Security / trust page — ManageEngine ServiceDesk Plus

Cited by

Facts read from this source

• ISMS Report an error

  “We have an Information Security Management System (ISMS) in place which takes into account our security objectives and the risks and mitigations concerning all the interested parties.”

• Employee background checks Report an error

  “Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf.”

• Confidentiality agreement training Report an error

  “Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance.”

• Internal audit team Report an error

  “We have a dedicated compliance team to review procedures and policies in Zoho to align them with standards, and to determine what controls, processes, and systems are needed to meet the standards.”

• Datacenter colocation Report an error

  “At our Data Centers, a co location provider takes responsibility of the building, cooling, power, and physical security, while we provide the servers and storage.”

• Datacenter access authentication Report an error

  “Additional two-factor authentication and biometric authentication are required to enter the premises.”

• Cctv monitoring Report an error

  “We monitor all entry and exit movements throughout our premises in all our business centers and data centers through CCTV cameras deployed according to local regulations.”

• Network segmentation Report an error

  “Our systems are segmented into separate networks to protect sensitive data. Systems supporting testing and development activities are hosted in a separate network from systems supporting ManageEngine's production infrastructure.”

• Network redundancy Report an error

  “All the components of our platform are redundant. We use a distributed grid architecture to shield our system and services from the effects of possible server failures.”

• Ddos prevention Report an error

  “We use technologies from well-established and trustworthy service providers to prevent DDoS attacks on our servers.”

• Server hardening Report an error

  “All servers provisioned for development and testing activities are hardened (by disabling unused ports and accounts, removing default passwords, etc.).”

• Waf Report an error

  “At the application layer, we have our proprietary WAF which operates on both whitelist and blacklist rules.”

• Owasp framework Report an error

  “Our robust security framework based on OWASP standards, implemented in the application layer, provides functionalities to mitigate threats such as SQL injection, cross site scripting and application layer DOS attacks.”

• Data isolation Report an error

  “Each customer's service data is logically separated from other customers' data using a set of secure protocols in the framework. This ensures that no customer's service data becomes accessible to another customer.”

• Data ownership no sharing Report an error

  “Your data is owned by you, and not by Zoho. We do not share this data with any third-party without your consent.”

• Encryption in transit Report an error

  “We mandate all connections to our servers use Transport Layer Security (TLS 1.2/1.3) encryption with strong ciphers, for all connections including web access,API access,our mobile apps, and IMAP/POP/SMTP email client access.”

• Encryption pfs hsts Report an error

  “We have full support for Perfect Forward Secrecy (PFS) with our encrypted connections, which ensures that even if we were somehow compromised in the future, no previous communication could be decrypted. We have enabled HTTP Strict Transport Security header (HSTS) to all our web connections.”

• Encryption at rest Report an error

  “Sensitive customer data at rest is encrypted using 256-bit Advanced Encryption Standard (AES).”

• Key management Report an error

  “We own and maintain the keys using our in-house Key Management Service (KMS). We provide additional layers of security by encrypting the data encryption keys using master keys.”

• Retention deletion Report an error

  “Once you terminate your Zoho user account, your data will get deleted from the active database during the next clean-up that occurs once every 6 months. The data deleted from the active database will be deleted from backups after 3 months.”

• Inactive account termination Report an error

  “In case of your unpaid account being inactive for a continuous period of 120 days, we reserve the right to terminate it after giving you prior notice and option to back-up your data.”

• Device disposal Report an error

  “We degauss failed hard drives and then physically destroy them using a shredder. We crypto-erase and shred failed Solid State Devices (SSDs).”

• SSO Report an error

  “We also support SAML for single sign-on that makes it possible for customers to integrate their company's identity provider like LDAP,ADFS when they login to Zoho services.”

• MFA Report an error

  “Currently, different modes like biometric Touch ID or Face ID, Push Notification, QR code, and Time-based OTP are supported.”

• Admin access control Report an error

  “We adhere to the principles of least privilege and role-based permissions to minimize the risk of data exposure.”

• Production access auth Report an error

  “Access to production environments is maintained by a central directory and authenticated using a combination of strong passwords, two-factor authentication, and passphrase-protected SSH keys.”

