# Zoho Cliq — Business Instant Messaging

Zoho Cliq by Zoho Corporation holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Zoho Corporation (https://cliq.zoho.com)
- Category: [Business Instant Messaging](https://whats-best.ai/software/instant-messaging.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/instant-messaging/zoho-cliq
- Alternatives: https://whats-best.ai/software/instant-messaging/zoho-cliq/alternatives ([markdown](https://whats-best.ai/software/instant-messaging/zoho-cliq/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Zoho Corporation
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Zoho Cliq is a cloud business-messaging service from Zoho Corporation. Encryption and access leads the scoring at 5 to 7: transport and at-rest encryption are documented in unusual depth — a DEK/KEK/master key hierarchy, six-month rotation, a restricted and audited in-house key service, and bring-your-own-key through six named key managers. Integrations follow at 5-6: a marketplace gating organization-wide installs to admins, slash commands, per-action bot consent, and a model-agnostic MCP server exposing channels, threads, users and roles to AI clients. Governance and discovery sits at a flat 4 and messaging core at 4-5, held back by chat export documented only as user-data import and export — the detailed EML-in-ZIP pages cover Zoho Mail — and by no public information on message history limits or threading for humans. Sharpest warnings: deployment control at a flat 2, everything captured being a cloud service with no public information on self-hosting, and sovereignty at 1-2, where legal entity, ownership, data residency and subprocessor exposure are each listed unknown. Scoring stayed in narrow bands; plan names appear only through poll limits, with no prices public.

**Speaks for it:**
- Encryption in transit and at rest documented in unusual depth, with a key hierarchy, six-month rotation, self-encrypting drives and bring-your-own-key through six named key managers.
- Marketplace gates organization-wide extension installs to admins while users install for their own teams, with slash commands and per-action bot consent.
- Channels categorized as organization, teams, external and personal carry permission-based controls, and unified search spans messages, users, channels and departments with search tags.
- eDiscovery, retention policies, audit logs and conversation archiving are each named on the security pages.
- A model-agnostic MCP server exposes channels, threads, users, roles and past conversations to AI clients such as Cursor, Windsurf, Claude and VS Code.

**Held against it:**
- Deployment control scores sit at a flat 2: everything captured is a cloud service, with no public information on a self-hosted edition, source availability or federation.
- Legal entity, ownership, data residency and subprocessor exposure are each listed unknown; the only European signals are an EU support address and EU among extension regions.
- The only export documented in detail — EML files in a ZIP, up to one year — belongs to Zoho Mail, with no format or scope documented for chat conversations.
- No public information on end-to-end encryption, device verification, administrator session revocation, or what the vendor itself can read.
- No public information on threading for humans, message edit history, or any documented message history limit.

**Best for:**
- You want cloud chat with unusually deep, published cryptography and the option to bring your own encryption keys.
- Your team builds bots and AI workflows and wants an auditable extension permission model plus a model-agnostic MCP server.
- You keep external collaboration separate from internal conversations, with external data stored in a separate space.

**Avoid if:**
- You must hold your own archive or follow a documented exit path — ask the vendor: the public pages we read do not show it
- You need a named contracting entity, data residency commitments or a published subprocessor list before signing — each attribute is listed unknown.
- Your legal discovery process needs chat conversations in a documented export format — the detailed export documentation captured covers Zoho Mail.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Team Lead | The Security Officer | The Works Council Advocate | The Compliance Counsel | The Platform Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Channels, threads & search | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2/5 |
| Encryption & access control | 3/5 | 2.5/5 | 2.5/5 | 3.5/5 | 3/5 | 2.5/5 |
| Retention, discovery & co-determination | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Deployment & data custody | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Integrations & extensibility | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| European sovereignty | 0.5/5 | 0.5/5 | 0.5/5 | 1/5 | 1/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **1.5/5** | **1.5/5** | **2/5** | **2/5** | **2/5** |

