Business Email & Office Suites
Zoho Workplace
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Zoho Corporation · www.zoho.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Zoho Workplace at a glance
- Vendor
- Zoho Corporation
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Zoho Workplace 3/5, the mean of 6 judges. Zoho Workplace, a business email and office suite from Zoho Corporation, is strongest on mail and deliverability and administration and identity, which both range 7 to 7: mailboxes on the customer's own domain with IMAP, POP, SMTP and ActiveSync, SPF, DKIM, DMARC and DNSBL checks with quarantine, and an admin console with role-based permissions, SAML single sign-on on every plan and a broad provisioning API. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Zoho Workplace, a business email and office suite from Zoho Corporation, is strongest on mail and deliverability and administration and identity, which both range 7 to 7: mailboxes on the customer's own domain with IMAP, POP, SMTP and ActiveSync, SPF, DKIM, DMARC and DNSBL checks with quarantine, and an admin console with role-based permissions, SAML single sign-on on every plan and a broad provisioning API. Weakest are pricing transparency at 3 to 4 and sovereignty at 4 to 5: the pricing pages publish tiers, storage and VAT treatment plus a five-user free tier, yet we found no per-user price figure, and the Enterprise tier is priced only by contacting sales. The German imprint names Zoho Corporation GmbH in Essen and an EU data centre is stated, while the privacy policy says data may be processed, transferred and stored in the USA, the EEA and other countries where Zoho operates. Spreads never exceed one point; the sovereignty split — the data protection officer at 4 — turns on professional secrecy, the pricing split on whether terms detail compensates for prices not shown.
Speaks for it
- Mailboxes on your own domain with IMAP, POP, SMTP and ActiveSync, SPF, DKIM, DMARC and DNSBL checks and an admin quarantine.
- One admin console with role-based permissions, SAML single sign-on on every plan and a broad provisioning API.
- Migration tools from Microsoft 365, Google Workspace and Exchange with split, dual and split-plus-dual delivery for coexistence.
- TLS in transit and 256-bit AES at rest stated, with admin-enforceable multi-factor authentication, S/MIME and PGP.
- A 15-day trial without credit card, a five-user free tier and plan mixing within one organisation.
Held against it
- We found no per-user price figure on the pricing pages, and the Enterprise tier is priced only by contacting sales.
- The pages say only that Zoho is certified for the industry standards described there; we found no public information on GoBD-compliant archiving, legal hold or a transparency report on authority requests.
- Subprocessors are described as assessed but not listed with locations, while the privacy policy names processing in the USA, the EEA and other countries where Zoho operates.
- Mail export is EML in a ZIP per folder or up to one year at a time, with no documented organisation-wide export by an administrator.
- We found no public information on DMARC reporting, MTA-STS or DANE.
Best for
- You run mail and identity for several hundred seats and want one console, SAML single sign-on and an API to script provisioning.
- You are moving off Microsoft 365, Google Workspace or Exchange and want part of the organisation to migrate first while the rest stays put.
- You need S/MIME and PGP for correspondence with outside partners and can source certificates from a third party.
- You want one subscription bundling mail, calendar, document editors, chat and meetings, with desktop and mobile clients included.
Avoid if
- You must show a client or a budget an annual per-seat cost — the pricing pages show no per-user figures and Enterprise is contact-sales only.
- Your auditors require named certification scopes, GoBD-compliant archiving, legal hold or a transparency report on authority requests.
- You are bound by professional secrecy and need subprocessors listed with locations and processing confined to the EU.
