The following section highlights the key security and encryption aspects covered in this document:

• Zoho CRM protects data exchanged over public networks using TLS 1.2/1.3, strong cipher suites, HSTS, secure authentication cookies, and Perfect Forward Secrecy (PFS).

• Email communications are protected using opportunistic TLS.

• Sensitive data at rest is encrypted using AES-256, with encryption keys managed through Zoho’s in-house Key Management Service (KMS).

• Emails stored within the platform are encrypted at rest, and Zoho enforces anti-spam controls.

• Zoho CRM supports both plain and encrypted email connections, uses STARTTLS for connection upgrades, and relies on industry-standard authentication mechanisms such as OAuth for supported mail providers.

• S/MIME is supported for email encryption.

Data Encryption

Zoho follows industry-standard encryption practices to protect customer data both in transit and at rest. We use modern cryptographic protocols and algorithms recommended by NIST to ensure data confidentiality, integrity, and secure access across all services.

Encryption in Transit

All customer data transmitted to Zoho servers over public networks is protected using strong encryption protocols. Zoho enforces Transport Layer Security (TLS) 1.2 and 1.3 with strong cipher suites for all connections, including:

• Web access

• API access

• Mobile applications

• IMAP, POP, and SMTP email client connections

TLS ensures secure communication by authenticating both parties involved in the connection and encrypting data during transmission.

For email services, Zoho leverages opportunistic TLS by default. When supported by peer mail servers, TLS encrypts email delivery and mitigates the risk of eavesdropping during server-to-server communication.

Zoho fully supports Perfect Forward Secrecy (PFS) for encrypted connections. This ensures that even if encryption keys were ever compromised in the future, previously transmitted data would remain protected and unreadable.

Additionally, Zoho enforces HTTP Strict Transport Security (HSTS) across all web connections. This instructs modern browsers to connect only over encrypted channels, even if an insecure URL is entered. All authentication cookies used on the web are flagged as secure.

Encryption at Rest

Sensitive customer data stored at rest is encrypted using 256-bit Advanced Encryption Standard (AES-256). The specific data encrypted at rest may vary depending on the Zoho CRM features and services you use.

Zoho manages encryption keys using an in-house Key Management Service (KMS). In order to provide additional layers of security:

• Data encryption keys are encrypted using master keys

• Master keys and data encryption keys are physically separated

• Keys are stored on different servers with restricted access.

Emails stored within the platform are also encrypted at rest, and Zoho enforces anti-spam controls to protect email communication.

For more detailed information:

• Encryption at Zoho

• Data encrypted across Zoho services

HIPAA-aligned Safeguards

Zoho CRM incorporates security measures that align with the technical safeguard requirements outlined in the HIPAA Security Rule for the storage and transmission of electronic protected health information (ePHI). While these capabilities help support HIPAA-regulated use cases, achieving HIPAA compliance remains a shared responsibility between Zoho and the customer and depends on how the service is configured and used.

Technical Safeguards Supporting 45 CFR §164.312

Zoho CRM provides the following security controls:

• TLS 1.2 and TLS 1.3 encryption for email transmitted in transit, including opportunistic TLS support for SMTP communications

• AES-256 encryption for data at rest, covering email content, attachments, and stored credentials

• Comprehensive audit logs that track administrator and user activities related to CRM data

• Role-based access controls to help restrict access to sensitive information

• Secure outbound email delivery with TLS-preferred gateway behavior

Reasonable Safeguards Under 45 CFR §164.522(b)

The HIPAA Privacy Rule permits the transmission of protected health information (PHI) by email when reasonable safeguards are in place. Organizations using Zoho CRM in HIPAA-regulated environments are responsible for implementing appropriate access controls, training users on proper handling and disclosure of PHI, and utilizing secure, portal-based communication methods when enhanced protection beyond standard email security is required.

Business Associate Agreement (BAA)

A Business Associate Agreement (BAA) may be available for eligible Zoho CRM plans. Customers should consult their Zoho account representative to verify eligibility, understand the scope of covered services and data, and review any limitations that may apply to specific features, including third-party integrations that operate outside Zoho's infrastructure.

