HR Management
Zoho People
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 2 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Zoho Corporation · www.zoho.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Zoho People is Zoho Corporation's cloud-based HR system, and the panel's weighted totals run 3.1 to 3.7. Its strongest area is payroll readiness, scored 4-5, resting on named integrations with Zoho Payroll and Zoho Expense plus payroll compliance reporting — though we found no public information on DATEV, a defined export format, or how mid-month joiners and leavers reach the run. Its weakest is time and absence, scored 2-3: a module name with no public detail on entitlement, carry-over, sickness handling or the German working-time recording duty. Elsewhere scores cluster within a single point — core HR records 3-4, recruiting and onboarding 3-4, employee data governance 3-4, sovereignty 3-4 — and no disagreement between judges runs deeper than one point. Recurring cautions: the captured pages give different figures for the contracting entity (a German GmbH in Essen, a Netherlands BV, the Indian parent), processing is described as USA, EEA and other countries where Zoho operates, we found no published subprocessor list, and no prices are shown — only a free trial and a demo request.
Speaks for it
- Payroll readiness scored 4-5 on named integrations with Zoho Payroll and Zoho Expense plus payroll compliance reporting
- Deletion is executed on stated timelines — data leaves the active database at the next six-monthly purge after cancellation and from backups three months later
- A data processing addendum and a GDPR addendum are available on request through a form, with EU standard contractual clauses and a group-company agreement named for transfers
- Onboarding is delivered as customizable workflows with electronic signature on offers, beside a centralized employee database, document management and a compensation module
- GDPR rights are extended regardless of location, and the vendor states data will never be used for advertising
Held against it
- Time and absence scored 2-3 — a named module with no public information on entitlement, carry-over, sickness handling or the German working-time recording duty
- Core HR records scored 3-4 with no public information on an org chart, dated history of contract and salary changes, or field-level permissions
- The captured pages give different figures for the contracting entity — Zoho Corporation GmbH in Essen in the imprint, a Netherlands BV in the privacy terms, the Indian parent in the footer
- We found no public information on a published subprocessor list or a default storage region, while processing is described as USA, EEA and other countries where Zoho operates
- The privacy terms state company data is used to build tailored models per customer, with no public information on a switch-off for works-council review
Best for
- You need a centralized employee database with document management and a compensation module, plus a stated integration into Zoho Payroll for the monthly run
- You already use Zoho's separate recruiting software and want customizable onboarding workflows with electronic signature on offers connecting to it
- You need executed deletion timelines on account closure and a requestable data processing addendum for GDPR paperwork
Avoid if
- You must evidence German working-time recording or detailed absence handling such as entitlement and carry-over, and the captured pages name a module with no further detail
- Your payroll closes through DATEV or a tax adviser, and we found no public information on any German payroll format or defined export
- You must state a default storage region and the subprocessor chain before DPO or works-council approval, while the published terms describe processing in the USA, the EEA and other countries where Zoho operates
The scores
Digital personnel file & data model
Show reasoningHide reasoning
How this is scored
The system of record: employee master data, the digital personnel file, org structure, custom fields, and whether history is kept rather than overwritten.
0 — A contact list with job titles; no document storage, no org structure, no history — changes overwrite what was there.
3 — Employee records with document upload, but a flat structure: no org chart, few or no custom fields, and no dated history of contract or salary changes.
5 — Digital personnel file with structured document types, an org chart, custom fields, and change history on the core employment fields.
8 — Complete record: versioned contract and compensation history with effective dates, document templates with e-signature, org structure supporting multiple entities and cost centres, and granular field-level permissions.
10 — The file is the single source of truth an auditor could work from: full effective-dated history on every field, retention rules per document type, delegated administration per entity, and export that reproduces the record intact.