- You need an administrator-run export of the whole organisation's mail on exit.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3.5 of 5 |
| Calendar, contacts & office apps | 3.5 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 3.5 of 5 |
| Migration, open standards & exit | 3 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Mail runs on the firm's own domain with IMAP, POP and documented SMTP servers (smtp.zoho.eu on ports 465 and 587), catch-all, delegated shared inboxes, and SPF, DKIM and DMARC checks with a quarantine an admin can review; ActiveSync is switchable per account and excluded only on the free tier, so my Outlook people need a paid seat. Storage (5 to 100 GB per user) and attachment limits (30/40 MB, large attachments up to 1 GB) are stated per plan. We found no public information on MTA-STS or DANE, DMARC reporting, or the delivery reputation of the outbound infrastructure. 2 4 6 12 17
The IT Administrator
Custom domains with aliases, shared and delegated mailboxes, documented IMAP, POP and SMTP settings, ActiveSync for the phones, catch-all, admin quarantine and inbound SPF, DKIM, DMARC and DNSBL checks with attachment limits stated per plan cover most of what I need to leave Exchange behind. We found no public information on MTA-STS or DANE, DMARC reporting, plus addressing, send limits, or the deliverability reputation of the outbound infrastructure. 2 4 6 12 17
The Public Sector IT Lead
The mailbox core is real: several domains with aliases and a catch-all, delegated access to other inboxes, IMAP, POP and SMTP on documented EU servers, ActiveSync, inbound SPF, DKIM, DMARC and DNSBL checks with quarantine, stated attachment limits, server-side rules and vacation replies. For eleven hundred mailboxes, though, we found no public information on DMARC reports, MTA-STS or DANE, plus addressing, send limits, or the deliverability record of the outbound infrastructure. 2 4 6 11 12 17
The IT Service Provider
Mailboxes on the customer's own domain with IMAP, POP, SMTP and ActiveSync, multiple domains and aliases in one console, and DKIM, SPF and catch-all manageable by console or API — I can wire up a client's DNS without opening a ticket. Inbound mail is validated against SPF, DKIM, DMARC and DNSBL with quarantine an admin can review, shared and delegated inboxes are there, and storage and attachment limits are published per plan. We found no public information on DMARC reporting, MTA-STS or DANE, native Outlook/MAPI, plus-addressing, or the outbound sending reputation. 2 4 5 6 12 17
The Data Protection Officer
Mailboxes run on the customer's own domain with IMAP, POP3, authenticated SMTP over SSL/TLS ports and Exchange ActiveSync manageable per account, plus catch-all, delegated shared inboxes, per-tier storage and attachment limits, and admin quarantine on failed SPF, DKIM and DMARC checks. We found no public information on MTA-STS or DANE, DMARC reporting, plus addressing, or the delivery reputation of the outbound infrastructure. For our practices this is a fully usable mailbox platform; the transport hardening and reputation evidence are the pieces not shown. 2 4 5 6 11 12 17
The Skeptic
Mailboxes on a custom domain with multiple domains, aliases, catch-all, group moderation and delegated inbox access are documented, with IMAP, POP, authenticated SMTP on smtp.zoho.eu and an administrator-settable ActiveSync status, plus SPF, DKIM, DMARC and DNSBL checks with quarantine and stated attachment and storage limits per plan. What the captured pages do not show is native Outlook MAPI, MTA-STS or DANE, DMARC reporting, plus-addressing, per-day send limits, or anything about the deliverability reputation of the outbound infrastructure. 2 4 6 11 12 17
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
CalDAV sync is documented for iPhones, iPads, Thunderbird and macOS calendars with two-way sync, and Outlook's calendar connects through the CalDAV plug-in — the shared calendar on every phone that I need. Room booking across branches, Writer, Sheet, Show, WorkDrive, Meeting and Cliq come in the bundle with desktop apps for macOS and Windows and mobile apps. We found no public information on free/busy lookup, delegated calendar access, CardDAV, or a company-wide address book. 1 5 6 13 14
The IT Administrator
The bundle ships a calendar with two-way CalDAV to phones and desktop clients, room booking across branches with admin-defined buildings, floors and rooms, tasks, Writer, Sheet and Show, WorkDrive, Cliq and Meeting, plus desktop and mobile apps included in the subscription. Outlook calendar sync runs through a CalDAV plug-in rather than native sync, and we found no public information on free/busy lookup, CardDAV or contacts sync to phones, an approval workflow for room bookings, or co-editing in the browser. 1 5 13 14
