Zoho groups its security practices into four areas: Physical Security, Network Security, People and Process, and Redundancy and Business Continuity.
Zoho's data centres are hosted in secure facilities protected from both physical and logical attacks, as well as natural disasters such as earthquakes, fires, and floods. Specific measures include N+2 redundant HVAC and temperature control systems, industry-standard fire prevention and control systems, and power back-up. Access to data centre information and customer data is granted strictly on an as-needed basis.
A network engineer reviews all firewall changes daily, with a fuller rule review conducted every six months. A dedicated Network Operations Centre team monitors infrastructure and applications continuously, with automated alerts triggered by any abnormal or suspicious activity in the production environment. Zoho also uses intrusion detection and prevention systems, alongside a combination of certified third-party and in-house tools to manage vulnerabilities.
Zoho maintains a dedicated incident management team, notifying customers of incidents that apply to them along with recommended actions, and tracking each incident through to resolution with appropriate corrective controls to prevent recurrence. Where applicable, Zoho can also provide customers with application and audit log evidence relating to a specific incident.
Every component of Zoho's platform is redundant, using a distributed grid architecture that shields the system from the effects of a possible server failure; if one server fails, users can continue working as usual since their data and Zoho's services remain available. Multiple switches, routers, and security gateways provide device-level redundancy to prevent single points of failure within the network.
Customer data is spread across geographically diverse data centres, with data in the primary data centre replicated to a secondary one; if the primary fails, the secondary takes over with minimal or no loss of time. Geo mirroring, replicating customer data to a separate geographic location specifically for disaster recovery, is available on select products and plans.
Zoho also runs a business continuity plan covering its major operations, such as support and infrastructure management, with disaster recovery drills performed periodically to validate it.