eucsoft

Zoho

CRM marketing · zoho.com · last read 2026-10-12

Identity

Legal entityZoho Corporation Pte. Ltd.
HQSG
Parent company—
Ultimate ownership—
EU contracting entityZoho Corporation B.V. (and 1 other EU entity by country)
LEI875500X64A0FL8N3D863
US CLOUD Act reachNot determined from the sources read
Sourcezoho.com · 2026-10-08

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

Data location

RegionEU data locationMinimum planSourceObserved
EUTerms not stated—zoho.com2026-10-08

EU: The document lists Europe as one of its datacenter locations. It says the datacenter is chosen from the country selected at sign-up, which is pre-filled from the IP address, but it names no plan or cost for EU hosting.

Subprocessor chain

38 third parties · 0 with a country outside the EEA · all read 2026-10-08

SubprocessorCountryPurpose
Amazon CDN——
Amazon SNS——
AMD——
Anthropic——
Audio Codes——
AVOXI, Inc.——
B2Brouter——
Bandwidth (Voxbone)——
Belgacom International Carrier Services SA (BICS)——
Brave Search API——
BulkSMS——
Clickatell——
Daxtra——
Easy Post——
Etisalat——
Google Cloud Speech-to-Text——
Google Cloud Text-to-Speech——
Google Translate——
Kaleyra——
Litmus——
Luna Soft——
MapMyIndia (MAPPLS)——
NTT——
OpenAI——
Perfios——
Remita——
SignDesk——
Signzy——
Sinch (formerly CLX)——
Storecove (Peppol)——
Tata Communications——
TeleSign——
Telnyx——
Twilio——
Validity——
Value First——
Veryfi——
Yodlee——

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Processing terms

No data processing agreement read yet.