The Public Sector IT Lead
This is a full workplace rather than a webmail: CalDAV two-way sync to named Mac, iOS and desktop clients plus an Outlook plug-in, room booking across branches, buildings and floors, Writer, Sheet and Show, WorkDrive, Meeting with up to 250 participants, Cliq chat, ToDo, and macOS and Windows clients included in the subscription. The gaps that matter for replacing Microsoft 365 for us: we found no public information on free/busy lookup across providers, browser co-editing, CardDAV, delegated calendar access or an approval step on room bookings. 1 5 6 13 14
The IT Service Provider
CalDAV sync is documented in detail — Mac, iPhone, Thunderbird and eM Client, two-way for personal, shared and group calendars, plus an Outlook plug-in — and room booking across branches is built into the calendar. The bundle ships document, spreadsheet and presentation editors, team file storage, video meetings with stated participant limits, chat and tasks, with desktop clients included and mobile apps for mail and chat. We found no public information on free/busy lookup, CardDAV, delegated calendar access, or an accessibility standard for the interface. 1 5 6 13 14
The Data Protection Officer
The bundle ships shared calendars with two-way CalDAV sync to macOS, iOS, Thunderbird and Outlook via a plug-in, room and resource booking across branches on paid plans, tasks, the Writer, Sheet and Show editors, WorkDrive storage, Meeting and Cliq, with desktop and mobile apps included. We found no public information on free/busy lookup across providers, in-browser co-editing, delegated calendar access or booking approval. Resource booking being reserved for paid plans matters when several practices share rooms. 1 5 13 14
The Skeptic
The bundle ships calendar together with Writer, Sheet, Show, WorkDrive, Cliq chat and Meeting, with desktop clients for macOS and Windows, mobile apps, CalDAV sync to a long list of clients including an Outlook plug-in, tasks, and room booking across branches, buildings and floors. But the captured pages show no free/busy lookup, no meeting invitations across providers, no delegated calendar access, no approval step on room bookings, no CardDAV, and browser co-editing is never stated. 1 5 6 13 14
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
TLS and 256-bit AES at rest are stated, S/MIME (admin-enabled, certificate from a third party) and PGP are supported, multi-factor sign-in is enforceable, retention policies and eDiscovery exist, deleted mail sits 30 days in trash, and breaches are notified within 72 hours. For my GoBD audit we found no public information on audit-proof GoBD archiving, legal hold, a transparency report, or any named certification — only a general statement of being certified for industry standards. 5 6 7 15 16 17
The IT Administrator
TLS in transit and 256-bit AES at rest, admin-enforceable multi-factor authentication, phishing and account-takeover protection, 30-day trash restore, S/MIME on the two top plans and PGP on all four, eDiscovery, retention policies and SIEM integration give me most of what an auditor asks about. The certifications are described only as industry standards without a named ISO 27001 or BSI C5 scope and auditor, and we found no public information on GoBD-compliant archiving, legal hold, or a transparency report on authority requests. 5 6 7 9 15 16 17
The Public Sector IT Lead
S/MIME and PGP, admin-enforceable multi-factor authentication, 256-bit AES at rest with TLS in transit, retention policies with eDiscovery, SIEM integration and 30-day trash restore are all documented, and breach notification within 72 hours is committed. But the certification statement says only that Zoho is certified for the described industry standards — no ISO 27001 or BSI C5 is named with scope and auditor — and we found no public information on GoBD-compliant archiving, legal hold or a transparency report on authority requests, which would end the conversation with our auditors. 3 5 6 7 9 15 16 17
The IT Service Provider
TLS in transit and AES-256 at rest are stated, multi-factor authentication can be enforced by the admin with IP and location restrictions, and both S/MIME — activated by the admin, certificates bought from a third party — and PGP on every plan are supported. Retention policies, organisation-wide eDiscovery, a 30-day trash restore, SIEM integration and 72-hour breach notification are all documented. We found no public information on GoBD-compliant archiving, legal hold, a transparency report, or certifications named with their scope and auditor; the pages say only that Zoho is certified for the industry standards described there. 5 6 7 9 15 16 17
The Data Protection Officer
