CRM
Zoho CRM
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 2 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Zoho Corporation · www.zoho.com
Compare with HubSpot Sales Hub → Compare with Odoo CRM → Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Zoho CRM scores strongest on automation, where scores cluster at 5 — workflows and assignment rules in the low tiers, journey orchestration reserved for Enterprise. Data portability is the weakest, scored 2 across the range: export and deletion are request-based rights, migration support ships only with the top tier, and we found no public information on self-serve export. Integrations and sovereignty cluster at 4 — over 1,000 marketplace applications, a selectable EU datacenter, a data processing agreement via website form and a data protection officer in Utrecht — though captured terms permit processing in the USA, the EEA and other countries where Zoho operates. Contact management spans 2 to 4, the split turning on how much weight to give teamspaces, audit logs and custom functions at upper tiers against a record model that shows only leads and deals; we found no public information on deduplication, merge tooling or field validation. Pricing transparency spans 3 to 4: the tier ladder and a permanent free tier for 3 users are public, but no per-seat figures for paid tiers appear, so the renewal invoice is not computable.
Speaks for it
- Automation scores cluster at 5, with workflows and assignment rules from the free tier and journey orchestration gated to Enterprise.
- A permanently free tier for 3 users carries leads, deals, workflows, reports and a mobile app, plus a 15-day trial without a credit card.
- Integrations scores cluster at 4 on a marketplace of over 1,000 applications and federated login via LinkedIn, Microsoft and Google.
- Sovereignty scores cluster at 4 with a selectable EU datacenter, a data processing agreement offered via website form and a data protection officer in Utrecht.
- Revenue forecasting with reports and dashboards ships from the Standard tier, and territory management arrives at Enterprise.
Held against it
- Data portability scores sit at 2, with export and deletion as request-based rights and migration support only in the top tier.
- Contact management scores span 2 to 4, and we found no public information on field validation, deduplication or merge tooling.
- The captured pricing pages show no per-seat figures for the paid tiers, so the renewal invoice is not computable.
- The captured pages state both EU datacenter storage and processing in the USA, the EEA and other countries where Zoho operates, and we found no public information on subprocessors.
- Deletion after cancellation runs six months in the active database plus three more in backups.
Best for
- You run a team of up to three users and want a permanently free CRM that already includes leads, deals, workflows and reports.
- You want tiered multi-step automation and are prepared to move up tiers for process automation and journey orchestration.
- You need a selectable EU datacenter, a data processing agreement via website form and EU standard contractual clauses for your GDPR paperwork.
Avoid if
- You need to export or delete your data on demand — the captured rights are request-based and migration support ships only with the top tier.
- You require a short post-cancellation deletion window — the captured terms run six months in the active database plus three more in backups.
- You need processing confined to named regions — the captured terms permit processing in the USA, the EEA and other countries where Zoho operates.
- You must compute your per-seat invoice before committing — the captured pricing pages show no per-seat figures for the paid tiers.
The scores
Contact & data model
Show reasoningHide reasoning
How this is scored
Depth and hygiene of the core records — contacts, companies, deals, custom fields, deduplication.
0 — A flat address book; no relations between people, companies and deals.
3 — The standard three objects exist but customization is cosmetic: few field types, no required fields, duplicates accumulate unchecked.
5 — Custom fields across objects, basic dedupe on create, activity history on the record; complex models still need workarounds.
8 — Rich field types with validation, merge and dedupe tooling, relationships beyond the standard model, permissioned field access.
10 — A genuinely modelable system: custom objects or equivalent, bulk hygiene tooling, field-level history — the data model bends to the business, not the reverse.