Assurance

SchemeStatusScopeSourceObserved
CCPAClaimedZoho's processing of its Californian customer's datazoho.com2026-10-08
CSAClaimedApplicable to - Zoho Campaignszoho.com2026-10-08
CSA STAR Self-Assessment · CSACertificate publishedApplicable to - All Cloud services of Zoho, ManageEngine, Qntrl and TrainerCentral.zoho.com2026-10-08
Cyber Essentials Plus · CyberEssentialsPlusClaimedApplicable to - Zoho UK office and EU Datacenters (EU1 Datacenter - Amsterdam, Netherlands; and EU2 Datacenter - Dublin, Ireland).zoho.com2026-10-08
ESQUEMA NACIONAL DE SEGURIDAD (ENS) - Spain · ENSAvailable on requestZoho is ENS certified with intermediate category(medium level). Applicable to - All cloud services of Zoho, Cloud and on-premises solutions of ManageEngine, Qntrl and TrainerCentral.zoho.com2026-10-08
GDPRClaimed—zoho.com2026-10-08
Hébergeur de Données de Santé (HDS) - France · HDSAvailable on requestZoho Creator is HDSv2.0 certified. Applicable to - Zoho Creator hosted in the EU datacenterszoho.com2026-10-08
ISO 22301 · ISO22301Available on requestBCMS 689185. Applicable to - Zoho Cloud Services, ManageEngine, Qntrl, Ulaa Browser and TrainerCentral along with the Support functions, Global Network Operation Center (NOC), Global DC Operations, HR, IT Support, Legal, Physical Security and Admin.zoho.com2026-10-08
ISO/IEC 27001 · ISO27001Available on requestAll cloud services of Zoho, ManageEngine, Qntrl, TrainerCentral, GSP Solution application, MED (MedicalMine), Ulaa Browser, Arattai, and GoFrugal.It also includes the on-premise products of Zoho, ManageEngine and GoFrugal.zoho.com2026-10-08
ISO/IEC 27017 · ISO27017Available on requestAll Cloud Services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral.zoho.com2026-10-08
ISO/IEC 27018 · ISO27018Available on requestAll Cloud Services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral.zoho.com2026-10-08
ISO/IEC 27701 · ISO27701Available on requestAll business units, cloud services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral.zoho.com2026-10-08
ISO 9001 · ISO9001Available on requestAll Cloud Services of Zoho, ManageEngine, Qntrl and TrainerCentral.zoho.com2026-10-08
GoBDAvailable on requestApplicable to - Zoho Books, Zoho Invoice and Zoho Expense.zoho.com2026-10-08
ISO/IEC 20000-1ClaimedNetwork Operations Center (NOC) and Data Center (DC) Operations of Zoho Corporation.zoho.com2026-10-08
National Cybersecurity AuthorityClaimedZoho Saudi Entity has obtained Class B certification from the CST, in compliance with the NCA Cloud Cybersecurity Controls. Applicable to - All Cloud Services of Zoho and ManageEngine.zoho.com2026-10-08
NHS DSPT (UK) - Version 8ClaimedZoho Corporation Limited (UK Office); status Standards Metzoho.com2026-10-08
PCI · PCIDSSClaimedSelf-assessment : SAQ-D; Applicable to - Zoho Books, Zoho Invoice, Zoho Inventory, Zoho Billing, Zoho Expense, Zoho Checkout and Zoho Commerce.zoho.com2026-10-08
SOC 1 (SSAE 18 and ISAE 3402 - Type 2) · SOC1Available on requestApplicable to - Zoho Books, Zoho Invoice, Zoho Expense, Zoho Inventory, Zoho Billing, Zoho Checkout, Zoho Payroll, Zoho CRM, Zoho Mail, Zoho Projects and BugTracker, Zoho Creator, Zoho People, Zoho Campaigns, Zoho Bigin, Zoho Bookings, Zoho Commerce, Zoho Flow, Zoho Analytics, Zoho Calendar, Zoho Cliq, Zoho Sign, Zoho TeamInbox, Zoho POS, Zoho eProtect, Zoho Store, Zoho Zepto Mail, ManageEngine Site 24x7 Group, ManageEngine Remote Access Plus Cloud, ManageEngine Patch Manager Plus Cloud and ManageEngine Endpoint Central Cloud.zoho.com2026-10-08
SOC 1 (SSAE 18 and ISAE 3402 - Type 2) Audit Trail · SOC1Available on requestIt is pertained to Data Centers in India. Applicable to - Zoho Books, Zoho Invoice, Zoho Billing, Zoho Inventory, Zoho Expense, Zoho Commerce, Zoho Payroll, Zoho Checkout and Zoho People.zoho.com2026-10-08
SOC 2 + HIPAA Type 2 · SOC2T2Available on requestAudit period : 01-Dec-2023 to 30-Sep-2024. Application Development, Production Support and the related General Information Technology Controls for the services provided to customers, from Zoho offshore development centre. Applicable to - Zoho CRM, Zoho Bookings, Zoho Survey, Zoho Forms, Zoho Desk, Zoho Mail, Zoho Creator, Zoho Analytics and many other Zoho and ManageEngine services, Qntrl and Vani (full list on page).zoho.com2026-10-08
SOC 2 Type 2 · SOC2T2Available on requestApplicable to - All cloud services and on-premise products of Zoho, ManageEngine, Qntrl and TrainerCentral.zoho.com2026-10-08
TX-RAMP · TXRAMPClaimedLevel 1 Applicable to - ManageEngine ServiceDesk Plus Cloud; Level 2 Applicable to - ManageEngine Endpoint Central Cloud and ManageEngine Site24x7zoho.com2026-10-08
Web Content Accessibility Guidelines(WCAG) · VPATAvailable on request2.2 AA levelzoho.com2026-10-08

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Data Privacy Framework List (US)EU-U.S. Data Privacy Framework · Zoho CorporationInactive - WithdrawalHR data, non-HR data2024-02-232026-10-09
Data Privacy Framework List (US)Swiss-U.S. Data Privacy Framework · Zoho CorporationInactive - Withdrawalnon-HR data2024-02-232026-10-09
Global LEI Index (GLEIF)ZOHO CORPORATION PTE. LTD. · ZOHO CORPORATION PTE. LTD.ISSUEDSG2027-03-272026-10-09

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Vulnerability reporting: bugbounty.zohocorp.com, [email protected] (security.txt, expires 2028-06-30; read 2026-10-11)

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
certificationsPublicfull2002026-10-08
residencyPublicfull2002026-10-08
subprocessorsPublicpartial2002026-10-08

History

Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.