Encryption at rest in 256-bit AES and in transit is stated, S/MIME with digital signatures and automatic key exchange is documented on the top plans with certificates bought from a third party and works from outside clients like Outlook and Thunderbird, PGP is listed on all four plans, multi-factor authentication is enforceable organisation-wide, and retention policies with eDiscovery are documented. We found no public information on GoBD-compliant audit-proof archiving, legal hold, a transparency report on authority requests, or any named certification with its scope; the vendor states only that it was certified for industry standards. S/MIME our doctors can actually use with outside colleagues is the decisive positive; the unnamed certifications and the absent transparency report are what I cannot sign off on. 3 5 6 7 15 16 17
The Skeptic
TLS in transit and 256-bit AES at rest are stated, multi-factor authentication is enforceable for all users, S/MIME and PGP are supported, deleted mail is restorable for 30 days, and eDiscovery, retention policies and a 72-hour breach notification are documented. What I cannot verify is audit-proof archiving: no GoBD, no legal hold, no tamper-proof archive verification, no transparency report on authority requests, and the certification claim names no standard, auditor or scope — the S/MIME certificate itself must be bought from a third party. 3 5 6 15 16 17
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
The admin console covers users, groups, aliases and domains with role-based permissions, SAML single sign-on on all plans, Active Directory cloud sync on the Enterprise tier, mobile device management for Android and iOS, exportable reports including suspicious logins, and a wide provisioning API for users, domains, accounts and mail policies. Reseller accounts manage several customers from a reseller store, and support is around the clock by email, chat and phone on every plan. We found no public information on SCIM provisioning, remote wipe, or stated support response times. 4 5 6 17 18
The IT Administrator
An admin console for users, groups, mailboxes and domains, role-based admin permissions, SAML single sign-on on every plan, exportable audit, login and compliance reports, mobile device management for Android for Work and iOS APNs, a broad provisioning API reaching organizations, users and mail policies, and reseller accounts for managing several customers match how I run three hundred mailboxes. Active Directory cloud synchronisation is documented only with the Enterprise tier at individual pricing, and we found no public information on SCIM provisioning, remote wipe, or stated support response times. 2 4 5 6 17 18
The Public Sector IT Lead
An admin console for users, groups, domains and policies, role-based admin permissions, SAML single sign-on on every plan, Active Directory cloud sync with Zoho Directory on Enterprise, exportable mailbox, compliance and suspicious-login reports, MDM configuration for Android and iOS, a mobile admin app, a broad provisioning API and a reseller programme with a store to map and manage customers are all documented. SCIM provisioning, remote wipe and support response times are the pieces we found no public information on. 4 5 6 17 18
The IT Service Provider
One console for users, groups, domains and mail policies with role-based admin levels, traffic and storage dashboards, exportable reports including suspicious logins, a mobile admin app, and an API deep enough to script provisioning across organisation, domains, users and policies. SAML single sign-on is on every plan, Active Directory cloud sync comes with the Enterprise tier, and the reseller programme has a store to map and manage several customers, white-label on the two upper plans and 24/7 phone, chat and email support. We found no public information on SCIM provisioning, remote wipe, or support response-time commitments. 4 5 6 17 18
The Data Protection Officer
An admin console covers users, groups, domains and content moderation, with role-based admin levels, enforceable MFA and password policies, IP restrictions, SAML single sign-on on every plan, Active Directory cloud sync via Zoho Directory on the Enterprise tier, exportable admin, compliance and suspicious-login reports, SIEM integration, a broad REST API with OAuth 2.0, and a real reseller programme with partner store, training, support and white labelling. We found no public information on SCIM provisioning or remote wipe in the mobile device management. Support is stated as 24/7 by phone, chat and email on all plans, but without response times. 4 5 6 17 18
The Skeptic
