Zoho encrypts customer data both at rest and in transit, using industry-standard algorithms recommended by NIST, across its entire platform.
Sensitive customer data at rest is encrypted using 256-bit Advanced Encryption Standard (AES), specifically AES/CBC/PKCS5Padding. This happens at the application layer, meaning only an authorised application user can actually view the underlying data; anyone accessing the database directly, including database or support staff, only ever sees encrypted data without access to the relevant encryption keys.
All customer data is encrypted in transit over public networks using Transport Layer Security (TLS) 1.2/1.3, with strong ciphers (AES_CBC/AES_GCM using 256-bit or 128-bit keys, SHA2 for message authentication, and ECDHE_RSA for key exchange), enforced across every connection, including web access, API access, and mobile apps. This applies both when data travels from your browser to Zoho's servers, and when it travels from Zoho's servers to third-party integrations. Zoho also implements Perfect Forward Secrecy and enforces HTTP Strict Transport Security (HSTS) across all its sites.
Zoho owns and maintains encryption keys using its own in-house Key Management Service (KMS), adding a further layer of security by encrypting the data encryption keys themselves using separate master keys. The master keys and data encryption keys are physically separated and stored on different servers with restricted access.
Exactly which data is encrypted at rest varies depending on the specific Zoho service you're using. Zoho CRM, for example, additionally offers Field-Level Encryption, letting you apply custom encryption to specific sensitive fields, configured from Setup, then Customization, then Fields.
Passwords used to access Zoho services are stored using a non-reversible encryption scheme, rather than being stored, or even recoverable, in plain text.