Zoho Mail, the business email service of Zoho Corporation, hosts mail on a custom domain with calendar, contacts, notes, and tasks built in. According to Zoho, AES-256 covers mail at rest and TLS covers mail in transit on every plan, while end-to-end encryption is absent by default. Those statements frame the safety question: outside interception is guarded against from the start, but Zoho itself retains the ability to read stored mail.
Encryption at rest and in transit
AES-256 encryption applies to stored messages and attachments, and it is active by default on all plans. The key management service of Zoho creates the keys, layers of protection guard them, and rotation happens automatically on a six-month cycle, or at once if a key is ever compromised. An organisation that prefers its own key can bring one through Zoho Directory. Zoho's email encryption page carries the full description.
Connections use TLS throughout: POP, IMAP, and SMTP for mail clients, and HTTPS for webmail and the mobile apps. The versions in use are TLS 1.2 and 1.3, with perfect forward secrecy. Where the receiving provider supports it, mail between Zoho Mail servers and other providers travels under TLS as well, and administrators have the option of requiring TLS for mail in both directions. A per-message indicator reports whether that message travelled encrypted. No configuration is needed for any of this, on any plan.
Together, these two layers guard against two specific threats: interception of mail on the network, and reading of raw files taken from a disk. They do not guard against reading by the provider, since the keys that unlock stored mail sit with the provider.
End-to-end encryption
Zoho is direct on this point: Zoho Mail has no end-to-end encryption by default. The reason given is operational. A provider that cannot scan a message loses the ability to search it fully, to check it for malware, to enforce a retention policy, to produce it for eDiscovery, or to restore it for an administrator after an employee departs. Zoho argues that most organisations require those controls, and that some are under a legal duty to keep them. The same Zoho encryption page sets out that reasoning.
Opt-in message-level encryption exists, with conditions attached. S/MIME, which both encrypts a message and signs it digitally, is offered on Zoho Mail Premium and Zoho Workplace Professional plans. Encryption between two people requires S/MIME to be enabled at both ends, and since Zoho supplies no S/MIME certificates, each user must buy a certificate from an outside provider and upload it. Zoho's S/MIME help page documents the setup and the certificate requirement. OpenPGP takes a different form: a key pair is generated or imported inside Zoho Mail, and public keys are exchanged with recipients. It is open to all paid plans. The PGP help page records that the feature currently serves users in US, EU, IN, and AU data centres, with remaining regions following in phases.
Message-level encryption carries two trade-offs. Coverage extends only to correspondents who have completed the same setup, so part of a mailbox stays outside it. And Zoho notes that PGP-encrypted attachments escape virus scanning, because their content bypasses the system-level spam and malware checks.
Without message-level encryption, Zoho can read stored mail under controlled conditions.
Sign-in controls
Most real-world email compromise runs through the account rather than the cryptography, and Zoho documents controls for account access. An organisation can switch on two-factor authentication, combining a static password with a changing passcode sent as an SMS-based OTP, an app-based OTP, a YubiKey, or Zoho's own OneAuth app, the option Zoho recommends. Logins that depart from the previous behaviour of the user trigger suspicious login alerts. Administrators can also confine mailbox access to named IP addresses, impose a password policy stricter than the default, and set an idle session timeout for the admin console on paid plans. Zoho's admin console security page documents these controls.
Because Zoho Mail is sold mainly to organisations, the administrator defines the security baseline for all users. Role-based access, custom security policies, audit logs, and eDiscovery provide that administrator with visibility and control. Custom domain hosting also includes domain authentication, with SPF, DKIM, BIMI, and DMARC listed on Zoho's homepage as protection for the domain of the organisation against spoofing. On a single user account, where no administrator is involved, two-factor authentication and a strong, unique password carry the largest effect, and both are available directly.
Privacy and advertising
The privacy position Zoho states is that it makes no money from advertising and does not sell personal information for advertising. Its privacy policy records that no dollar of advertising revenue has ever been made, and none ever will be, even from free editions of its products. The privacy FAQ states the same position in plainer terms: personal information is never sold to third parties for advertising, no money is made from showing other people's ads, and this has been the approach for almost 20 years. With no advertising income at stake, the commercial motive for mining mailbox content for ad targeting disappears, and that motive is the main privacy worry attached to free consumer mail.
