, Arena cannot call Zoom APIs with that connection.

Arena stores Zoom OAuth access and refresh tokens, and any Server-to-Server client secrets you provide, encrypted at rest. Tokens are used only to authenticate Zoom API calls for the connection that owns them.

We apply these controls:

• Tokens and webhook Secret Tokens are not displayed in the workflow editor, execution logs, or API responses
• Tokens are refreshed automatically over TLS; they are not logged in plaintext
• Access is scoped to the workspace that created the connection
• Removing the app or disconnecting the integration deletes the stored tokens
• Human access to decrypted credentials is restricted to security, abuse, or legal investigations, and only when necessary

Arena does not keep a copy of your Zoom account. Meeting video and audio remain in Zoom unless a workflow you enable downloads a recording file into Arena for that run.

Zoom API traffic and the Arena application use TLS 1.2 or higher in transit. Zoom Data and credentials stored by Arena are encrypted at rest (AES-256). Enterprise plans may use customer-managed encryption keys (CMEK).

OAuth redirects complete on Zoom's authorization servers. Arena receives tokens only over HTTPS after you click Allow.

When you add a Zoom trigger (meeting started or ended, participant joined or left, recording completed, or all events), Zoom sends events to an Arena webhook URL.

Arena validates every Zoom webhook before a workflow runs:

• The webhook Secret Token from your Zoom app Features page must be configured on the trigger
• Arena verifies the x-zm-signature header using HMAC-SHA256 over v0:{timestamp}:{rawBody}, compared in constant time
• The x-zm-request-timestamp must be within a five-minute window to reject replayed requests
• Requests missing a signature, timestamp, or Secret Token are rejected

Do not share the Secret Token. If it is exposed, rotate it in Zoom and update the Arena trigger.

Zoom Connections are isolated by Arena workspace. Another tenant cannot read your tokens, recordings, or workflow logs.

Platform controls that apply to Zoom data include:

• Logical tenant isolation; no shared databases between tenants
• Separate encryption keys per workspace
• Least-privilege service access to stored secrets
• SSO (SAML 2.0) and MFA on Arena accounts, with SCIM provisioning where enabled
• Audit logging of connection, workflow, and administrative actions

Arena personnel do not browse Zoom meeting content, recordings, or participant lists as part of normal operations.

Execution logs record that a Zoom action ran (for example, create meeting or list recordings) and non-secret outputs you choose to pass to the next block. They do not include OAuth tokens, client secrets, or webhook Secret Tokens.

We monitor the Service for abuse, failed authentication, and availability issues, with alerting on security-relevant events. Full audit logs are available for workspace actions; SIEM export is available on eligible plans.

When you disconnect Zoom in Arena or remove the Arena app in Zoom:

• Stored OAuth tokens and Server-to-Server secrets for that connection are deleted or invalidated within 7 days
• Workflows that depended on the connection stop calling Zoom until you reconnect
• Zoom API Data associated with the connection is deleted or de-identified within 7 days
• Execution logs are retained for operations (90 days) and security investigations (up to 1 year)

The full Zoom data retention and protection schedule is in the Privacy Policy.

The Arena Zoom app runs on the same Arena platform described on the Security page, including:

• SOC 2 Type II (security, availability, and confidentiality)
• ISO/IEC 27001 information security management
• HIPAA-ready controls, with Business Associate Agreements available
• Annual independent penetration tests and continuous vulnerability scanning

Zoom Data processed for a workflow is used only to provide that user-facing feature. It is not used to train generalized AI/ML models.

If a security incident affects Zoom Connections or Zoom Data, we will investigate, contain, and remediate the issue. We notify affected customers within 72 hours of confirming a reportable incident, and we notify Zoom and regulators where required.

If you suspect unauthorized use of your Zoom connection, disconnect the integration immediately, rotate access in Zoom, and email noreply@thearena.ai.

Introduction

Position² is dedicated to preserving data security by preventing unauthorized disclosure of information. This policy gives security researchers instructions for vulnerability discovery on the Arena Zoom app and how to report findings. It also states how long we ask you to wait before public disclosure.

Guidelines

We request that you:

• Notify us as soon as possible after you discover a real or potential security issue
• Provide us a reasonable amount of time to resolve the issue before you disclose it publicly
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data
• Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or obtain data, establish command-line access or persistence, or pivot to other systems
• Once you have established that a vulnerability exists or encounter any sensitive data (including personal data, Zoom tokens, recordings, or trade secrets), stop testing, notify us immediately, and keep the data strictly confidential
• Do not submit a high volume of low-quality reports

Authorization

Security research carried out in conformity with this policy is deemed permissible. We will work with you to understand and fix the problem, and Position² will not pursue legal action in connection with good-faith research that follows these rules.

Scope

This policy applies to:

• https://thearena.ai and related Arena marketing pages
• The Arena web application
• Arena APIs used by the Zoom Marketplace app
• Zoom webhook receiver endpoints operated by Arena

Any service that is not listed above is out of scope. Vulnerabilities in Zoom, Zoom Marketplace, or other third-party products should be reported to that vendor. Email noreply@thearena.ai before testing if you are unsure whether a system is in scope.

Types of testing not authorized

• Network denial of service (DoS or DDoS) tests
• Physical testing (office access, tailgating) or social engineering (phishing, vishing)

Reporting a vulnerability

Email noreply@thearena.ai. Do not disclose the vulnerability publicly or to third parties. Include:

• Description of the vulnerability
• Place of discovery (URL, app, or API)
• Potential impact, especially if Zoom tokens or Zoom Data could be exposed
• Steps to reproduce (include scripts and screenshots if possible)

Reports may be submitted anonymously. Prefer English. We will acknowledge receipt within 2 business days and keep you updated on confirmation and remedy.

You are responsible for:

• Authorizing the Zoom app only for accounts and scopes your organization permits
• Protecting Arena account credentials, SSO, and MFA
• Keeping webhook Secret Tokens confidential
• Reviewing workflows before they create, update, or delete Zoom meetings or recordings
• Disconnecting Zoom when a teammate leaves or a connection is no longer needed
• Requesting Zoom admin pre-approval when your Zoom account requires it

We may update this Zoom Security Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Changes are effective when they are posted here.

For Zoom app security questions, incidents, or vulnerability reports:

• Position², Inc.
• Email: noreply@thearena.ai
• Website: https://thearena.ai
• Privacy Policy (including Zoom data and retention): https://thearena.ai/privacy
• Zoom app documentation: https://thearena.ai/documentation/zoom
• Security: https://thearena.ai/security

We typically acknowledge security reports within 2 business days.