Microsoft 365 and recording
Does Zime need organization-wide Microsoft 365 permissions, or can it be limited to some users?
The one-time admin consent includes two organization-wide permissions, both read-only, used only to receive Microsoft's notices that a recording or transcript is ready. Zime reads meetings only for organizers who sign in to Zime themselves, and you can limit who may sign in by requiring user assignment on the Zime app in Microsoft Entra ID. The Zime app for Teams can also be made available to selected people or groups only.
Do the permissions go beyond read access?
Zime makes one change, acting as the organizer: about 10 minutes before a meeting your recording settings select, it turns on Record and transcribe automatically. It does not create, move or cancel meetings, edit attendees or calendars, post messages, or touch files.
Which Microsoft 365 apps does Zime use?
Native recording uses Microsoft Teams meetings, Microsoft Entra ID sign-in, and each user's read-only Outlook calendar connection. It does not use Outlook mail, contacts, OneDrive, SharePoint, Teams chats or channel messages.
Can we turn on Teams native recording for one region or team only?
Yes. It goes by who sends the invite, not who attends. Have only the organizers in that region or team enable native recording; everyone else keeps the notetaker.
What does our admin need to do for the Zime mobile app under Intune?
Grant admin consent to the Zime Mobile enterprise app, add it to an Intune App Protection Policy for users who hold an Intune licence, and make sure the broker app is on the device.
We do not have a GitHub repository. Can we still use Zime skills in Claude?
Yes. Zime hosts a private repository and gives your Claude owner's GitHub account read access. You need that one GitHub account, not a repository of your own.
Your data and third parties
Which third parties receive our data?
Every provider, what it does, the data involved and where it runs is on the Sub-processors page. Zime does not sell customer data.
Which AI providers process our data, and for what?
Amazon Bedrock, Google Vertex AI, OpenAI, Anthropic, OpenRouter, Deepgram and ElevenLabs, each for a different job. The table on the AI data use page shows what each one receives.
Is our data used to train or fine-tune AI models?
No. Zime does not train or fine-tune AI models on your data or any other customer's data. We are happy to put this commitment in the DPA. Data shared with Zime's AI providers is used for service delivery and inference, not to train their models.
Where is our data stored? Can it live in our own cloud?
Account data, CRM data, transcripts and insights are on Amazon Web Services in US East (N. Virginia). Meeting recordings are with Backblaze or Google Cloud in the United States. Zime can also keep your meeting recordings and transcripts in an Amazon S3 bucket in your own AWS account; Zime sets this up per customer.
How long is data kept, and how is it deleted?
By default, Zime keeps each call recording for three years. Longer retention is available on request. Transcripts and insights are retained. When an admin asks Zime to delete data, it is deleted within one month. At the end of the contract, at your choice, Zime returns your personal data, or deletes it and certifies the deletion.
Do you have an architecture or data flow diagram?
Yes. The Security page shows how a conversation moves through Zime: record, match to your CRM, analyse, write back, and where each kind of data is stored.
Legal and assurance
Can we sign a Data Processing Agreement?
Yes. Send your template or use Zime's standard DPA. Zime's contracting entity is Inner Fit Research Inc.
How quickly do you tell us about a security incident? Can notices go to our security mailbox?
Zime notifies you within 48 hours of becoming aware of a personal data breach that affects your data. Yes, you can name a security contact or shared mailbox to receive these notices.
What is your latest penetration test, and what is the remediation status?
An independent test in August 2026. Every critical, high and medium finding was fixed and verified on retest, and the application was graded A+. The summary is available under NDA.
Which reports and policies can you share?
The SOC 2 Type II report, the penetration test summary and certificate, and Zime's security policies are shared under NDA. Request the reports through the trust center and the policies from support@zime.ai.
How do you stop data leaving through staff devices?
Every device runs an endpoint agent that checks disk encryption, antivirus, screen lock and updates; access is role based with mandatory multi-factor authentication; customer data may not be stored on personal devices; and removable media or printing of customer data is prohibited.
Do you have a separate API security, change management or patch management policy?
These are covered inside broader policies, listed on the Compliance and reports page. The August 2026 penetration test also covered the API layer.