• Customer audit logging Report an error

  “Detailed audit logging covering all update and delete operations performed by the user are available to the customers in every ManageEngine cloud service.”

• Vulnerability management Report an error

  “We have a dedicated vulnerability management process that actively scans for security threats using a combination of certified third-party scanning tools and in-house tools, and with automated and manual penetration testing efforts.”

• Malware scanning Report an error

  “We scan all user files using our automated scanning system that’s designed to stop malware from being spread through Zoho's ecosystem.”

• Dmarc Report an error

  “Zoho Corporation supports Domain-based Message Authentication, Reporting, and Conformance (DMARC) as a way to prevent spam. DMARC uses SPF and DKIM to verify that messages are authentic.”

• Backup schedule Report an error

  “We run incremental backups everyday and weekly full backups of our databases using Zoho Admin Console (ZAC) for ManageEngine's DCs. Backup data in the DC is stored in the same location and encrypted using AES-256 bit algorithm.”

• Backup retention Report an error

  “All backed up data are retained for a period of three months. If a customer requests for data recovery within the retention period, we will restore their data and provide secure access to it.”

• Disaster recovery Report an error

  “Application data is stored on resilient storage that is replicated across data centers. Data in the primary DC is replicated in the secondary in near real time. In case of failure of the primary DC, secondary DC takes over”

• Breach notification GDPR Report an error

  “As data controllers, we notify the concerned Data Protection Authority of a breach within 72 hours after we become aware of it, according to the General Data Protection Regulation (GDPR).”

• Bug bounty Report an error

  “A vulnerability reporting program in "Bug Bounty", to reach the community of researchers, is in place, which recognizes and rewards the work of security researchers.”

• Vendor management Report an error

  “We evaluate and qualify our vendors based on our vendor management policy. We onboard new vendors after understanding their processes for delivering us service, and performing risk assessments.”

• Security programs Report an error

  “We have dedicated security and privacy teams that implement and manage our security and privacy programs.”

• Endpoint security Report an error

  “All workstations issued to Zoho employees run up-to-date OS version and are configured with anti-virus software.”

• Access cards logging Report an error

  “We provide employees, contractors, vendors, and visitors with different access cards that only allow access strictly specific to the purpose of their entrance into the premises.”

• Firewall monitoring Report an error

  “A network engineer reviews all changes made to the firewall everyday. Additionally, these changes are reviewed once in every six months to update and revise the rules.”

• Intrusion detection Report an error

  “Our intrusion detection mechanism takes note of host-based signals on individual devices and network-based signals from monitoring points within our servers.”

• Backup recommendation customer Report an error

  “From your end, we strongly recommend scheduling regular backups of your data by exporting them from the respective Zoho services and storing it locally in your infrastructure.”

• Incident notification channels Report an error

  “For incidents specific to an individual user or an organization, we will notify the concerned party through email (using their primary email address of the Organisation administrator registered with us).”

• Shared responsibility Report an error

  “We provide a thorough analysis on the shared responsibility model and how both our customers and Zoho can collaborate as well as take up individual responsibility towards cloud security and privacy.”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Change & Configuration Manager Change, problem & release management
• The Change & Configuration Manager Self-service portal & service catalog
• The Change & Configuration Manager Deployment, integrations & multi-client operation
• The Change & Configuration Manager European sovereignty
• The MSP Owner Deployment, integrations & multi-client operation
• The MSP Owner European sovereignty
• The Municipal IT Lead Change, problem & release management
• The Municipal IT Lead Self-service portal & service catalog
• The Municipal IT Lead Deployment, integrations & multi-client operation
• The Municipal IT Lead European sovereignty
• The Service Desk Lead Self-service portal & service catalog
• The Service Desk Lead Deployment, integrations & multi-client operation
• The Service Desk Lead European sovereignty
• The Skeptic Self-service portal & service catalog
• The Skeptic Deployment, integrations & multi-client operation
• The Skeptic European sovereignty
• The Solo IT Admin Deployment, integrations & multi-client operation
• The Solo IT Admin European sovereignty