An admin console for users, groups, domains and policies with role-based permissions, an extensive API including login-history and audit records, SAML single sign-on on all plans, Active Directory cloud sync, mobile device management for Android and iOS, a mobile admin app, and a reseller programme with a store to map and manage customer organisations — this is material an IT department can work with. The gaps are real though: SCIM provisioning, Entra ID or LDAP sync, an explicit remote wipe, and support response times are nowhere stated. 2 4 5 6 17 18
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
A documented tool migrates mails, contacts, calendars and notes from Microsoft 365, Google Workspace and Exchange, split and dual delivery lets part of the office move first while the rest stays put, and PST/EML import recreates the folder structure with failure notifications — that protects my client threads. Export is per folder or up to twelve months at a time as EML in a ZIP, IMAP, CalDAV and SMTP stay open, domains can be transferred away, and after cancellation data leaves the active database within a six-monthly cleanup and the backups three months later. We found no public information on an admin-level export of the whole organisation or export formats for calendars and contacts. 1 9 13 17 19
The IT Administrator
Documented migration tools move mail, contacts and calendars from Exchange, Microsoft 365 and Google Workspace, split, dual and split-plus-dual delivery give coexistence while part of the company migrates first, PST and EML import is documented, and deletion after cancellation is stated with timelines for the active database and backups. The documented export reaches single folders or ranges of up to one year of mail only, and we found no public information on migrating mailbox permissions, free/busy during coexistence, or export of calendars and contacts in standard formats. 1 9 13 17 19 20
The Public Sector IT Lead
Getting in is well documented — migration tools from Exchange, Microsoft 365 and Google for mail, contacts and calendars, split delivery so one part of the administration moves first, coexistence with Microsoft 365 or Google Workspace, PST import and CSV user import. Getting out is thinner: export runs per folder per account as EML in a ZIP, at most one year per run, and we found no public information on an organisation-wide admin export, calendar or contact export formats, a self-hosted or open-source edition, or a contractual data return; deletion from the active database within a six-month cycle and the backups three months later is stated. Schleswig-Holstein taught us the exit terms matter as much as the entrance. 1 9 17 18 19
The IT Service Provider
Migration tools are documented from Microsoft 365, Google Workspace and Exchange for mail, contacts, calendars, notes and files, with PST and EML import up to 500 MB per ZIP, folder-structure retention, IMAP migration, and coexistence via split or dual delivery while part of a company stays put. Mail exports as EML in a ZIP per folder or up to one year at a time, an admin can run an organisation-wide eDiscovery export, and deletion after cancellation is stated at six months from the active database plus three more from backups. We found no public information on calendar or contacts export in ICS or vCard, or a self-hosted edition. 1 9 17 18 19 20
The Data Protection Officer
Migration in is well documented: tools for Microsoft 365, Google Workspace and Exchange moving mail, contacts, calendars and files, PST and EML import with folder structure retained, and split, dual or split-plus-dual delivery for coexistence during the move. Getting out is thinner: export is EML inside a ZIP per folder or up to one year at a time delivered as a download link, with no documented whole-organisation export by an administrator, though end-of-contract deletion is stated (active database at the next six-monthly cleanup, backups three months later) and domains can be transferred to another registrar. We found no public information on open document formats, an open-source code base or a self-hosted edition. 1 9 17 19 20
The Skeptic
Getting in is well documented: migration tools from Microsoft 365, Google Workspace and Exchange carrying mail, contacts, calendars and files, PST and EML import up to 500 MB per archive, IMAP migration, coexistence via split or dual delivery, and a guided domain transfer to another registrar. Getting out is thinner: export is EML packed in ZIP per folder, at most one year at a time, delivered as a download link to the same account, with no documented calendar or contacts export and no whole-organisation export by an administrator; deletion after cancellation is stated (next six-monthly cleanup, backups three months after that). 1 4 13 17 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The German imprint names Zoho Corporation GmbH in Essen as the provider, an EU data centre is stated on the Mail pages, a data protection officer sits in Utrecht and a data processing addendum on EU model clauses is offered. But the terms say personal data may be processed and stored in the USA, the EEA and other countries where Zoho operates, the data centre is assigned by region at signup and accounts may be moved, the trademark owner is Zoho Corporation Private Limited, and subprocessors are not listed with their locations — an EU option with an Indian parent and a mixed processing chain. 2 8 9 10
