Zoho Security Practices, Policies, and Infrastructure

Zoho Security Practices, Policies and Infrastructure

Zoho groups its security practices into four areas: Physical Security, Network Security, People and Process, and Redundancy and Business Continuity.

Physical Security

Zoho's data centres are hosted in secure facilities protected from both physical and logical attacks, as well as natural disasters such as earthquakes, fires, and floods. Specific measures include N+2 redundant HVAC and temperature control systems, industry-standard fire prevention and control systems, and power back-up. Access to data centre information and customer data is granted strictly on an as-needed basis.

Network Security

A network engineer reviews all firewall changes daily, with a fuller rule review conducted every six months. A dedicated Network Operations Centre team monitors infrastructure and applications continuously, with automated alerts triggered by any abnormal or suspicious activity in the production environment. Zoho also uses intrusion detection and prevention systems, alongside a combination of certified third-party and in-house tools to manage vulnerabilities.

People and Process

Zoho maintains a dedicated incident management team, notifying customers of incidents that apply to them along with recommended actions, and tracking each incident through to resolution with appropriate corrective controls to prevent recurrence. Where applicable, Zoho can also provide customers with application and audit log evidence relating to a specific incident.

Redundancy and Business Continuity

Every component of Zoho's platform is redundant, using a distributed grid architecture that shields the system from the effects of a possible server failure; if one server fails, users can continue working as usual since their data and Zoho's services remain available. Multiple switches, routers, and security gateways provide device-level redundancy to prevent single points of failure within the network.

Customer data is spread across geographically diverse data centres, with data in the primary data centre replicated to a secondary one; if the primary fails, the secondary takes over with minimal or no loss of time. Geo mirroring, replicating customer data to a separate geographic location specifically for disaster recovery, is available on select products and plans.

Backup specifics: Zoho runs full backups once a week and incremental backups daily. Backup data is stored in the same data centre as the original, encrypted at rest, and restored and validated weekly. Backed-up data is retained for 3 months, and a specific customer's data can be restored from backup and made available to them on request.

Zoho also runs a business continuity plan covering its major operations, such as support and infrastructure management, with disaster recovery drills performed periodically to validate it.

For the full, current security whitepaper, see Zoho's own Security page and Security FAQ.
Need help? 1 Cloud Consultants can help you understand Zoho's security practices as part of your own vendor security assessment. Book a discovery call with 1 Cloud Consultants.