### The judges

- **The Team Lead** (v1.0): Runs a distributed team and needs the tool people actually open. Wants threads that stay readable, search that finds last spring's decision, and channels that can be tidied without losing history. Unmoved by feature lists that do not survive a busy Tuesday.
- **The Security Officer** (v1.0): Assumes the archive will one day be read by someone it was not meant for. Wants end-to-end encryption that ordinary users survive, device verification, sessions an admin can revoke, and a plain statement of what the vendor cannot decrypt.
- **The Works Council Advocate** (v1.0): Knows that a chat log is a record of who spoke to whom at what hour. Wants presence a person controls, no individual activity scoring anywhere, retention that deletes rather than hides, and analytics that can be switched off across the organisation.
- **The Compliance Counsel** (v1.0): Will one day have to produce this archive, edits and deletions included, to a regulator or a court. Wants legal hold, an export a lawyer can work from, retention per channel, and an audit trail that survives the admin who made the change.
- **The Platform Engineer** (v1.0): Would rather run it than rent it, and wants to know whether that is a supported deployment or a hobby build. Cares about open protocols, federation, a plugin system with real permissions, and an upgrade path that does not orphan the customisations.
- **The Skeptic** (v1.0): Reads for the message-history cap, the tier where SSO appears, and what "unlimited" excludes. Has seen "end-to-end encrypted" mean direct messages only, on request, with search disabled — and wants that sentence found rather than assumed.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- 2FA: yes · password policies (complexity, length, period) and two-factor authentication [S3]
- Audit trails: yes · yes · yes [S8]
- CCPA: Zoho's offerings have privacy features that enable it's users to comply with the CCPA · CCPA · yes [S6]
- Csa certified senders: Zoho Campaigns · Certified Senders Alliance (CSA) · yes · 02-Aug-2018 [S6]
- Cyber essentials plus: Zoho UK office and EU Datacenters (EU1 Amsterdam, Netherlands; EU2 Dublin, Ireland) · Cyber Essentials Plus (UK) · yes · 21-09-2027 [S6]
- Emm integration: yes · Enterprise Mobility Management (EMM) integration and app controls [S3]
- Encryption: yes · yes [S3]
- Ens spain: All cloud services of Zoho, Cloud and on-premises solutions of ManageEngine, Qntrl and TrainerCentral. · ENS Spain, intermediate category (medium level) · yes · 15-May-2027 [S6]
- GDPR: Zoho's offerings have privacy features that comply to GDPR · GDPR · yes [S6]
- GDPR page available: yes [S8]
- Gobd: Zoho Books, Zoho Invoice and Zoho Expense · GoBD (Germany) · yes [S6]
- Hds france: Zoho Creator hosted in the EU datacenters · HDS France (HDSv2.0) · yes · 26-Jan-2029 [S6]
- HIPAA support: yes [S4]
- Ip restriction: yes · IP address restriction for access [S3]
- Iso20000 1: Network Operations Center (NOC) and Data Center (DC) Operations of Zoho Corporation. · ISO/IEC 20000-1 · yes · 29-July-2027 · 0116286 [S6]
- Iso22301: Zoho Cloud Services, ManageEngine, Qntrl, Ulaa Browser and TrainerCentral along with Support functions, NOC, Global DC Operations, HR, IT Support, Legal, Physical Security and Admin. · ISO 22301 (BCMS) · yes · 20-Nov-2026 · BCMS 689185 [S6]
- ISO 27001: All cloud services of Zoho, ManageEngine, Qntrl, TrainerCentral, GSP Solution application, MED (MedicalMine), Ulaa Browser, Arattai, and GoFrugal. It also includes the on-premise products of Zoho, ManageEngine and GoFrugal. · ISO/IEC 27001… [S6]
- Iso27017: All Cloud Services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral. · ISO/IEC 27017 · yes · 21-Aug-2028 · CLOUD 714132 [S6]
- Iso27018: All Cloud Services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral. · ISO/IEC 27018 · yes · 21-Aug-2028 · PII 714133 [S6]
- Iso27701: All business units, cloud services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral. · ISO/IEC 27701 · yes · 21-Aug-2028 · PM 732705 [S6]
- Iso9001: All Cloud Services of Zoho, ManageEngine, Qntrl and TrainerCentral. · ISO 9001 · yes · 02-Feb-2029 · FS 724104 [S6]
- Nhs dspt: Zoho Corporation Limited (UK Office) · NHS DSPT (UK) Version 8, status Standards Met · yes · 30-June-2027 [S6]
- Oauth authentication: yes · yes [S8]
- Observability: yes · yes [S8]
- Pci dss: Zoho Books, Zoho Invoice, Zoho Inventory, Zoho Billing, Zoho Expense, Zoho Checkout and Zoho Commerce. · PCI DSS, Self-assessment SAQ-D · yes · 14-Oct-2026 [S6]
- Rbac: yes · role-based access control at channel and integration level [S3]
- SAML SSO: yes · SAML-based SSO [S3]
- Saudi nca: All Cloud Services of Zoho and ManageEngine. · Saudi NCA Class B (CST) certification · yes · 27-Nov-2028 [S6]
- Signal spam: Zoho Corporation · Signal Spam (France) · yes [S6]
- Soc1 audit trail: Data Centers in India; Zoho Books, Invoice, Billing, Inventory, Expense, Commerce, Payroll, Checkout, People · SOC 1 Audit Trail · yes [S6]
- Soc1 type2: SOC 1 (SSAE 18 and ISAE 3402 - Type 2) · yes · Financial-reporting-relevant controls; broad list of Zoho and ManageEngine products [S6]
- SOC 2 HIPAA type2: SOC 2 + HIPAA Type 2 · yes · 01-Dec-2023 to 30-Sep-2024 [S6]
- SOC 2 type2: All cloud services and on-premise products of Zoho, ManageEngine, Qntrl and TrainerCentral. · SOC 2 Type 2 · yes [S6]
- Tx ramp: TX-RAMP (Texas) · yes · 20-June-2027 · ManageEngine ServiceDesk Plus Cloud · ManageEngine Endpoint Central Cloud and ManageEngine Site24x7 [S6]
- Wcag: Zoho CRM, Zoho Forms and Zoho Desk. · WCAG 2.2 AA level · yes · 22-Mar-2029 [S6]