The IT Administrator
An EU data centre is stated, the German imprint names Zoho Corporation GmbH in Essen with a Dutch data protection officer, and a data processing agreement based on EU standard contractual clauses is offered with GDPR as the worldwide baseline. The privacy policy still names processing in the USA and other countries where Zoho operates, push notifications run through Apple, Google and Windows services, hosting is assigned by region at signup and may be moved, and the captured pages list no subprocessors with their locations; the parent company sits in India. 2 7 8 9 10
The Public Sector IT Lead
On paper there is a German contracting entity — Zoho Corporation GmbH in Essen with a commercial register entry and a German VAT ID — an EU data centre, and a data processing addendum on the basis of the EU's model contractual clauses with a Data Protection Officer in Utrecht. But the parent and trademark owner sit with Zoho Corporation Private Limited in Chennai, the privacy policy has customers agree their data may be processed, transferred and stored in the USA and other countries where Zoho operates, push notifications run through Apple, Google and Windows services, and no subprocessor list with locations and no named ISO 27001 or BSI C5 certification appear. My council asked for owners who answer to European law only, and this chain does not show that. 2 7 8 9 10
The IT Service Provider
The German imprint names Zoho Corporation GmbH in Essen as the provider, with a commercial register entry and German VAT number, a Dutch entity holds the data protection officer role, and the German product pages state that data is stored in a data centre inside the EU. The parent and trademark owner is Zoho Corporation Private Limited in India, the privacy policy says personal and service data may be processed, transferred and stored in the USA, the EEA and other countries where Zoho operates, account location can be reassigned, and push notifications run through Apple, Google and Microsoft services; the captured pages state different things about where data is held, and subprocessors are described as assessed rather than listed with locations. 2 7 8 9 10
The Data Protection Officer
The German legal notice names Zoho Corporation GmbH in Essen with a data protection officer at a Dutch entity, the marketing pages promise an EU data centre, and a data processing addendum based on the EU standard contractual clauses with an intra-group agreement is offered. Against that, the privacy policy says personal information and service data are processed, transferred and stored in the USA, the EEA and other countries where Zoho operates, the terms say the data centre is assigned by region at signup and accounts may be migrated to other facilities, and the subprocessors are assessed but never listed with names or locations. With an Indian parent and no answer to who at the provider can open a mailbox and under which law, I cannot clear this chain for patient correspondence under professional secrecy. 2 8 9 10
The Skeptic
A German contracting entity (Zoho Corporation GmbH, Essen) and an EU data centre are stated, the infrastructure is Zoho's own, and transfers are covered by an intra-group agreement based on EU Standard Contractual Clauses. But the privacy policy consents to processing in the USA, the EEA and other countries where the Indian parent operates, the terms reserve the right to move accounts to other facilities, and I found no subprocessor list with locations, no published data processing agreement on the captured pages, and a certification claim that names nothing. 2 8 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
The tiers are public with their inclusions, storage per user, attachment limits and VAT treatment (local taxes added on top), plan mixing is allowed, and price changes take effect only after the current billing cycle while I must give notice seven days before renewal. But we found no public information on a per-user price figure, minimum users, contract term, or monthly-versus-annual billing, and the Enterprise tier is individual pricing via a sales contact — so I cannot compute what the second year costs my twelve seats. 5 6 10
The IT Administrator