The Solo Seller
Leads and deals are the records these pages actually name, plus timestamped audit logs tracking activity inside the app — but I found no public information on custom fields, field validation, dedupe or merge tooling for the core records. For a one-person shop, that hygiene layer is what keeps the database worth anything in year two, and it is exactly what I found no public information on. 2 5
The Data Protection Officer
Leads and deals reach even the free tier, and teamspaces, wizards, custom functions, territory management, time-stamped audit logs and Vaults for private business data give the record layer substance. We found no public information on deduplication, field validation or field-level permissions, so the hygiene of a database full of other people's personal data rests unproven. 1 2 5
The Sales Ops Lead
The free tier names leads and deals, and teamspaces are offered for per-team collaboration, but we found no public information on custom field types, required fields, validation, or deduplication and merge tooling. As the owner of record hygiene for a forty-seat team, that is a data model I cannot audit before purchase. 1 2
The RevOps Integrator
Leads, deals and workflows are named across the tiers, and timestamped audit logs plus teamspaces suggest records carry activity history. But we found no public information on deduplication or merge tooling, field types and validation, or relationships beyond the standard objects — the depth of the data model is the part no captured page shows. 2 1 5
The Migrator
Leads, deals, reports and dashboards are evidenced across tiers, with canvas design, teamspaces, custom functions and timestamped audit logs at the upper end for shaping the tool — but we found no public information on field types, validation, or any dedupe and merge tooling, and dedupe is the difference between a migration and a year of cleanup. 1 2 5
The Skeptic
The captured pages name leads, deals, reports and forecasting and stop there; nothing in them shows companies as objects, custom fields, validation, deduplication or merge tooling. We found no public information on the depth or hygiene of the record model, so the workable-model layer of this criterion stays unverified and I score the two objects the pages actually evidence. 1 2
Pipeline & forecasting
Show reasoningHide reasoning
How this is scored
Whether the pipeline enforces a process and produces reporting a finance department accepts.
0 — A kanban of deals with amounts; nothing is enforced, nothing rolls up.
3 — Multiple pipelines and stage probabilities exist, but no required fields per stage and only canned reports.
5 — Stage requirements, win/loss capture and standard forecast views; custom reporting is limited or an add-on.
8 — Enforceable process (required fields, stage gates, routing), custom report builder, forecast by team and period with quota tracking.
10 — Forecasting a CFO signs: weighted and commit-based views, historical snapshots, attainment tracking, and reporting composable enough to answer questions the vendor never anticipated.
The Solo Seller
Revenue forecasts plus reports and dashboards ship in the Standard package, which is a real forecast view rather than a plain deals board. I found no public information on required fields per stage, stage gates, quota tracking or a custom report builder, so from these pages I cannot tell whether the pipeline enforces any process at all. 2
The Data Protection Officer
Revenue forecasts, reports and dashboards ship in the standard tier and CPQ arrives at Professional, so a reporting layer exists. We found no public information on required fields per stage, stage gates, quota tracking or weighted forecast views — nothing evidences a process the pipeline enforces rather than merely displays. 2 5
The Sales Ops Lead
Revenue forecasting plus reports and dashboards are listed from the standard tier and territory management arrives in enterprise, but we found no public information on required fields per stage, stage gates, quota or attainment tracking, or a custom report builder. I cannot hand finance a forecast whose enforcement layer is unverifiable from public pages. 2
The RevOps Integrator
Revenue forecasting ships in the standard tier with reports and dashboards, and territory management and CPQ stack above it. We found no public information on required fields per stage, stage gates, quota tracking or a custom report builder — I can see forecasts exist, but not whether the roll-up would survive a finance review. 2 5
The Migrator
Revenue forecasting plus reports and dashboards ship in the standard tier and territory management arrives at enterprise, which reads as standard forecast views rather than a bare kanban; we found no public information on required fields per stage, stage gates, quota tracking or weighted and commit-based views. 2
The Skeptic
Reports, dashboards and revenue forecasting are listed from the Standard tier, so canned reporting and a basic forecast view exist in public view. Stage enforcement, required fields per stage, quota tracking and any custom report builder go unmentioned on the captured pages, and I score the tier bullet, not a process. 2
Automation & workflows
Show reasoningHide reasoning
How this is scored
Triggers, sequences and routing that remove manual work without a consultant.
0 — No automation beyond email templates.
3 — Simple if-this-then-that on records; no multi-step sequences, no branching.
5 — Multi-step workflows with delays and branching, email sequences, basic lead routing — capped by tier or count.
8 — Full workflow builder across objects with webhooks as steps, round-robin routing, sequence analytics.
10 — Automation as infrastructure: versioned workflows, error handling, per-step logs, and limits generous enough that the feature is not its own upsell.