**Data**
- Archiving: yes · conversation archiving [S3]
- Import export: yes · user data import and export [S3]
- No ad monetization: no [S8]
- Privacy no third party tracking: yes · no [S8]

**Hosting**
- Privacy first party tools: no · no [S6]
- Tracking first party: no [S3]

**Integrations**
- Byok ekms: Zoho Directory · AWS KMS · Google KMS · Thales CTM · Fortanix DSM · Azure Key Vault · Futurex DSM [S5]
- Count: yes · 50 [S3]
- Marketplace install permission: admins only · users [S11]
- Poll install scope: entire organization · specific teams [S10]
- Poll marketplace: Zoho Marketplace [S10]
- Scrum bot available regions: US · IN · EU · JP [S11]
- Supported clients: Cursor · Windsurf · Claude · VS Code [S8]

**Legal**
- Entity: Zoho Corporation Pvt. Ltd. [S1]
- Entity: Zoho Corporation Pvt. Ltd. · 2026 [S3]

**Pricing**
- Poll all plans: yes [S10]

**Product**
- Ad free: yes [S4]
- Agent capabilities: exposes Cliq's core capabilities as standardized tools for MCP-compatible AI clients [S8]
- AI channel creation: AI can create channels, route updates, notify teams [S8]
- AI context search: Retrieve messages, files, records, past decisions [S8]
- AI monitoring: AI monitors connected systems and surfaces critical updates in Cliq [S8]
- AI workspace access: channels · threads · users · roles · past conversations [S8]
- Audit logs: yes [S4]
- Backup encryption: yes [S5]
- Board view comments: Work item card supports adding and viewing comments [S11]
- Bot consent flow: Consents popup grants all at once or per-action [S11]
- Bot voice alerts: yes [S4]
- Byok: yes [S5]
- Cache encryption: Redis · yes [S5]
- Channel activity monitoring: yes [S4]
- Channel categories: organization · teams · external · personal [S2]
- Channel chat methods: Channels are accessed via LHS and categorized as organization, teams, external, and personal [S2]
- Channel search syntax: Users can find channels by typing #Channel name in search bar or selecting Channels from search drop-down [S2]
- Channels: yes · channels for single or multiple teams [S3]
- Collaboration controls: yes · permission-based controls on all channel types (add/remove participants, send messages) [S3]
- Custom user fields: yes · custom fields and customizable user profiles [S3]
- Customization options: /clocal domain · branding · notifications · module configurations [S3]
- Default security policies: yes [S4]
- Device sync: yes · seamless sync across all devices [S3]
- Dlp: yes [S4]
- Ediscovery retention: yes · yes [S4]
- Encrypted data CRM: CRM · Custom fields marked as encrypted, all files and all mail content sent and received via CRM [S5]
- Encrypted data dataprep: DataPrep · All imported user data including PII, ePHI, and credentials [S5]
- Encrypted data desk: Desk · Ticket thread content, attachments, custom fields marked as encrypted and tokens [S5]
- Encrypted data finance: Finance · Bank account details, custom fields that are marked as encrypted, employee details which contain sensitive personal information, travel documents, bank statements and attachments [S5]
- Encrypted data mail: Mail · All mail content, attachments and fields that contain personal information [S5]
- Encrypted data services other: Creator · Campaigns · Cliq · People · Connect · Projects · Sprints · Notebook · Sign · Analytics · Recruit · Social · ServiceDeskPlusCloud · SalesIQ · Assist · Survey · Show · Directory · Contracts · Learn · Site24x7 · Forms · OfficeIntegr… [S5]
- Encrypted data workdrive: WorkDrive · All files [S5]
- Encryption: yes · yes [S4]
- Export delivery: export delivered as download link to ZIP file via email notification [S7]
- Export format: emails import/export with each email in EML format packed in a ZIP archive [S7]
- Export scope: export an entire folder or emails of a specific period / last months up to one year [S7]
- Field encryption default org key: yes · per_org [S5]
- Field encryption pii column key: per_column · PII/sensitive data [S5]
- Field encryption standard: AES/CBC/PKCS5Padding · AES 256 [S5]
- File encryption: CTR · GCM · Distributed File System (DFS) · AES 256 [S5]
- Import failure notification: notification with failed emails and error messages on import failure [S7]
- Import folder structure: option to retain folder structure from ZIP file under a chosen folder; or replicate mailbox folder structure with Import directly to your account [S7]
- Import settings path: import/export performed via Settings > Import/Export Emails [S7]
- Import source formats: EML · ZIP of EML [S7]
- Import zip max size: 500 [S7]
- In house kms: yes [S5]
- Ip restriction: yes [S4]
- Key generation: Java Security library / SecureRandom · 256 [S5]
- Key hierarchy: DEK · KEK · master_key · yes [S5]
- Key rotation: yes · 6 [S5]
- Kms access control: yes · yes · yes [S5]
- Logs encryption: HDFS · yes [S5]
- Mcp bridge: MCP is a standardized bridge between AI agents and Cliq [S8]
- Mdm: yes [S4]
- Model agnostic: yes [S8]
- Networks data separation: yes [S4]
- Networks external collaboration: yes [S4]
- Password policies tfa: yes · yes [S4]
- Poll bot actions: Create a Poll · Help [S10]
- Poll CSV export: yes [S10]
- Poll data deletion: yes [S10]
- Poll duration extension: yes [S10]
- Poll editing: question · description · choices [S10]
- Poll extension: Poll extension for Zoho Cliq: create/run polls, manage responses, export participant data, create chats for poll options [S10]
- Poll option chats: allow creating chats for poll options with minimum number of users [S10]
- Poll plan limits: polls/poll votes · 1000 · 10000 [S10]
- Poll regions: US · IN · EU · AU · CN [S10]
- Poll results notification: next day after poll ends at 9 AM [S10]
- Poll slash command: /poll [S10]
- Poll widget sections: Active Polls · Completed Polls · My Participations · Configurations [S10]
- Pst migration: PST migration supported via separate help page [S7]
- Rate limiting: yes [S8]
- Role based access: yes [S4]
- Scrum bot platform: Scrum Bot built on Cliq platform manages work through Sprints and Stand-up meetings [S11]
- Scrum command: /scrum @username lists work items in any chat window [S11]