The People Lead
The product page promises one centralized employee database with document management and a compensation module, which is the shared-drive replacement at its most basic. We found no public information on an org chart, custom fields, or dated history of contract and salary changes — the difference between a database and a personnel file I could defend in an audit, so this stays at the store-and-upload level. 1
The Payroll Officer
The product page confirms a centralized employee database, document management and a compensation module, with e-signature available for offers. We found no public information on org structure, custom fields, or dated change history on contracts and salary — exactly what a backdated correction needs to survive. 1
The Works Council Advocate
A centralised employee database with document management, a compensation module and electronically signed offers is more than a flat record with uploads. But we found no public information on an org chart, custom fields or dated change history on contract and salary — and without history I cannot reconstruct what a manager saw or changed last year, which sets the score. 1
The Data Protection Officer
The product page confirms a single centralized employee database with document management, a compensation module and electronic signature for offer letters, in a solution described as adaptable. We found no public information on an org chart, org structure across entities and cost centres, or dated change history of contract and salary changes — without history this remains a records store rather than a full personnel file. 1
The IT Integrator
The product pages show a centralized employee database with document management, a compensation module and e-signature for commitments, which is a real personnel file carrying documents. We found no public information on an org chart, on dated history of contract or salary changes, or on field-level permissions, so I cannot make this file the identity source of truth I would hang account provisioning on. 1
The Skeptic
The product page confirms a centralized employee database, document management, a compensation line and analytics, and stops there. We found no public information on org structure, custom fields, contract or salary change history, or field-level permissions, so what is evidenced is records with documents rather than a structured personnel file. 1
Payroll handoff
Show reasoningHide reasoning
How this is scored
Whether the month closes cleanly into payroll — DATEV, Lohn und Gehalt, an in-house system or an external tax adviser — and how much of that is automated rather than re-typed.
0 — No payroll path stated at all; whatever leaves the system leaves as a spreadsheet somebody retypes.
3 — Generic CSV export said to be usable for payroll, with no named payroll system, no defined format and no handling of mid-month changes.
5 — A named payroll integration or a documented export format for at least one major system (e.g. DATEV LODAS/Lohn und Gehalt), covering the recurring monthly fields.
8 — Certified or vendor-maintained integration with a named payroll provider, covering variable pay, absences and mid-month joiners and leavers, with a documented pre-payroll check.
10 — Payroll is a first-class part of the product: maintained bidirectional integrations with several named systems, an auditable approval and lock step before transmission, retro-accounting for backdated changes, and the tax adviser given their own access.
The People Lead
The only handoff on show is an integration line naming Zoho Payroll and Zoho Expense; we found no public information on a DATEV or Lohn und Gehalt export, a defined file format, or how mid-month joiners and leavers reach payroll. A named integration beats a generic CSV promise, but I cannot see what actually arrives at my tax adviser, so this sits just below the mid-point. 1
The Payroll Officer
A named integration with Zoho Payroll is advertised alongside payroll compliance reporting, which is more than a bare export. We found no public information on variable pay, mid-month joiners and leavers, retro-accounting, a pre-payroll check, or any DATEV and tax-adviser path, so I cannot verify the month would close clean. 1
The Works Council Advocate
The product page names integrations with Zoho Payroll and Zoho Expense plus a compliance-reporting feature, so a payroll path is at least stated. We found no public information on a DATEV or tax-adviser handoff, on which recurring fields the integration covers, or on mid-month joiners and leavers and any pre-payroll check. 1
The Data Protection Officer
Native integrations with Zoho Payroll and Zoho Expense plus a compliance-and-reporting capability are stated on the product page, which meets the bar of a named payroll integration. We found no public information on DATEV or other named payroll export formats, on variable pay, mid-month joiners and leavers, or on a documented pre-payroll check. 1
The IT Integrator
A native integration with Zoho Payroll plus compliance reporting is a named payroll path, which is more than a generic export. We found no public information on DATEV or any other named payroll system, on a documented format, or on how variable pay, absences and mid-month joiners and leavers reach payroll, so the month closing cleanly is unproven. 1
The Skeptic
The only payroll path shown is a one-line integration with Zoho Payroll, a sibling product, plus a compliance-reporting bullet. We found no public information on DATEV or any German payroll system, a defined export format, or how absences and mid-month joiners and leavers reach the run, so the integration is named but its coverage and maintenance are not evidenced. 1
Absence & working-time
Show reasoningHide reasoning
How this is scored
Vacation, sickness and working-time recording — including whether the product meets the German recording duty (BAG 2022, ArbZG) rather than merely offering a timer.
0 — No absence or time handling; both live in a spreadsheet elsewhere.
3 — Vacation requests with an approval step, but entitlement is manual, carry-over is not handled and there is no working-time recording.
5 — Automatic entitlement and carry-over, sickness recording, an absence calendar, and basic working-time capture with a report per employee.
8 — Configurable per country and contract: pro-rata entitlement, public-holiday calendars per location, break and rest-period rules, overtime accounts, and an export the employer can hand to a labour inspection.
10 — Working-time recording built as a legal obligation rather than a feature: tamper-evident records, documented compliance with the ArbZG recording duty, works-council-configurable monitoring limits, and shift or on-call models handled without add-ons.
