# Zoho Workplace — Business Email & Office Suites

Zoho Workplace by Zoho Corporation holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Zoho Corporation (https://www.zoho.com/de/workplace/)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-email/zoho-workplace
- Alternatives: https://whats-best.ai/software/business-email/zoho-workplace/alternatives ([markdown](https://whats-best.ai/software/business-email/zoho-workplace/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Zoho Corporation
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S5]

## The panel's verdict

Zoho Workplace, a business email and office suite from Zoho Corporation, is strongest on mail and deliverability and administration and identity, which both range 7 to 7: mailboxes on the customer's own domain with IMAP, POP, SMTP and ActiveSync, SPF, DKIM, DMARC and DNSBL checks with quarantine, and an admin console with role-based permissions, SAML single sign-on on every plan and a broad provisioning API. Weakest are pricing transparency at 3 to 4 and sovereignty at 4 to 5: the pricing pages publish tiers, storage and VAT treatment plus a five-user free tier, yet we found no per-user price figure, and the Enterprise tier is priced only by contacting sales. The German imprint names Zoho Corporation GmbH in Essen and an EU data centre is stated, while the privacy policy says data may be processed, transferred and stored in the USA, the EEA and other countries where Zoho operates. Spreads never exceed one point; the sovereignty split — the data protection officer at 4 — turns on professional secrecy, the pricing split on whether terms detail compensates for prices not shown.

**Speaks for it:**
- Mailboxes on your own domain with IMAP, POP, SMTP and ActiveSync, SPF, DKIM, DMARC and DNSBL checks and an admin quarantine.
- One admin console with role-based permissions, SAML single sign-on on every plan and a broad provisioning API.
- Migration tools from Microsoft 365, Google Workspace and Exchange with split, dual and split-plus-dual delivery for coexistence.
- TLS in transit and 256-bit AES at rest stated, with admin-enforceable multi-factor authentication, S/MIME and PGP.
- A 15-day trial without credit card, a five-user free tier and plan mixing within one organisation.

**Held against it:**
- We found no per-user price figure on the pricing pages, and the Enterprise tier is priced only by contacting sales.
- The pages say only that Zoho is certified for the industry standards described there; we found no public information on GoBD-compliant archiving, legal hold or a transparency report on authority requests.
- Subprocessors are described as assessed but not listed with locations, while the privacy policy names processing in the USA, the EEA and other countries where Zoho operates.
- Mail export is EML in a ZIP per folder or up to one year at a time, with no documented organisation-wide export by an administrator.
- We found no public information on DMARC reporting, MTA-STS or DANE.

**Best for:**
- You run mail and identity for several hundred seats and want one console, SAML single sign-on and an API to script provisioning.
- You are moving off Microsoft 365, Google Workspace or Exchange and want part of the organisation to migrate first while the rest stays put.
- You need S/MIME and PGP for correspondence with outside partners and can source certificates from a third party.
- You want one subscription bundling mail, calendar, document editors, chat and meetings, with desktop and mobile clients included.

**Avoid if:**
- You must show a client or a budget an annual per-seat cost — the pricing pages show no per-user figures and Enterprise is contact-sales only.
- Your auditors require named certification scopes, GoBD-compliant archiving, legal hold or a transparency report on authority requests.
- You are bound by professional secrecy and need subprocessors listed with locations and processing confined to the EU.
- You need an administrator-run export of the whole organisation's mail on exit.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Calendar, contacts & office apps | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Security, encryption & compliance archiving | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| Administration, identity & partner management | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Migration, open standards & exit | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 | 2.5/5 |
| Pricing transparency | 1.5/5 | 2/5 | 1.5/5 | 2/5 | 1.5/5 | 1.5/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Breach notification: 72 [S7]
- Certifications: yes [S9]
- Cookie privacy statement: no · no [S1]
- Dnt: no [S9]
- DPA available: yes · legal@zohocorp.com [S7]
- DPA available: yes [S9]
- DPA basis: Model Contractual Clauses [S7]
- Dpia: yes [S7]
- Eea rights extended: yes [S9]
- Encryption: yes [S3]
- Encryption at rest: yes [S7]
- GDPR baseline: GDPR controls implemented as baseline standard worldwide; effective 25 May 2018 [S7]
- GDPR HIPAA: yes · yes [S3]
- GDPR page link: yes [S10]
- HIPAA faq: FAQ-Frage zu HIPAA-Konformität vorhanden, Antwort nicht im Text erfasst [S6]
- Iar: yes [S7]
- Internal audits: yes [S7]
- No ad sales: no [S9]
- No third party tracking: no [S2]
- Privacy policy: yes [S3]
- Product assessment: yes [S7]
- Subprocessor assessment: yes [S7]
- Transfer mechanism: EU Standard Contractual Clauses based intra-group agreement [S9]

