Evaluation Guide / Secure
Secure
Safeguard your enterprise. Trust in a platform built with security at its core.
App security
Data encryption
With Zoho Creator, data encryption is of paramount importance to ensure data security. The AES-256 encryption algorithm is used, which is a highly secure and widely accepted encryption standard. Each byte of data stored on Zoho Creator is encrypted using this algorithm. Additionally, data encryption happens in transit, which means that when data is transferred to and from the Zoho Creator platform, it's encrypted using secure HTTPS protocols.
Data portability
Zoho Creator allows users to export their data in various formats, such as CSV, PDF, and XLSX. This feature facilitates data portability and ensures that users can take their data along with them whenever they choose to leave the platform or move to another service. Data portability ensures that users have full control over their data.

Data retention
Zoho Creator offers data retention policies that enable users to retain their data for a specified period. This feature helps in complying with various data retention regulations and ensures that users maintain a copy of their data for backup and recovery purposes. Users can define the retention period for each individual application and choose to automatically delete data after a specified time period.
API security
Zoho Creator provides robust API security mechanisms to protect APIs from unauthorized access. The platform uses OAuth 2.0, an industry-standard authorization framework for API security. OAuth 2.0 ensures that only authorized applications can access Zoho Creator's APIs. Additionally, IP restrictions and SSL encryption provide additional security.
Session management
Zoho Creator session management ensures that user sessions are secure and protected from unauthorized access. The platform uses secure session tokens and cookies to manage user sessions. These tokens and cookies are encrypted, preventing session hijacking and other similar attacks. Additionally, session timeout policies ensure that idle sessions get terminated after a specified time period.
IP restriction
Zoho Creator provides IP restriction policies that enable users to restrict access to their applications based on IP addresses. IP restriction adds an extra layer of security to the platform and ensures that only authorized users can access the applications. Users can define the IP addresses that are allowed to access their applications, and all other requests from other IP addresses get denied.
Password policy
Zoho Creator's password policy ensures that users create strong and secure passwords. The platform enforces password policies that require users to create passwords that meet certain criteria, such as length, complexity, and expiration. Additionally, Zoho Creator uses secure password storage mechanisms like bcrypt, which ensures that user passwords are not stored in plain text and are not susceptible to brute force attacks.
Zoho security
Data center security
Zoho Creator provides maximum security to its clients by housing their data in state-of-the-art data centers. These data centers have been designed keeping in mind the most stringent security guidelines and standards in the industry.
Zoho data centers are equipped with physical security measures, such as biometric authentication systems, closed-circuit television (CCTV) cameras, and secure access controls. The data center facilities are also regulated by strict policies and procedures in accordance with the American Institute of Certified Public Accountants (AICPA) Trust Services Principles and Standards, ensuring optimal protection for customer data.
Furthermore, the data center adheres to globally recognized security norms, such as ISO 27001, SOC 2 Type 2, and GDPR. Regular audits and periodic assessments ensure that the data center facilities remain compliant with these industry standards.
Network security
Zoho Creator also provides robust network security features, ensuring that customer data stays safe and secure. This includes protection against cyber attacks, data breaches, and unauthorized access.
The Zoho Creator platform operates on a secure, private network that is continuously monitored for any suspicious activity. The network infrastructure is designed using industry-standard security protocols, such as SSL/TLS encryption, firewalls, and intrusion detection systems, which restrict unauthorized access to data.
Disaster recovery
Disaster recovery is an integral part of the Zoho Creator platform. In the unlikely event of a disaster, the platform ensures that client data is safe and secure, and business continuity is maintained.
Zoho Creator uses an innovative disaster recovery solution that is designed to minimize downtime and ensure that customer data is always available. The platform leverages backup and restoration systems, which includes regularly scheduled backups for all customer data, and replication across multiple disaster-recovery data centers. This allows local and remote redundancy to ensure that, in the event of a regional outage, client data is continuously available.
Business continuity
Zoho Creator provides a business continuity framework that is designed to ensure that customers continue to have access to data in the event of an unplanned interruption to the service. When a disruption occurs, the platform immediately shifts to a secondary data center to ensure no data is lost, and customers continue to be able to perform critical business functions.
Zoho Creator's business continuity framework is maintained through comprehensive testing and validation procedures. These include rigorous backup testing and disaster recovery simulations, providing clients with confidence in the platform's ability to consistently deliver performance and business continuity.
Customer controls for security
Zoho Creator provides granular and customizable security controls for customers to manage their data effectively. The platform enables customers to control their data access, authorization, and permissions for users through granular control settings. This ensures that only authorized users with approved access can access client data.
In addition, Zoho Creator provides detailed logging, auditing, and tracking of all user activity within the platform, ensuring that customers can monitor and track all changes in their data. This includes comprehensive audit trails, transaction records, and system authentication logs.
Compliance
Compliance is an essential aspect of any low-code platform, and Zoho Creator has robust compliance capabilities. This ensures that the security and privacy concerns of businesses are adequately addressed, thereby building trust and credibility. Below are detailed explanations of some of the compliance capabilities of Zoho Creator.
1. GDPR compliant
The General Data Protection Regulation (GDPR) is a comprehensive data protection regulation that came into effect in May 2018 in the European Union. Zoho Creator complies with the GDPR by providing customers with the right to request access to their data, rectify issues with it, and erase it. It also includes data protection impact assessment and breach notification rules.
2. ISO/IEC 27001 certification
ISO/IEC 27001 certification is a globally recognized standard for information security management. Zoho Creator is certified for the ISO/IEC 27001 standard, which signifies that the platform meets the highest standards for information security management. This ensures that the data of customers is secure and protected from unauthorized access.
3. SOC 2 + HIPAA compliance
SOC 2 and HIPAA compliance are essential for businesses that process and store sensitive healthcare data. Zoho Creator is compliant with SOC 2 and HIPAA requirements, which includes maintaining strict access control, regular audits and assessments, and data backup and recovery capabilities.
4. Swiss-U.S. Privacy Shield Framework
The Swiss-U.S. Privacy Shield is a framework that governs cross-border personal data transfer between Switzerland and the United States. Zoho Creator adheres to the Swiss-U.S. Privacy Shield Framework, ensuring that any data from customers located in Switzerland is adequately protected and secure, according to framework standards.
5. Data privacy
Data privacy is critical in today's business environment, where personal data is being collected and processed more than ever before. Zoho Creator takes data privacy seriously and provides essential features like role-based access control, using secure HTTPS communication, and data encryption to ensure the security and privacy of user data.
6. Transparent business model
Zoho Creator has a transparent business model, which means it discloses all its policies and procedures to customers. This ensures that customers are aware of how their data is being used, who has access to it, and what controls are in place to protect it.
7. Your right to restrict
Zoho Creator provides customers with the right to restrict the processing of their data if they believe it is not being used appropriately. This allows customers to control how their data is being used, ensuring that no unauthorized parties have access to it.
8. No adjunct surveillance
Adjunct surveillance is the use of additional technologies like cookies to collect data from users. Zoho Creator does not engage in adjunct surveillance, and instead, relies on the necessary data collected through forms, reports, and applications. This ensures that users are not being monitored unnecessarily and that their data is secure.