The People Lead
Time and attendance appears as a module name on the product page and nothing more. We found no public information on automatic entitlement, carry-over, sickness handling, or working-time recording that would satisfy the German recording duty, so I have no basis to trust either the vacation calculation or the time records — a label is not a capability. 1
The Payroll Officer
The product page names a time and attendance module. We found no public information on entitlement calculation, carry-over, sickness recording, overtime accounts, or any statement on the German working-time recording duty, so there is nothing here I could hand to a labour inspection. 1
The Works Council Advocate
A time and attendance module is named, and nothing beyond that name: we found no public information on entitlement calculation, carry-over, sickness recording or per-employee working-time reports. For a works council the decisive questions — whether the recording duty after the 2022 labour-court ruling and rest-period rules are met, and whether monitoring limits are configurable — are entirely unanswered in the captured pages. 1
The Data Protection Officer
A time and attendance capability is named on the product page and nothing further. We found no public information on entitlement calculation and carry-over, sickness recording, absence calendars, per-country holiday rules, or any statement on the German working-time recording duty. 1
The IT Integrator
The pages name a time and attendance module and stop there. We found no public information on automatic entitlement, carry-over, sickness handling or per-employee working-time capture, and nothing on the German working-time recording duty — a module name on a product page is not an evidenced capability. 1
The Skeptic
Time and attendance appears as a single feature line and nothing else. We found no public information on entitlement calculation, carry-over, sickness handling, overtime and break rules, or any statement on the German working-time recording duty, so a buyer cannot tell a compliance capability from a timer. 1
Recruiting & onboarding
Show reasoningHide reasoning
How this is scored
The join path — vacancy to signed contract to a person who has an account, equipment and a plan on day one.
0 — Neither applicant tracking nor onboarding exists; hiring happens in a shared inbox.
3 — A basic applicant list with statuses, or an onboarding checklist — one of the two, without the handover between them.
5 — Applicant tracking with a careers page, structured stages and rejection handling, plus a checklist-driven onboarding that carries the hired candidate over into an employee record without re-entry.
8 — Multi-posting to named job boards, interview scheduling and scorecards, GDPR-conscious applicant retention and deletion, e-signed contracts, and onboarding that triggers tasks in IT and payroll.
10 — The whole join is one governed flow: approval-gated requisitions with budget, structured and bias-conscious evaluation, automated applicant deletion at the stated deadline, and provisioning driven from the record so day one needs no HR intervention.
The People Lead
Onboarding workflows are named and offers can carry an electronic signature, while recruiting happens in a separate Zoho recruiting product reached through integration rather than in this system. We found no public information on careers pages, structured stages, applicant retention or the candidate-to-employee handover, so this is one half of the join path plus a pointer to the other. 1
The Payroll Officer
Recruiting arrives through an integration with the vendor's separate recruiting software, while the product itself offers custom onboarding workflows and offers with e-signature. We found no public information on the handover from hired candidate to employee record, applicant retention and deletion, or interview scheduling, so day one looks like manual stitching. 1
The Works Council Advocate
Recruiting arrives via an integration with Zoho Recruit, onboarding is described as customisable workflows, and offers are signed electronically. We found no public information on the handover from candidate to employee record, on careers pages and structured stages, or on applicant retention and deletion — the last point would have to be answered in writing before I could approve anything here. 1
The Data Protection Officer
The product offers customizable onboarding workflows and electronic signature on offers, with recruiting reached through an integrated separate recruiting product. We found no public information on structured application stages, rejection handling, or automatic deletion of applicant data at a stated deadline — for applicant data, that silence is the finding. 1
The IT Integrator
Both halves exist: recruiting arrives through an integration with Zoho's recruiting software, and onboarding is a customizable workflow with e-signature for commitments. We found no public information on the candidate hand-over into the employee record without re-entry, and none on onboarding creating accounts or triggering IT tasks — the only identity integration shown is sign-in via LinkedIn, Microsoft and Google, not employee provisioning. 1 2
The Skeptic
Onboarding workflows and electronically signed offers are confirmed, while recruiting arrives only as an integration with the vendor's separate recruiting software. We found no public information on a careers page, application stages, or a carry-over from hired candidate to employee record, so the join path is evidenced only at its two ends. 1
Employee data protection & co-determination
Show reasoningHide reasoning
How this is scored
How the product handles the most sensitive personal data a company holds — retention, deletion, role separation, subject rights — and whether it can pass a works council (BetrVG §87) rather than merely a procurement checklist.