**Data**
- Credit card storage: no · yes [S9]
- Dormant account cleanup: yes [S7]
- Export delivery: email_link_zip_download [S19]
- Export format: EML · ZIP [S19]
- Export scope: yes · 12 [S19]
- Import eml zip max size mb: 500 [S19]
- Import failure notification: yes [S19]
- Import folder structure retention: yes [S19]
- Import pst supported: yes [S19]
- Import target folder selection: yes [S19]
- Mobile location sharing: yes [S9]
- Ownership: yes [S10]
- Retention active: 6 · 3 [S9]
- Service data ownership: yes [S9]

**Hosting**
- EU datacenter: EU data center [S2]
- Infrastructure: Zoho · yes [S1]
- Location: Data center location assigned based on region/country at signup; Zoho may migrate accounts to other facilities; local copy possible via Zoho group entity in region [S10]
- Regional domains: EU/US users must use country-coded domain extensions (.com, .eu, .au, etc.) [S13]
- Transfer locations: USA · EEA · other countries where Zoho operates [S9]

**Integrations**
- API modules: Organization API · Domains API · Groups API · Users API · Mail Policy API · Accounts API · Folders API · Labels API · Email API · Signatures API · Threads API · Tasks API · Bookmarks API · Notes API · Logs API · Anti-spam API · Developer S… [S4]
- CRM: yes · yes [S2]
- Federated auth: LinkedIn · Microsoft · Google [S9]
- Import export settings path: Settings > Import/Export Emails [S19]
- Oauth2: Zoho Mail API uses OAuth 2.0 with named scopes such as ZohoMail.organization.accounts and ZohoMail.messages [S4]
- Smtp account specific settings: exact server details vary by account type and datacenter; shown under Server Configurations Details in the account [S12]
- Smtp app specific password: application-specific password required for other devices when two-factor authentication is enabled [S12]
- Smtp authentication required: yes [S12]
- Smtp export import: yes · yes · yes [S12]
- Smtp port 25 not supported: 465 · 587 · no [S12]
- Smtp sender must match account: sending email address must match the account's email address/aliases or Relaying Disallowed error occurs [S12]
- Smtp ssl server: 465 · 587 · yes · yes · smtp.zoho.eu · smtp.zoho.eu [S12]
- Smtp ssl server paid org: 465 · paid_organisation_domain_email · smtppro.zoho.eu · SSL [S12]
- Smtp tls server paid org: 587 · paid_organisation_domain_email · smtp.zoho.eu · TLS [S12]
- Third party apps: yes · yes [S10]

**Legal**
- Children age limit: 16 [S9]
- Commercial register: HRB 36774 · Amtsgericht Essen [S8]
- Content responsible: Suvish Viswanathan [S8]
- Entity name: Zoho Corporation GmbH · II. Hagen 7, 45127 Essen, Deutschland [S8]
- Governing law: Governing law and jurisdiction based on billing address for paying customers [S10]
- Last updated: 2022-03-02 [S9]
- Liability cap: USD 1000 or fees paid in prior 12 months, whichever is higher [S10]
- Marketplace developer data: no · yes [S9]
- Privacy policy revised: yes [S7]
- Sales contact: sales@eu.zohocorp.com [S1]
- Termination refund: yes [S10]
- Terms change notice days: 30 [S10]
- Trademark owner: Zoho Corporation Private Limited [S10]
- Updated date: 2022-03-02 [S10]
- VAT id: DE340244058 [S8]
- Warranty disclaimer: as-is, as-available, all warranties disclaimed [S10]

**Pricing**
- Cancellation notice days: 7 [S10]
- Enterprise: Vertrieb kontaktieren [S5]
- Free tier: 5 · 5 · no [S6]
- Free trial: yes [S3]
- Plan mixing: yes [S6]
- Price change notice: Price changes apply only after current billing cycle ends [S10]
- Resource booking paid plans only: no · paid plans only · no [S14]
- S mime certificate not included: third party · no [S15]
- Sub year credit card only: yes [S10]
- Subscription billing: yes [S10]
- Trial: 15 · no [S6]
- Trial free: Free trial period available; data lost unless paid plan purchased or data exported before trial ends [S10]
- VAT: yes [S5]
- VAT: yes [S6]
- Workplace enterprise: yes [S6]