The Solo Seller
Workflows and assignment rules start in the free tier and process automation arrives in Professional — genuinely generous routing for one seat. Journey orchestration sits in Enterprise, the hostage-feature pattern I refuse to reward, and I found no public information on branching, delays, webhooks as steps or per-workflow limits. 1 2
The Data Protection Officer
Workflows and assignment rules are present from the free tier, cadences and AI agents sit in standard, and process automation, journey orchestration and custom functions arrive tier by tier, so multi-step sequences and routing are evidenced. The automation story is structured as a ladder of paid tiers, and we found no public information on webhooks as steps, round-robin routing, error handling or per-step logs. 1 2
The Sales Ops Lead
Workflows and assignment rules are listed from the standard tier, process automation in professional, and journey orchestration and cadences in enterprise, which reads as multi-step automation parcelled out by tier. We found no public information on webhooks as workflow steps, routing analytics, or workflow versioning and per-step error handling. 1 2
The RevOps Integrator
Multi-step machinery is clearly present: workflows and assignment rules at entry level, process automation and email intelligence above, and full journey orchestration with custom functions and AI agents at the top tier. We found no public information on webhooks as workflow steps, routing strategies, error handling or the per-tier limits that gate all of this. 2 1
The Migrator
Workflows and assignment rules start in the standard tier, with process automation gated to professional and journey orchestration to enterprise — automation exists but is plainly capped by tier; we found no public information on branching, delays, webhooks as steps, sequence analytics or workflow count limits. 1 2
The Skeptic
Workflows and assignment rules ship in the cheapest tier, cadences and process automation arrive at Professional, and journey orchestration with custom functions waits behind Enterprise — multi-step automation is real and visibly capped by tier. We found no public information on webhooks, routing options, sequence analytics or the limits that decide whether automation becomes its own upsell. 1 2
Integrations & API
Show reasoningHide reasoning
How this is scored
Two-way email/calendar sync, native connections, and an API that treats external systems as first-class.
0 — No API, no sync; data enters by CSV and leaves never.
3 — One-way email logging (BCC), a handful of Zapier triggers, a read-mostly API.
5 — Two-way email and calendar sync for the major providers, a documented REST API with sane limits, a modest native directory.
8 — Deep native integrations for the revenue stack, webhooks, OAuth apps, API parity with the UI for core objects.
10 — An ecosystem: public API covering everything the UI does, event streams, a marketplace, and sync so reliable the CRM can be the system of record without being the only system.
The Solo Seller
The integration story on these pages is the marketplace claim of seamless connection to over 1,000 applications, plus a Google Ads connection in Professional. I found no public information on two-way email and calendar sync or on a documented API — and inbox sync is the piece a solo pipeline cannot live without. 1 2
The Data Protection Officer
A marketplace of over 1,000 applications, a named Google Ads integration, widgets and the right to share service data through supported third-party integrations evidence a broad native directory. We found no public information on two-way email and calendar sync, API scope, rate limits or webhooks — precisely the seams through which contact data leaves the controller's grip. 1 2 4
The Sales Ops Lead
A claim of more than a thousand integrations is published alongside Google Ads and federated login via LinkedIn, Microsoft and Google, and the privacy policy confirms service data can be shared through supported integrations. But we found no public information on two-way email and calendar sync, on API documentation, or on webhooks, so I cannot confirm external systems are first-class citizens. 1 2 4
The RevOps Integrator
A marketplace of over 1,000 applications, a Google Ads connection and email intelligence suggest a wide integration surface. But we found no public information on two-way email and calendar sync, a documented REST API, or webhooks — and without those, I cannot call a CRM first-class in a revenue stack. 1 2 4
The Migrator
A directory of over a thousand applications, a Google Ads integration and sign-in via Google and Microsoft are real connective tissue, but we found no public information on two-way email and calendar sync or on a documented API and its limits — and when I plan an exit, silence on the API is the fact that decides the score. 1 2 4
The Skeptic
The headline claims integration with over 1,000 applications, Google Ads lands at Professional, and federated login runs through LinkedIn, Microsoft and Google — a big number with no anatomy. We found no public information on two-way email and calendar sync, a documented API or webhooks, which is the part of this criterion that actually moves data. 1 2 4
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where other people's personal data actually lives and under whose law — entity, hosting, subprocessors, DPA.
0 — US entity, US-default hosting, no public DPA or subprocessor list.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad and undocumented.
5 — EU hosting selectable at signup, published DPA and subprocessor list; core processing still touches US entities.
8 — EU entity or EU-default hosting with published subprocessors, consent-friendly fields, retention and deletion controls; residual US exposure named and narrow.
