Product security
Every change and every feature goes through secure coding guidelines, checked by code analysis tools, vulnerability scanners and manual review. The security framework is based on OWASP standards.
Security
Your data is the most
Your data is the most
valuable thing
you own.
It's the first question people ask us before moving to Zoho, and it's the right one. Here is how Zoho protects your data — and where you can verify every one of these claims yourself.
The foundations
Secure
Secure
by design.
This isn't a layer bolted on afterwards: security is built into Zoho's entire development process.
Data security
Each client's data is logically separated from every other client's. Encryption applies both at rest and in transit. Retention and backups are handled securely.
Availability
Disaster recovery and business continuity programs deliver high availability. Client data is spread across data centres in multiple locations.
Operational security
Rigorous logging and monitoring keeps traffic clean and flags abnormal behaviour.
In practice
What we can
What we can
turn on for you.
These protections exist — but they still have to be configured. That's part of our implementation work, and we don't skip it.
- Encryption at rest and in transit — your data is unreadable, whether it's stored or moving.
- Multi-factor authentication — a stolen password is no longer enough to get in.
- Single sign-on (SSO) — one identity across every app, revocable in one move when someone leaves.
- Role-based access control — everyone sees what concerns them, and nothing else.
- Logging, audit and monitoring — who did what, and when. Essential the day you have to trace something back.
- Personal data privacy — encryption of sensitive fields, consent management.
Certifications
Verified by
Verified by
independent auditors.
These aren't Zoho's own claims: they're audits run by outside firms and renewed periodically.
ISO/IEC 27001
The reference standard for information security management. Applies to Zoho's cloud services.
ISO/IEC 27017
Security guidelines specific to cloud services — the layer ISO 27001 leaves out for the cloud.
ISO/IEC 27018
Protection of personal information in the public cloud.
ISO/IEC 27701
An extension of ISO 27001 dedicated to privacy management.
SOC 2 Type II
Assesses the design and the actual effectiveness of controls over a period of time — not a snapshot.
SOC 1 Type II · SOC 2 + HIPAA
Under the AICPA's SSAE18 and ISAE 3402 standards. An independent audit firm has also reviewed HIPAA compliance.
Full detail and audit reports: Zoho trust centre · GDPR compliance · Zoho privacy policy
What Zoho doesn't cover
The recycle bin keeps your data
The recycle bin keeps your data
60 days. No more.
This is the hole in the net, and it has nothing to do with Zoho's security: one wrong move on your side, an employee who leaves, an import that overwrites the wrong column — and past 60 days, it's gone for good.
Zolio Cloud
Daily backup of your Zoho data
An encrypted copy every night, kept outside of Zoho. It's the only net that protects you from your own mistakes — the ones no certification can do anything about.
- Automatic backup — Books, CRM, Desk, Sign
- Portal reachable even if Zoho is down
- 14-day trial, free 500 MB plan
Questions about
security?
It's often the real objection behind a migration that keeps stalling. Ask us the hard questions — we'd rather answer them before than after.