**Product**
- Account administrators: yes [S10]
- Admin console: user management · group aliases · moderation policies [S2]
- Admin dashboard: Admin dashboard with email traffic stats, user overviews, storage reports, security status [S17]
- Admin reports: yes · mailbox · compliance · suspicious logins [S17]
- Admin roles: yes [S17]
- AI data usage: yes · yes [S9]
- Allow block lists: yes [S17]
- Allowlist blocklist: Users can add email addresses or domains to an allowlist (whitelist) and blocklist in Zoho Mail settings [S11]
- Allowlist not guaranteed: Allowlisting does not guarantee 100% inbox delivery; allowlisted emails can still fail spam checks [S11]
- Archive by date or count: date · email_count [S16]
- Archive folder options: yes [S16]
- Archive keeps email in folder: Archived emails remain in the same folder but are removed from the email list [S16]
- Archive no storage reduction: no [S16]
- Archive not synced imap: no [S16]
- Archive restore from trash: 30 [S16]
- Archive unread count exclusion: yes [S16]
- Attachment limits: 30 · 40 [S6]
- Attachments upload: yes [S4]
- Audit logs API: login history · audit records · SMTP logs · yes [S4]
- Blocklist delivery: Blocklisted email addresses are always delivered to the Spam folder [S11]
- Bookmarks API: yes [S4]
- Caldav account deletion behavior: Deleting CalDAV account removes synced device-side events; events remain in Zoho Calendar [S13]
- Caldav app calendars excluded: App Calendars · no [S13]
- Caldav app specific password: Application Specific Password required when TFA is enabled [S13]
- Caldav evolution one calendar limit: In Evolution, only one calendar can be synced at a time [S13]
- Caldav multi calendar sync: yes · yes [S13]
- Caldav no calendar creation: no [S13]
- Caldav offline editing: Offline event creation/editing syncs when back online [S13]
- Caldav paid user limitation: Shared, Subscribed and Group Calendars · Paid Org users and Personal users only [S13]
- Caldav primary calendar default: primary calendar under My Calendars [S13]
- Caldav server address: https://calendar.zoho.com/ · yes [S13]
- Caldav supported apps: OS X Calendar · BusyCal · Fantastical · iPhone · iPad · Thunderbird Lightning · eM Client · Gnome's Evolution [S13]
- Caldav sync: CalDAV sync provides one-way or two-way sync between Zoho Calendar and CalDAV-supporting calendar apps [S13]
- Caldav sync modes: two-way · two-way · two-way · read-only [S13]
- Caldav wellknown URL: https://calendar.zoho.com/.well-known/caldav [S13]
- Catch all: yes [S17]
- Catchall API: yes [S4]
- Cliq channels: 500 · 500 · 100 · 100 · 100 · 20000 [S5]
- Cliq limits: Unbegrenzt · 10.000 · 10.000 · Unbegrenzt · 15 · 5 · 5 · 60 [S5]
- Cliq meeting limits: 5 · 5 · 15 · 60 [S6]
- Cliq searchable messages: 10000 · 10000 · unlimited · unlimited [S6]
- Collaboration capabilities: Dateien · Aufgaben · Kalender · Editoren für Dokumente, Tabellen und Präsentationen [S1]
- Communication capabilities: E-Mails · Konferenzen · Anrufe · Sprachkanäle · Teambenachrichtigung [S1]
- Connect: yes · 5 externe Benutzer pro Mitglied [S5]
- Cpaas: Mitarbeiter · SMTP und API · E-Mail-Analyse · Sperrliste · Webhooks · yes [S5]
- Custom domain: yes [S2]
- Custom login URL: yes [S17]
- Customer count: 550000 [S5]
- Customer count: 550000 [S6]
- Data center security: yes [S3]
- Data subject requests: yes [S17]
- Delivery routing: Split · Dual · Split+Dual [S17]
- Desktop apps: Mail · Calendar · Writer · Sheet · Cliq · Meeting · WorkDrive (Sync) · macOS · Windows · no · yes [S1]
- Developer space sdk: yes [S4]
- Diagnostic toolkit: port checks · email header analysis · domain lookup [S17]
- Disclaimer footer: Organization-wide email disclaimer/footer management [S17]
- Dkim spf management: yes [S4]
- Domain purchase: yes [S2]
- Domain purchase: Buy and manage multiple domains, aliases in admin console [S17]
- Domain transfer: yes [S17]
- Ediscovery: whole organization · specific accounts · include/exclude spam and deleted emails · yes [S17]
- Empty folder keeps archived: no [S16]
- Encryption: yes · yes · yes [S2]
- Encryption: SSL/TLS · 256-Bit-AES [S6]
- Encryption at rest transit: yes · yes [S15]
- Encryption features: alle 4 Pläne · alle 4 Pläne · 2 Pläne [S5]
- Engagement features: Live-Town Halls · Firmenforen · Live-Events · Auszeichnungen [S1]
- Enterprise ad sync: yes [S5]
- Enterprise vpc: yes [S5]
- Export delivery: Export wird als ZIP-Download-Link per E-Mail an dasselbe Konto zugestellt [S20]
- Export scope: gesamter Ordner oder Zeitraum bis zu 1 Jahr [S20]
- Export source accounts: EML · lokale Speicherung/Backup [S20]
- Free plan: 5 · 1 · yes · 5 · no [S5]
- Free plan datacenter note: Ausgewählte Rechenzentren (Free Plan) [S5]
- Free tier datacenter restriction: yes [S6]
- Free trial: yes [S1]
- GDPR products listed: 33 Zoho products listed as GDPR-ready [S7]
- Group moderation: Group email moderation with moderators [S17]
- Group moderation API: yes [S4]
- Imap migration: yes [S1]