10 — European entity, EU-only processing including subprocessors, deletion that provably deletes — sovereignty a DPO can sign off without a caveat file.
The Solo Seller
EU and US datacenters are both offered with no stated default, a DPA is available via a form on the website, and the transfer clause names the USA, the EEA and other countries where Zoho operates, with no published subprocessor list. The German legal notice names an Essen-registered company while every page footer credits the Indian parent; after cancellation, deletion runs six months in the active database and three more months later in backups. 3 4 5
The Data Protection Officer
A German GmbH in Essen, a data protection officer in the Netherlands, selectable EU datacenters, a DPA offered by form and group-company standard contractual clauses form a genuine EU posture, with no third-party trackers and no ad-derived revenue. It stays short of signable: no subprocessor list is published, the captured pages state both that data is stored in an EU datacenter and that personal information is processed in the USA, the EEA and other countries where Zoho operates, every footer names the Indian parent company, and deletion after cancellation takes six months in the active database plus three more in backups — under a policy last updated in March 2022. 1 3 4 5
The Sales Ops Lead
A German GmbH, a named DPO in the Netherlands, an EU datacenter option and a DPA offered via website form are all confirmed. Against that, the terms consent to processing in the USA, the EEA and other countries where the vendor operates, we found no public information on subprocessors, and post-cancellation deletion runs six months in the active database plus three more in backups. 3 4 5
The RevOps Integrator
There is a German-registered entity in Essen, an appointed DPO, EU datacenters selectable alongside US ones, SCC-based group transfers, a DPA and stated deletion timelines. But the footer credits the Indian parent Zoho Corporation, processing is permitted across the USA, the EEA and other countries where Zoho operates, and we found no public information on a subprocessor list — the residual exposure is broad rather than named and narrow. 3 4 5
The Migrator
A German subsidiary in the commercial register, a Dutch data protection officer, standard contractual clauses on a group-company basis and a selectable EU datacenter are genuine substance; but transfers are declared for the USA and any country where Zoho operates, no subprocessor list appears anywhere captured, and deletion after cancellation stretches to roughly nine months across database and backups. 3 4 5
The Skeptic
EU hosting is selectable beside US, a DPA is offered through a website form, a DPO in Utrecht is named and GDPR duties are acknowledged — but the imprint's Essen company sits under the Indian parent credited in every footer, and the privacy policy states transfers to the USA, the EEA and other countries where Zoho operates under intra-group clauses. We found no public information on subprocessors or on which region is the default, and deletion after cancellation runs six months in the active database plus three more in backups. 3 4 5
Import, export & exit
Show reasoningHide reasoning
How this is scored
Getting in with history intact, and out with everything — the anti-lock-in criterion.
0 — Import is a support ticket; export is contacts-only CSV missing notes, activities and files.
3 — Self-serve CSV import with mapping; export covers main objects but drops activity history, attachments or relations.
5 — Guided migration from major competitors, full-object CSV export, API access sufficient to rebuild the database elsewhere with effort.
8 — Complete export (all objects, history, files) self-serve in open formats, import with dedupe and dry-run, no API metering that prices exit out of reach.
10 — Exit as a feature: documented full-fidelity export, migration tooling both directions, and contractual data-return terms — leaving is a weekend, which is exactly why you can stay.
The Solo Seller
The exit story here is a privacy-policy right to request export or deletion of service data, plus migration support listed only as an Ultimate-tier feature. I found no public information on self-serve import with mapping, or on what an export actually covers — notes, activities, attachments — so I have no way to price my own way out before I buy in. 2 4
The Data Protection Officer
Access, export and deletion of service data are stated rights, but they read as request-based rather than self-serve, and migration support appears only as a top-tier Ultimate feature. We found no public information on self-serve import with mapping, export formats, or whether notes, activity history and attachments survive the trip out, while the six-plus-three-month post-cancellation deletion clock sets the floor on how long contacts' data lingers. 2 4
The Sales Ops Lead
The privacy policy grants export and deletion of service data on request, and the top tier bundles migration support as a consulting service. We found no public information on self-serve import, on export formats, or on whether activity history, attachments and relations survive the move — exit looks like a request, not a runbook. 2 4
The RevOps Integrator
The privacy policy grants export and deletion of service data on request, and the top tier names migration support alongside consulting. We found no public information on self-serve import with mapping, export formats, or whether activity history and files leave with you — from what's captured, exit looks like a request to the vendor, not a feature. 4 2
The Migrator
The only export commitment found is a privacy-policy right to request export or deletion, and migration support sits in the top tier bundled with consulting; we found no public information on self-serve import, dedupe on import, export formats, or whether notes, activity history and files come out at all — an exit here starts as a request, not a click. 2 4
The Skeptic
The only exit path in evidence is the privacy policy's right to request export or deletion of service data — a request, not a self-serve tool — and migration support appears only as a consulting line in the topmost tier. We found no public information on self-serve import, export formats, or whether notes, activities and files make it out. 2 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per seat, per month, at renewal — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most buyers need are unpriced, or per-seat maths is obscured by bundles, minimums or mandatory onboarding fees.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability hides in an unpriced tier or usage-metered add-on.