**Support**
- SLA uptime: 99.9 · yes · yes [S8]
- Team: onboarding to fine-tuning · yes [S3]

14 more facts on the canonical page: https://whats-best.ai/software/instant-messaging/zoho-cliq

## Questions

### Is Zoho Cliq European?

Not determined: the vendor’s pages as captured do not say where Zoho Cliq is based.

### Where does Zoho Cliq store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Zoho Cliq have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Zoho Cliq?

As of 21 Oct 2026, the panel rates [Element (3.5/5)](https://whats-best.ai/software/instant-messaging/element), [Mattermost (3.5/5)](https://whats-best.ai/software/instant-messaging/mattermost) and [Stackfield (3/5)](https://whats-best.ai/software/instant-messaging/stackfield) highest among the other 19 Business Instant Messaging products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Element](https://whats-best.ai/software/instant-messaging/element) (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Zoho Cliq alternatives](https://whats-best.ai/software/instant-messaging/zoho-cliq/alternatives).

## What this page leaves out

- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor page: https://cliq.zoho.com (checked 2026-10-13)
- [S2] Channels, threads & search — found from sitemap: https://www.zoho.com/cliq/help/channels/how-to-chat-in-channel.html (checked 2026-10-13)
- [S3] Channels, threads & search — found from sitemap: https://www.zoho.com/cliq/enterprise-chat-software.html (checked 2026-10-13)
- [S4] Encryption & access control — found from sitemap: https://www.zoho.com/cliq/security.html (checked 2026-10-13)
- [S5] Encryption & access control — found from sitemap: https://www.zoho.com/encryption.html (checked 2026-10-13)
- [S6] Retention, discovery & co-determination — found from sitemap: https://www.zoho.com/compliance.html (checked 2026-10-13)
- [S7] Retention, discovery & co-determination — found from sitemap: https://www.zoho.com/mail/help/import-export-emails.html (checked 2026-10-13)
- [S8] Deployment & data custody — found from sitemap: https://www.zoho.com/cliq/mcp-server.html (checked 2026-10-13)
- [S9] Deployment & data custody — found from sitemap: https://www.zoho.com/cliq/help/zoho-directory/installation.html (checked 2026-10-13)
- [S10] Integrations & extensibility — found from sitemap: https://www.zoho.com/cliq/help/integrations/poll-bot.html (checked 2026-10-13)
- [S11] Integrations & extensibility — found from sitemap: https://www.zoho.com/cliq/help/integrations/scrum-bot.html (checked 2026-10-13)

---

Cite as: whats-best.ai, "Zoho Cliq — Business Instant Messaging", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/instant-messaging/zoho-cliq

Corrections: https://whats-best.ai/correct/685?target=page