Security and Encryption in Zoho Apptics

Security and Encryption in Zoho Apptics

Overview

Protecting customer data is fundamental to Zoho Apptics. Multiple layers of authentication and encryption safeguard your data throughout its lifecycle, from the moment it leaves your application until it is securely processed and stored within Zoho's infrastructure.

Encryption architecture flow in Zoho Apptics

Zoho Apptics secures data using:
  1. JWT-based request authentication
  2. RSA encryption for sensitive data in transit
  3. TLS encryption for all network communication
  4. AES-256 encryption for data at rest
  5. Zoho's in-house Key Management Service (KMS)
Together, these mechanisms protect against unauthorized access, data interception, man-in-the-middle attacks, and server compromise.

JWT-based request authentication

Every request sent from the Apptics SDK is authenticated using JSON Web Tokens (JWTs).

JWT authentication provides an additional layer of security by validating SDK requests before they are processed. Unlike relying solely on application credentials, signed JWTs help ensure that requests originate from trusted SDK instances and have not been tampered with.

JWT-based authentication validates that requests originate from trusted SDK instances, verifies request integrity, and helps prevent unauthorized API access and credential misuse.

RSA encryption for sensitive data

Sensitive information collected by the SDK is additionally protected using RSA public-key encryption before it leaves the client application.

How it works?

The Apptics SDK securely fetches the RSA public key from the Apptics service. Before transmission, designated sensitive fields (such as personally identifiable information) are encrypted locally using the fetched public key.

Only the corresponding RSA private key, securely stored on the Apptics servers, can decrypt the data. This asymmetric encryption model ensures that sensitive information remains unreadable even if intercepted during transmission.

Encryption in Transit

All communication between your application, the Apptics SDK, Zoho Apptics services, and supported integrations is secured using Transport Layer Security (TLS). TLS protects customer data from Man-in-the-middle (MITM) attacks, network eavesdropping, packet interception, and data tampering during transmission.

RSA encryption for designated sensitive fields complements TLS by providing application-layer protection in addition to transport-layer encryption.
Info
For more information, see the Zoho Encryption in Transit documentation.

Encryption at Rest

Once data reaches Zoho Apptics, it is encrypted before being stored. Zoho Apptics uses AES-256 (Advanced Encryption Standard) for application-layer encryption of stored data. AES-256 is an industry-standard symmetric encryption algorithm used to protect highly sensitive information. Zoho's application-layer encryption uses AES-256 with CBC mode and PKCS5 padding for encrypted fields. Read Zoho's encryption White paper for further details.

What data is protected?

Depending on the feature being used, Zoho Apptics protects information, including:
  1. Personally identifiable information (PII), such as email addresses and IP addresses
  2. Authentication-related information
  3. Core analytics and engagement data (session, screens, events, APIs)
  4. Crash diagnostics
  5. Performance monitoring data
  6. User and device metadata
  7. Feedback data
  8. Store reviews data
Sensitive information is protected during transmission and while stored within Zoho Apptics.
NotesNote: The application developer is responsible for collecting user consent and configuring data collection in accordance with applicable privacy regulations. Zoho Apptics secures data after it is collected and transmitted by the application.

Full-disk encryption

In addition to application-layer encryption, Zoho infrastructure supports hardware-based full-disk encryption in supported data centers, providing another layer of protection for stored data.

Hardware-based full-disk encryption is currently available in the following regions:
  1. US (United States of America)
  2. IN (India)
  3. EU (European Union)
  4. JP (Japan)
  5. CN (China)
  6. AU (Australia)
  7. AE (United Arab Emirates)
  8. CA (Canada)
  9. SA (South Africa)
Info
For more information, refer to the Zoho's full-disk encryption documentation.