8 — Every tier priced publicly including annual/monthly split; limits, seat minimums and overage rules stated; only genuine enterprise contracts are custom.
10 — Complete price computability: every tier, add-on, usage meter and renewal rule public, with a calculator or table that makes the invoice at 3 and 30 seats a two-minute exercise.
The Solo Seller
The entry point is fully public — free for 3 users permanently, with annual and monthly billing options and VAT stated as added on top of listed prices — but the captured pricing pages show no per-seat figures for Standard, Professional, Enterprise or Ultimate. At three seats my invoice is zero and computable; at seat four, nothing on these pages lets me compute it. 2 5
The Data Protection Officer
The public pricing pages state a permanently free tier for 3 users, annual and monthly billing, EUR and GBP pricing, a 15-day trial without credit card, and that local taxes are added on top of listed prices. The per-seat figures for the paid tiers do not appear in the captured pages, and Ultimate is described only as extended function limits plus consulting, so the real invoice at renewal is not computable from what is public. 2 5
The Sales Ops Lead
Annual and monthly billing options, VAT added on top of stated prices, a permanently free tier for exactly three users and a fifteen-day card-free trial are publicly clear. We found no public information on per-seat figures for the paid tiers or on seat minimums, and the top tier bundles consulting, migration support and custom AI, so the real invoice is not computable from the captured pages. 2 5
The RevOps Integrator
The pricing page publishes a permanent free tier for three users, annual and monthly billing, VAT stated as added on top of listed prices, and full feature lists for all four tiers. But the captured pages give no per-seat price figures for the paid tiers, and we found no public information on seat minimums or the functional limits implied by the top tier's extended limits — so the real invoice isn't computable from what I can see. 2 5
The Migrator
The pricing pages show four tiers with annual and monthly billing, state that local taxes are added on top of listed prices, and offer three users free forever with a fifteen-day trial without a credit card; but no per-seat figures appear in what we captured, and we found no public information on seat minimums, overage rules or renewal terms. 2 5
The Skeptic
Tier names, feature ladders, an annual and monthly billing toggle, a permanently free tier for three users and the note that local taxes are added on top of listed prices are all public. But the captured pricing pages carry no per-seat figures for any paid tier and name extended feature limits at the top tier without itemizing them, so the real invoice at renewal is not computable from what was captured. 2 5
European sovereignty — proven facts
2 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in DE ⚠ unverified | 3/3 pts | 3 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU optional ⚠ unverified | 1/3 pts | 5 Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 11 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Every page footer credits '© 2026, Zoho Corporation Pvt. Ltd.', the Indian parent company, so the Essen-registered GmbH appears to be a German subsidiary of it.
- Weak sourcing — Data residency. The page does not state which region is the default; US data centers are offered equally, and the EU option is presented only as marketing copy without default details.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 35 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 19 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (5)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor product page www.zoho.com Checked 17 Sep 2026 +1 earlier capture: 11 Sep 2026 Details →
- 2 Vendor pricing page www.zoho.com Checked 17 Sep 2026 +1 earlier capture: 11 Sep 2026 Details →
- 3 Imprint — found from the homepage www.zoho.com Checked 30 Sep 2026 Details →
- 4 Privacy policy — found from the homepage www.zoho.com Checked 30 Sep 2026 Details →
- 5 Security / trust page — found from the homepage www.zoho.com Checked 30 Sep 2026 Details →