Limits on internal access are also set out in the policy. Only a small number of employees may see customer data, only on a need-to-know basis for technical support, and that access is reviewed periodically. The secure email page adds that access to encrypted data is highly restricted even for employees, and that in rare cases selected employees receive obfuscated data only after multiple security checks, under tight control and constant monitoring. What is described is restriction and monitoring, not impossibility.
Data residency
Residency is worth stating plainly. Signup IP address decides the data centre of an account automatically. Centres operate in the US, EU, India, Canada, Saudi Arabia, and other regions, and the privacy FAQ explains how the login URL reveals which centre holds an account. Service data for EU accounts stays within the EU, yet in certain circumstances it may be reached from outside the European Economic Area, specifically from India, for technical support purposes. The claim is therefore narrower than data never leaving a region.
Compliance and scale
Zoho reports ISO 27001 and SOC 2 Type II certification for Zoho Mail, and the Zoho Workplace security page adds statements of GDPR and HIPAA compliance. All of these are Zoho's own claims as reported here, and this article reviewed no independent audit report behind them. The homepage likewise reports more than 550,000 businesses running on Zoho Mail, a 99.9% uptime SLA, and 10 or more local data centres. Those numbers are Zoho's own marketing claims, attributed to Zoho in this article rather than independently measured.
Limits
Three limits complete the picture, since no mail provider covers every risk. Stored mail stays readable by Zoho unless S/MIME or OpenPGP is in use, and the privacy policy states that Zoho may be compelled to disclose personal information to meet a legal obligation, prevent fraud, enforce an agreement, or protect user safety. Phishing forms the second limit, and it bypasses encryption entirely: a persuasive message that obtains a password or a one-time code from the account holder defeats transport encryption outright, which is why two-factor authentication carries more weight than any encryption setting for most users. Exposure of the address forms the third limit. An address handed to many services turns up in breach data and draws spam and phishing for years afterwards, and encryption offers no answer there, because the underlying problem is exposure rather than interception.
Aliases and Zoho Mail
AliasFleet supplies email aliases that forward to a destination inbox, one alias per service. Under this arrangement the Zoho Mail address serves as the destination inbox and is never given out directly. A website, shop, or newsletter receives its own alias, and mail to that alias lands in the Zoho inbox. When an alias begins attracting spam, or turns up in a breach, that alias alone can be paused or closed, leaving the Zoho address and every other service untouched. Nothing about how Zoho Mail encrypts or stores mail changes; what changes is the breadth of exposure of the Zoho address. The mechanism is explained in full in the article on how email aliases actually work, and the argument for keeping a real address private is made in the article on whether email aliases are safe.
Zoho Mail fits this pattern well. Account security is strong, and mail stays out of advertising, while the weak point lies at a layer Zoho does not control: the roster of parties holding the address, which cannot be taken back once it has spread widely. Aliases act on that layer. The same trust question has been answered for Gmail, Outlook, Yahoo Mail, and iCloud Mail.
Configuration
The documented controls suggest a consistent configuration. Two-factor authentication is switched on, with an authenticator app or a hardware key preferred over SMS where that choice exists. The Zoho account carries a strong password used nowhere else. Sensitive correspondence with a regular contact runs under S/MIME or OpenPGP, after keys or certificates have been exchanged in advance. And the Zoho address itself remains private, with aliases standing in for it at websites and newsletters, so the address that matters most surfaces in the fewest databases. Background on second factors and mail generally appears in the article on whether email is safe for two-factor codes, and the alias concept itself is introduced in what an email alias is.
In sum, Zoho Mail combines encryption at rest and in transit on all plans, two-factor authentication, admin controls, and a stated policy against advertising revenue and sale of personal information, against a single clear limit: without message-level encryption, Zoho can read stored mail under controlled conditions. For business use that is a reasonable trade, on two conditions: the account is locked down with two-factor authentication, and the address itself stays private behind aliases.
Top comments (0)