Zoho Flow employs robust encryption to ensure that all data passing through the platform is protected against unauthorised access, whether it is in motion between systems or stored at rest. Encryption is applied at multiple layers of the platform architecture, using industry-standard algorithms and Zoho's own in-house Key Management Service.
Encryption transforms data into a form that can only be read by a party that holds the correct decryption key. Its primary function is to safeguard the contents of a message or data record so that only the intended recipient can access it. In the context of Zoho Flow, encryption protects the data that flows between your applications and the credentials used to authorise those connections.
Encryption in transit protects data while it is moving from one location to another. This covers data travelling between your browser and Zoho Flow's servers, as well as data exchanged between Zoho Flow and third-party applications during flow execution. By encrypting data in transit, Zoho Flow guards against man-in-the-middle attacks, where a malicious party might attempt to intercept communications.
All data in transit is secured using TLS (Transport Layer Security), ensuring that connections between Zoho Flow and external services are authenticated and the data they carry cannot be read or tampered with during transmission.
Encryption at rest (EAR) protects data that is stored on discs, in databases, or on other storage media. Even if physical storage were accessed without authorisation, encrypted data at rest would be unreadable without the corresponding decryption key. This layer of protection defends against risks such as server compromise or unauthorised physical access to storage infrastructure.
Zoho Flow uses the AES-256 symmetric encryption algorithm for data at rest. The technical specification is as follows:
| Parameter | Value |
|---|---|
| Algorithm | AES-256 (symmetric) |
| Block size | 128-bit |
| Key size | 256-bit |
| Key management | Zoho in-house Key Management Service (KMS) |
Encryption keys are managed using a two-tier structure. A Data Encryption Key (DEK) encrypts the stored data, and this DEK is itself encrypted by a Key Encryption Key (KEK). Both keys are managed by Zoho's internal Key Management Service, ensuring that key storage and rotation are handled securely and separately from the data they protect.
The following categories of data are encrypted within Zoho Flow:
In addition to file-level and database-level encryption, full disk encryption is available for Zoho Flow data centres located in the following regions:
Full disk encryption provides an additional layer of protection at the storage hardware level, meaning that all data written to the physical discs in these data centres is encrypted, regardless of the application-level encryption already applied.