> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/zoom-playbooks-for-sensitive-data-movement.md).

# Zoom playbooks for sensitive data movement

To mitigate the risk associated with sensitive data movement in Zoom, you can define automated workflows for these use cases: 

* [Notify on cloud recording without passcode](#notify-on-cloud-recording-without-passcode)
* [Notify on PII in Zoom cloud recording](#notify-on-pii-in-zoom-cloud-recording)
* [Remove public share from Zoom cloud recording](#remove-public-share-from-zoom-cloud-recording)

## Notify on cloud recording without passcode

When a Zoom recording without a passcode is completed, the Security team is notified in Slack that the recording is not passcode-protected.

1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to sensitive data movement, and select the **Notify on cloud recording** **without passcode** playbook. 
3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FtYcJrNbJcBG5bINaYAkX%2FPB%20Zoom%20sensitive%20notify.png?alt=media&amp;token=34cb2ed7-56c0-4538-871f-46d0d747dea1" alt=""><figcaption></figcaption></figure>
4. Under the **Recording completed** event, make sure that the:
   * `Is password protected` macro is `false`.
   * Add any relevant conditions.
5. Customize the **Notify in Slack** step to notify the Security team:\
   `Zoom's cloud recording {{event.rawData.body.payload.object.topic}} has been completed.`

   `The meeting was hosted by <Get host email> and is not passcode-protected.`

## Notify on PII in Zoom cloud recording

People tend to share sensitive information, such as user and password credentials, more easily by spoken word than written text. DoControl runs PII scanning on all text-based files associated with Zoom cloud recordings, such as chat, closed captions, and audio transcripts. These text files have a high probability of including PII, such as passwords, emails, and bank account details.&#x20;

When a Zoom cloud recording contains PII (personally identifiable information), the Security team is notified in Slack, and the entire Zoom recording (or selected entities) are deleted.

1. In Workflows, select **Playbooks**.

2. Filter the playbooks according to sensitive data movement, and select the **Notify on PII in Zoom cloud recording** playbook.&#x20;

3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FBDbblPxHDg1oqi3yUz6T%2FPB%20Zoom%20notify%20on%20PII%20sensitive.png?alt=media&amp;token=496a9d0a-3728-40a6-912f-5f41565f218e" alt=""><figcaption></figcaption></figure>

4. Under the **Recording completed** event, make sure that these macros are defined:

   * `Get recording file types` macro contains at least one CC, or
   * `Get recording file types` macro contains at least one chat, or
   * `Get recording file types` macro contains at least one transcript.
   * Add any relevant conditions.

5. Customize the **PII scan** step that scans the recording uploaded to Zoom for PII labels:
   * Make sure that the `Get meeting UUID` macro is selected.
   * Specify which PII labels to scan for, such as `email, password,` or `address.`
   * Customize the error handling step in case of an error.

6. Customize the **Conditional** step:

   * If the PII scan didn't detect the specified labels, end the workflow with `success` status.
   * If the PII scan detected the specified labels, customize the **Notify in Slack** step to notify the Security team:\
     `The <Get meeting topic> Zoom recording was uploaded to the cloud. There's a high probability that this publicly shared recording contains PII (personally identifiable information):`

     **`PASSWORD:`**

     **`USERNAME:`**

     **`ADDRESS:`**

7. Customize the **Delete recording** step:
   * Select the entire recording, including its entities (chat, closed captions and audio transcript), OR
   * Select specific entities only (chat, closed captions or audio transcript), by entering the relevant file ID for one or more entities.
   * Customize the error handling step in case of an error.

## Remove public share from Zoom cloud recording

When a Zoom cloud recording contains PII (personally identifiable information), the sharing status of the Zoom recording is automatically changed to `internal`.

1. In Workflows, select **Playbooks**.

2. Filter the playbooks according to sensitive data movement, and select the **Remove public share from Zoom cloud recording** playbook.&#x20;

3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FWGEdmHFVXZqjOZJIEcQt%2FPB%20Zoom%20remove%20public%20sensitive.png?alt=media&amp;token=77a381f6-d0b6-4079-add4-6d29b4a66a4b" alt=""><figcaption></figcaption></figure>

4. Under the **Recording completed** event, make sure that these macros are defined:

   * `Get recording file types` macro contains at least one CC, or
   * `Get recording file types` macro contains at least one chat, or
   * `Get recording file types` macro contains at least one transcript.
   * Add any relevant conditions.

5. Customize the **PII scan** step that scans the recording uploaded to Zoom for PII labels:

   * Make sure that the `Get meeting UUID` macro is selected.
   * Specify which PII labels to scan for, such as `email, password,` or `address.`
   * Customize the error handling step in case of an error.

6. Customize the **Conditional** step:

   * Make sure that the `email` macro contains at least one, or
   * Make sure that the `password` macro contains at least one, or
   * Make sure that the `address` macro contains at least one.

7. If the PII scan didn't detect the specified labels, end the workflow with `success` status.

8. If the PII scan detected the specified labels:
   * For Change recording sharing status, select **Internal or Non-shareable**.
   * Customize the error handling step in case of an error.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/zoom-playbooks-for-sensitive-data-movement.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.