Four tiers are published with per-user mail storage, archive storage, attachment limits and included products, VAT treatment is stated as local taxes in addition to the stated prices, a 15-day trial without credit card, a five-user free tier and mixable mail-only and workplace plans are documented, with cancellation terms of seven days before renewal. No per-user price figures appear in the captured material, the Enterprise tier is priced only by contacting sales, S/MIME certificates must be bought from a third party, and we found no public information on a monthly versus annual billing comparison, minimum users, or the cost of extra storage, additional domains and shared mailboxes. 5 6 10 14 15
The Public Sector IT Lead
Tier structures are public and unusually detailed on inclusions — storage per user, attachment limits, the products in each plan, plan mixing, local taxes added on top of stated prices, credit-card-only billing for terms under a year, a free tier for five users and a 15-day trial. But the captured pricing pages contain no per-user price figures at all, Enterprise is individually priced via the sales team, and additional storage and the third-party S/MIME certificate are unpriced, so I cannot compute an annual cost for eleven hundred mailboxes from what was captured. 5 6 15
The IT Service Provider
The tier structure is public and unusually detailed on terms: Mail Lite through Workplace Professional with storage, archive and attachment limits per plan, a five-user free tier without IMAP or ActiveSync, a 15-day trial without credit card, plan mixing in one organisation, VAT stated as added on top, and auto-renewal, notice and refund rules published. But the captured pricing pages show no price per user at any tier, Enterprise is contact-sales only, and S/MIME certificates must be bought from a third party, so I cannot put an annual figure in front of a client from these pages. 5 6 10 15
The Data Protection Officer
The captured pricing pages publish the tiers with their storage, attachment limits and included products, state that local taxes come on top, that subscriptions under a year are credit-card only, that renewal is automatic with seven days' notice, and that S/MIME certificates and the Enterprise tier are priced individually. However, we found no per-user price figures on the captured pages, so a practice group cannot compute its annual cost from what we read. The structure of what costs extra is public; the prices themselves are not. 5 6 10 15
The Skeptic
Tier structures with storage and inclusions, VAT treatment, a fifteen-day trial without credit card, plan mixing and cancellation terms are public. But the captured pricing pages contain no per-user price figure at all, nothing on monthly versus annual billing, minimum users or term, or the price of extra storage — and the enterprise tier is contact-sales only. 5 6 10 15
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Zoho Workplace
Is Zoho Workplace European?
No. whats-best.ai classifies Zoho Workplace as Rest of world.
Where does Zoho Workplace store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Zoho Workplace have a free plan?
Yes. Zoho Workplace has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to Zoho Workplace?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Zoho Workplace alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (Workplace) www.zoho.com Checked 5 Nov 2026 Details →
- 2 Features page (Zoho Mail) www.zoho.com Checked 5 Nov 2026 Details →
- 3 Security / trust page www.zoho.com Checked 5 Nov 2026 Details →
- 4 API documentation www.zoho.com Checked 5 Nov 2026 Details →
- 5 Pricing page www.zoho.com Checked 5 Nov 2026 Details →
- 6 Pricing page (Zoho Mail) www.zoho.com Checked 5 Nov 2026 Details →
- 7 GDPR page www.zoho.com Checked 5 Nov 2026 Details →
- 8 Legal notice www.zoho.com Checked 5 Nov 2026 Details →
- 9 Privacy policy www.zoho.com Checked 5 Nov 2026 Details →
- 10 Terms of service www.zoho.com Checked 5 Nov 2026 Details →
- 11 Mail, domains & deliverability — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 12 Mail, domains & deliverability — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 13 Calendar, contacts & office apps — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 14 Calendar, contacts & office apps — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 15 Security, encryption & compliance archiving — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 16 Security, encryption & compliance archiving — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 17 Administration, identity & partner management — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 18 Administration, identity & partner management — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 19 Migration, open standards & exit — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →
- 20 Migration, open standards & exit — found from sitemap www.zoho.com Checked 5 Nov 2026 Details →