Encryption concepts
worth understanding
| Method | What it protects | Enabled by |
|---|---|---|
| Encryption at rest(AES-256) | Email stored on Zoho servers | On by default, all plans |
| Encryption in transit(TLS) | Email moving between your device and Zoho, and between mail servers | On by default, all plans |
| Encryption Level Indicator | Shows you whether a given email travelled encrypted | On by default, all plans |
| S/MIME | The message itself, after it reaches the server. | You can configure it. Available on Zoho Mail Premium and Zoho Workplace Professional plans. |
| OpenPGP | The message itself, end to end | You configure it. Available on all paid plans. |
Do you need to set anything up?
For most organizations, No. Encryption at rest and encryption in transit are always on, on every Zoho Mail plan, with nothing to configure. If your concern is "is my company email encrypted?" It is, by default.
S/MIME or OpenPGP add message-level encryption, so only recipients who hold the right key can read the message. They’re useful for regulated legal, clinical or financial correspondence, or where a contract requires it.
For S/MIME, buy a certificate from a certificate provider and upload it to Zoho Mail. For OpenPGP, generate or import a key pair in Zoho Mail. In both cases you exchange public keys with your recipients.
How does Zoho Mail encrypt your data?
Read our docs on email encryptionEncryption at rest
Zoho Mail encrypts all email content and attachments with AES-256.
Across Zoho services, files are encrypted in CTR or GCM mode. Encryption keys are generated by Zoho’s key management service and protected in layers: data keys are encrypted with key-encryption keys, which are encrypted with a master key stored on a separate server. Keys are rotated automatically every six months, and immediately if a key is ever compromised.
Organizations can also bring their own encryption key (BYOK) through Zoho Directory.
Encryption in transit
All connections to Zoho Mail are encrypted with TLS—for POP, IMAP, SMTP, and over HTTPS for webmail and the mobile apps. Zoho Mail supports TLS in all plans. Email travelling between Zoho Mail servers and other email providers is encrypted with TLS wherever the receiving provider supports it.
Zoho uses TLS 1.2 and 1.3 with perfect forward secrecy. Admins who need every external message encrypted can turn on Forced TLS for incoming and outgoing email, so messages are never delivered without encryption.
A note on End-to-end encryption (E2EE)
Zoho Mail is not E2EE by default. With end-to-end encryption, the provider cannot scan your messages
However, if the server cannot scan a message, it cannot search it comprehensively, scan it for malware, apply a retention policy, produce it for eDiscovery, check it against a data loss prevention rule, or recover it for an administrator when an employee leaves.
Most organizations need those controls, and some are legally required to hold them. Zoho Mail is built for that case. Your email is encrypted in transit and at rest, along with S/MIME and Open PGP for individual emails to be encrypted on your choice.
Certifications
Zoho Mail is certified to ISO 27001 and SOC 2 Type II. Zoho is constantly verified against the highest global compliance standards.
Read more on Zoho's compliance