How user mailbox is linked with CRM

Email Authentication

Zoho CRM uses industry-standard authentication mechanisms to securely link user mailboxes to CRM without storing sensitive credentials in plain form.

OAuth 2.0 for Google and Microsoft

OAuth is the recommended and most secure authentication path for Google Workspace and Microsoft 365 accounts. During the OAuth flow:

• The user is redirected to their identity provider (Google or Microsoft) to sign in and grant consent to the requested scopes.

• Zoho CRM never sees, transmits, or stores the user's account password.

• After consent, Zoho receives an access token and a refresh token, both stored in encrypted form.

• Refresh tokens enable ongoing background sync without requiring the user to re-authenticate.

• Tokens can be revoked at any time by the user from their Google or Microsoft account, or by an administrator from their identity provider's admin console.

Password-Based Authentication for Non-OAuth Providers

When connecting a mail server that does not support OAuth (for example, a self-hosted IMAP server or a smaller hosted email provider), Zoho CRM accepts the username and password supplied during configuration.

• The password is encrypted at rest using AES-256 and is decrypted only at the point of connecting to the mail server.

• Passwords are never written to logs, surfaced in user interfaces, or transmitted in plain form across network boundaries.

• Customers using providers that issue app-specific passwords are encouraged to issue an app password rather than the primary account password.

Secure IMAP Authentication

For IMAP-based integrations, Zoho CRM enforces secure authentication standards:

• PLAIN and LOGIN mechanisms are used only over TLS-protected connections.

• XOAUTH2 is used for OAuth-enabled IMAP providers (Google, Microsoft).

• Credentials are scoped to the integration context and are not reused across unrelated services.

Information Required from Users to Establish a Connection

To establish a secure email connection with Zoho CRM, users may be required to provide:

• Authorization consent for OAuth-based integrations (Google and Microsoft)

• Mail server credentials for non-OAuth providers (stored in encrypted form)

• Necessary permissions to enable API access for Graph API integrations

• Valid SSL certificates on mail servers when using encrypted connections

API Integrations & Permissions

Zoho CRM supports multiple API-based integration paths for email. Each integration path is designed to operate with the minimum permissions necessary and without exposing credentials in transit or at rest.

Integration Paths Overview

Microsoft Graph API Security

Graph API integrations communicate with Microsoft Graph exclusively over HTTPS. All requests are encrypted in transit. Authentication uses OAuth 2.0 with delegated scopes, and no credentials are exposed during authentication or data exchange.

• Refresh tokens for Graph integrations are stored encrypted at rest.

• Customers can revoke consent at any time from the Microsoft 365 admin portal, which immediately invalidates the integration.

• API access must be explicitly enabled in Zoho CRM settings before Graph integration can be configured.

Required OAuth Scopes

Graph API Integration

IMAP / POP / SMTP Setup

OAuth SMTP Ports — Google and Microsoft

OAuth integrations do not require port configuration on the customer's network because authorization occurs over HTTPS to the identity provider. The following ports are used for sending mail after OAuth authorization:

Server Requirements

This section outlines the server and connectivity requirements needed to configure email communication with Zoho CRM. The following requirements are common across all supported protocols, including IMAP, POP, and Graph API, unless stated otherwise.

Connection Methods and Supported Protocols

Zoho CRM supports both plain and encrypted email connections to ensure compatibility with different mail server configurations.

Supported Protocols

Zoho CRM supports the following encryption standards for email communication:

• TLS 1.0, 1.1, 1.2, and 1.3

• STARTTLS, which allows plain connections to be upgraded to encrypted connections when supported by the mail server

Required Open Ports and Allow Listing

To ensure uninterrupted email communication, administrators must allow-list the appropriate ports based on the configured connection type.

Note: For integrations that use Graph API, API access must be enabled in Zoho CRM settings.

SSL Certificate Requirements

Mail servers connecting to Zoho CRM over encrypted ports must use a valid SSL certificate.

• Certificates must meet standard trust and validation requirements.

• Expired, invalid, or self-signed certificates may result in connection failures.