0 — No stated retention or deletion handling, no role model beyond admin-or-not, and no DPA offered on the site.
3 — A DPA exists on request and roles are coarse; retention and deletion are described as something the customer arranges themselves.
5 — A signable DPA is published, roles are configurable per module, applicant and employee retention periods are stated, and deletion can be executed rather than only promised.
8 — Field-level access control with an audit log of who read what, configurable retention per data category with automatic deletion, documented subject-rights support, and monitoring or analytics features that can be switched off for co-determination.
10 — Built for the works council to say yes: published processing documentation and subprocessor list, per-entity data separation, tamper-evident audit trail, evaluation and behavioural-analysis features off by default with their scope documented, and a data-protection impact assessment the customer can build on.
The People Lead
A data processing agreement is available on request via a form, a data protection officer contact and deletion timelines on account closure are stated, and the vendor commits to no advertising use of data — more than a procurement checkbox. But we found no public information on role granularity or field-level permissions, and the privacy policy states company data is used to build tailored models per customer, which my works council would want scoped or switched off before saying yes. 2 3
The Payroll Officer
A DPA is available on request via a form, GDPR and SCC-based intra-group transfers are documented, and account deletion timing is stated as a six-monthly purge with backups cleared three months later. We found no public information on configurable roles, field-level access, an audit log of who read what, or retention per data category, and the privacy policy states company data is used to build tailored models — something a works council will want interrogated. 2
The Works Council Advocate
A data-processing addendum is offered via form, GDPR rights are extended regardless of location, and deletion is actually executed on a stated purge cycle after cancellation — that is more than a promise. But my three questions go unanswered: we found no public information on an audit log of who read which record, on configurable roles or field-level permissions, or on whether the analytics, eNPS surveys, the Zia chatbot and the AI models built from customer data can be switched off — and the mobile apps' access to call history, contacts and location would need its own negotiation. 1 2
The Data Protection Officer
Deletion executes rather than being only promised: after account cancellation, data is removed from the active database at the next six-monthly purge and from backups three months later, and export or deletion can be requested. The processing addendum is available only on request through a form rather than published for signature, and we found no public information on configurable roles, an audit log of who read what, or stated retention periods per data category such as applicant records. 2
The IT Integrator
A DPA is available through a request form, standard contractual clauses are named for transfers, and deletion actually executes at account close — active database purged on a six-month cycle, backups three months later. We found no public information on configurable roles per module, an audit log of who read what, or retention and deletion per data category, and the stated AI data use — anonymized service data plus customer data for tailored models — is exactly what a works council will interrogate. 2
The Skeptic
A GDPR addendum is requestable through a form rather than published signable, subject rights and a DPO contact are documented, and account data is deleted from the active database on a six-monthly cleanup cycle after cancellation. We found no public information on role or field-level permissions, per-category retention, or read-level audit logging, and the AI terms state company data is used to build tailored models with no documented switch-off for co-determination purposes. 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the data lives, who the contracting entity is, who the subprocessors are, and whether the answer is documented rather than assumed. Independently sourced by the sovereignty pipeline; scored here as the buyer would weigh it.
0 — US-headquartered vendor, US contracting entity, hosting region unstated or US, subprocessors not named.
3 — EU hosting is offered as an option but the contracting entity is non-EU, or the subprocessor list is incomplete or absent.
5 — EU hosting stated as standard and an EU contracting entity, but the subprocessor chain includes non-EU providers without an explained safeguard.
8 — EU or DACH hosting with a named data-centre provider, an EU contracting entity, the full subprocessor list published, and any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, contracting entity, hosting and every subprocessor in the EU, certification of the data centres published, and an on-premises or private-cloud option for buyers who need it.