**Support**
- Migration: yes [S5]
- Notifications: yes · no [S10]
- Sales email: sales@eu.zohocorp.com [S2]
- Sales email: sales@eu.zohocorp.com [S5]
- Smtp troubleshooting email: support@zohomail.com (for traceroute and connection issues) [S12]

128 more facts on the canonical page: https://whats-best.ai/software/business-email/zoho-workplace

## Questions

### Is Zoho Workplace European?

No. whats-best.ai classifies Zoho Workplace as Rest of world.

### Where does Zoho Workplace store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Zoho Workplace have a free plan?

Yes. Zoho Workplace has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18543).

### What are the best alternatives to Zoho Workplace?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Zoho Workplace alternatives](https://whats-best.ai/software/business-email/zoho-workplace/alternatives).

## What this page leaves out

- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor homepage (Workplace): https://www.zoho.com/de/workplace/ (checked 2026-11-05)
- [S2] Features page (Zoho Mail): https://www.zoho.com/de/mail/ (checked 2026-11-05)
- [S3] Security / trust page: https://www.zoho.com/workplace/security.html (checked 2026-11-05)
- [S4] API documentation: https://www.zoho.com/mail/help/api/ (checked 2026-11-05)
- [S5] Pricing page: https://www.zoho.com/de/workplace/pricing.html (checked 2026-11-05)
- [S6] Pricing page (Zoho Mail): https://www.zoho.com/de/mail/zohomail-pricing.html (checked 2026-11-05)
- [S7] GDPR page: https://www.zoho.com/gdpr.html (checked 2026-11-05)
- [S8] Legal notice: https://www.zoho.com/de/impressum.html (checked 2026-11-05)
- [S9] Privacy policy: https://www.zoho.com/de/privacy.html (checked 2026-11-05)
- [S10] Terms of service: https://www.zoho.com/de/terms.html (checked 2026-11-05)
- [S11] Mail, domains & deliverability — found from sitemap: https://www.zoho.com/mail/help/anti-spam.html (checked 2026-11-05)
- [S12] Mail, domains & deliverability — found from sitemap: https://www.zoho.com/mail/help/zoho-smtp.html (checked 2026-11-05)
- [S13] Calendar, contacts & office apps — found from sitemap: https://www.zoho.com/calendar/help/caldav-sync-zoho-calendar.html (checked 2026-11-05)
- [S14] Calendar, contacts & office apps — found from sitemap: https://www.zoho.com/mail/help/resource-booking-by-zoho-calendar.html (checked 2026-11-05)
- [S15] Security, encryption & compliance archiving — found from sitemap: https://www.zoho.com/mail/help/s-mime.html (checked 2026-11-05)
- [S16] Security, encryption & compliance archiving — found from sitemap: https://www.zoho.com/mail/help/archive.html (checked 2026-11-05)
- [S17] Administration, identity & partner management — found from sitemap: https://www.zoho.com/mail/admin-console.html (checked 2026-11-05)
- [S18] Administration, identity & partner management — found from sitemap: https://www.zoho.com/partners/resellers.html (checked 2026-11-05)
- [S19] Migration, open standards & exit — found from sitemap: https://www.zoho.com/mail/help/import-export-emails.html (checked 2026-11-05)
- [S20] Migration, open standards & exit — found from sitemap: https://www.zoho.com/de/mail/help/import-export-emails.html (checked 2026-11-05)

---

Cite as: whats-best.ai, "Zoho Workplace — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/zoho-workplace

Corrections: https://whats-best.ai/correct/1558?target=page