The People Lead
The imprint names a German GmbH in Essen with a commercial register entry while the site footer credits the Indian parent, and the privacy policy describes processing in the USA, the European Economic Area and other countries where Zoho operates. EU data centres appear only within certification scopes, and we found no published subprocessor list — a German entity helps, but I cannot tell my four hundred people where their data sits or who else touches it. 2 3 4
The Payroll Officer
The imprint names Zoho Corporation GmbH in Essen with a commercial register number and German VAT ID, while the site footer credits the Indian parent, so the captured pages give different signals about the contracting entity. Data may be processed in the USA, the EEA and other countries, EU datacenters appear only within certification scopes, and we found no public information on the subprocessor chain. 2 3 4
The Works Council Advocate
The imprint names Zoho Corporation GmbH in Essen with a commercial-register entry, but the captured pages give different company names for the contracting entity — the privacy policy names Zoho Corporation BV in Utrecht and the footer credits the Indian parent. Processing is described as taking place in the USA, the EWR and other countries where Zoho operates, EU data centres appear only inside a certification's scope, and we found no published subprocessor list. 2 3 4
The Data Protection Officer
The privacy policy states processing, transmission and storage in the USA, the EEA and other countries where Zoho operates, with EU data centres named only within a certification's scope, and we found no public information on where customer data sits by default. The imprint, the privacy policy and the footer name different Zoho entities (an Essen GmbH, a Netherlands BV and the Indian parent), transfers rest on standard contractual clauses and an intra-group agreement, and we found no public information on a published subprocessor list. 2 3 4
The IT Integrator
The captured pages give different entities for the provider — a German GmbH in the Essen imprint and the Indian parent in the site footer — and the privacy policy states processing in the USA, the EEA and other countries without naming a default or an EU choice, while the EU datacenters surface only inside a certification's scope for another product. We found no public information on a published subprocessor list. 2 3 4
The Skeptic
The imprint names Zoho Corporation GmbH in Essen with a commercial register number, while the privacy terms name Zoho Corporation BV in the Netherlands and the footer credits the Indian parent, so the captured pages give different figures for the contracting entity. Hosting is described as USA, EEA and other countries where Zoho operates, we found no public information on where customer data is stored by default, and none on the subprocessor chain. 2 3 4
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an HR lead can compute the real annual invoice for their headcount — including the modules they actually need — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price per employee exists, but the modules most buyers need are unpriced, or a minimum headcount, setup fee or mandatory onboarding package is not stated publicly.
5 — Per-employee prices are public for the main tiers with the billing period stated, but at least one commonly needed module (payroll, time, recruiting) hides in an unpriced bundle.
8 — Every tier and module priced publicly with per-employee maths, billing period, minimum term and VAT treatment stated; only genuinely custom enterprise work lacks a number.
10 — Complete price computability: a calculator or table that produces the annual invoice for a given headcount and module selection, including setup, minimums and renewal terms.
The People Lead
The public product page offers a free trial and a demo request, and we found no public prices of any kind — no tiers, no per-employee rates, no billing period. An HR lead cannot begin to estimate the annual invoice for their headcount from this, so this is the bottom of the scale. 1
The Payroll Officer
We found no public information on pricing at all — no per-employee price, tier list, billing period, setup fee or minimum term appears in the captured pages, only a free trial and a demo request. An HR lead cannot compute an annual invoice from this. 1
The Works Council Advocate
We found no public prices at all — no tiers, no per-employee rate, only a free trial and a demo request, so every figure is a sales conversation. An HR lead cannot compute an annual invoice for their headcount from these pages. 1
The Data Protection Officer
The captured pages offer a free-trial sign-up and a demo request; we found no public information on per-employee prices, tiers, billing period, minimum term, setup fees or VAT treatment. An HR lead cannot begin to compute an annual invoice from what is public. 1
The IT Integrator
The captured pages offer a free trial and a demo request and show no prices, tiers, billing periods or per-employee rates, so an HR lead cannot compute any invoice from what is public. I specifically need to see whether single sign-on and API access sit in the base tier or a paid add-on, and the pages give no public information on that. 1
The Skeptic
We found no public prices on the captured pages: no per-employee rate, no tier, no billing period — only a free trial and a demo request. An HR lead cannot compute any annual invoice from what is published. 1
European sovereignty — proven facts
2 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in DE ⚠ unverified | 3/3 pts | 4 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU optional ⚠ unverified | 1/3 pts | 3 Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 30 Aug 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. The imprint names the German subsidiary registered in Essen, while the site footer credits the Indian parent Zoho Corporation Pvt. Ltd., so the contracting entity may differ.
- Weak sourcing — Data residency. The page names EU datacenters only within a certification's applicability scope (and elsewhere refers to data centers in India) without stating where customer data is stored by default or that EU is a selectable option.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (zoho.com/de/people, zoho.com/de/privacy.html, zoho.com/compliance.html, zoho.com/de/impressum.html). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 10 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (4)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Product page www.zoho.com Checked 15 Sep 2026 Details →
- 2 Privacy policy www.zoho.com Checked 15 Sep 2026 +1 earlier capture: 30 Aug 2026 Details →
- 3 Security / trust page www.zoho.com Checked 30 Sep 2026 Details →
- 4 Imprint — found from the homepage www.zoho.com Checked 30 Sep 2026 Details →