# Zoho Vault — Password Management

Zoho Vault by Zoho Corporation holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Zoho Corporation (https://www.zoho.com/de/vault/)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/password-management/zoho-vault
- Alternatives: https://whats-best.ai/software/password-management/zoho-vault/alternatives ([markdown](https://whats-best.ai/software/password-management/zoho-vault/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Zoho Corporation
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S1]

## The panel's verdict

Zoho Vault is a cloud password manager from Zoho Corporation; its German pages state that data is stored in a datacenter within the EU. The highest scores on the card sit in identity integration, ranging from 4 to 6: higher scores credit Active Directory and LDAP sync with configurable intervals, SAML single sign-on, Okta, Azure and Google Workspace user sync, and YubiKey hardware-key MFA, while lower scores hold back because not one captured page explains how the vault key is derived or released through single sign-on. Security architecture scores cluster at 3-4, and sharing and access control, audit and policy, and deployment and portability at 4, where we found no public information on an encryption whitepaper, dated audits, admin recovery or a documented export format. Sovereignty scores cluster at 3: the parent sits in Chennai, contracting entity jurisdiction and subprocessor exposure are unknown, and the terms permit datacenter migration. Pricing transparency carries the lowest score on the card, 2-3: the captured pricing page lists what each edition contains yet shows no price figure.

**Speaks for it:**
- Active Directory and LDAP sync with configurable intervals, SAML single sign-on, Okta, Azure and Google Workspace user sync, and YubiKey hardware-key MFA are all stated on the captured pages
- A bug bounty with a public reporting address, plus automated and manual penetration tests, are described on the security pages
- Audit logging of user update and delete actions is offered in every Zoho service, with SIEM integration and folder activity reports on the paid editions
- The free edition includes unlimited passwords, notes and devices, offline access, audit trails and a security dashboard
- The German pages state EU datacenter storage, and free migration and onboarding support is offered

**Held against it:**
- We found no public information on key derivation, on which fields stay unencrypted, or on a named independent audit with its date
- We found no public information on an admin recovery mechanism and its key model, or on what happens to a leaver's shared items
- We found no public information on how the vault key is released under single sign-on or on automatic suspension of a deprovisioned user
- Contracting entity jurisdiction, ownership and subprocessor exposure are unknown on the captured pages, and the terms state Zoho may migrate the datacenter
- The captured pricing page shows no price figure, seat minimum or minimum term, so an annual invoice cannot be computed from public information

**Best for:**
- You run Active Directory or LDAP and want user and password provisioning with configurable sync intervals into a shared vault
- You want a no-cost start where the free edition already includes audit trails, a security dashboard, offline access and unlimited passwords and devices
- You already use Okta, Azure or Google Workspace and want single sign-on plus user sync
- Your team shares credentials through user groups and folders and needs granular sharing with an access-control workflow

**Avoid if:**
- You must compute an annual invoice from public information before purchase — the captured pricing page shows no price figure
- You need your data location fixed — the terms assign the datacenter at signup and state that Zoho may migrate it
- Your procurement must pin down the contracting chain — the parent is Zoho Corporation in Chennai, and contracting entity jurisdiction, ownership and subprocessor exposure are unknown on the captured pages
- Your audit requires logged evidence of who viewed or copied a shared credential — the documented logging covers user update and delete operations

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| SSO, directory sync & provisioning | 2.5/5 | 2/5 | 3/5 | 2/5 | 3/5 | 2.5/5 |
| Audit logs, policies & reporting | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Hosting choice, offline access & export | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | 1/5 | 1/5 | 1/5 | 1/5 | 1.5/5 | 1/5 |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2/5** | **2/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Aes256 at rest: internal KMS · AES-256 · yes [S6]
- Audits: yes [S1]
- CCPA: yes [S10]
- Certifications: yes [S3]
- Certified senders alliance: Zoho Campaigns · yes · 02-Aug-2018 [S10]
- Csa star self assessment: yes [S10]
- DPA: yes [S3]
- EU transfers: EU Standard Contractual Clauses / intra-group agreement [S3]
- Fhir part11 eudralex: Zoho Sign · yes [S10]
- GDPR: yes [S10]
- GDPR breach notification: 72 [S6]
- GDPR rights: yes [S3]
- Hsts: yes [S6]
- Internal audits: yes [S6]
- ISMS: yes [S6]
- ISMS ISO based: ISMS in place derived from ISO standards [S7]
- ISO certifications: ISO 27001 · ISO 27017 · ISO 27018 [S7]
- No ad monetization: no [S11]
- No third party tracking: yes · yes [S5]
- Opportunistic tls email: yes [S6]
- Pfs hsts: yes [S6]
- Privacy policy: personenbezogene Daten unterliegen der Datenschutzrichtlinie von Zoho [S5]
- Soc1 type2: yes [S10]
- SOC 2 HIPAA type2: yes · 01-Dec-2023 to 30-Sep-2024 [S10]
- Tls in transit: web · API · mobile apps · IMAP/POP/SMTP · 1.2 · 1.3 [S6]
- Tracking first party: uses own first-party tools hosted in own data centres [S11]

**Data**
- Backup schedule: weekly · AES-256 · 3 months · daily [S6]
- Credit card storage: no [S3]
- Deletion options: yes · yes · yes · yes [S3]
- Deletion schedule: 3 · 6 [S6]
- Inactive free accounts: 120 [S6]
- Media disposal: crypto erase + shred · degauss + shred [S6]
- Multi user activity: yes [S5]
- Ownership: yes [S5]
- Service data ownership: customer [S3]
- Service data retention: 3 · 6 [S3]
- Third party trackers: no [S3]

**Hosting**
- EU datacenter: yes [S1]
- Local copy: yes [S5]
- Region assignment: Rechenzentrumsstandort wird durch Region/Land bei Anmeldung bestimmt; Zoho kann migrieren [S5]

**Integrations**
- Browser extensions: Ulaa · Chrome · Firefox · Microsoft Edge · Safari · Brave · Vivaldi [S1]
- Federated auth: LinkedIn · Microsoft · Google [S3]
- Push notification providers: Apple Push Notification Service · Google Cloud Messaging · Windows Push Notification Services [S3]
- Third party apps: yes [S5]

**Legal**
- Amendment notice days: yes · 30 [S5]
- Anti spam ad disclosure: yes [S11]
- Anti spam last updated: 2009-09-04 [S11]
- Anti spam no purchased lists: yes [S11]
- Anti spam permission rule: Covered Services may be used only with express permission from recipients; violations may lead to account termination [S11]
- Anti spam postal address required: yes [S11]
- Anti spam scope: Anti-Spam Policy applies to all Zoho Services used for transmitting bulk or commercial emails (Covered Services) [S11]
- Anti spam unsubscribe: yes · 10 [S11]
- Commercial register: Amtsgericht Essen · HRB 36774 [S4]
- Content responsible: Suvish Viswanathan [S4]
- Contracting entity: Zoho Corporation Private Limited [S5]
- Copyright: Zoho Corporation Pvt. Ltd. [S8]
- Copyright holder: 2026 · Zoho Corporation Pvt. Ltd. [S4]
- Governing law: geltendes Recht und Gerichtsstand nach Rechnungsanschrift des zahlenden Kunden, sonst Bundesstaat/Land [S5]
- Last updated: 2022-03-02 [S3]
- Provider: Essen · Zoho Corporation GmbH · II. Hagen 7 · Deutschland · 45127 [S4]
- Refund on zoho breach: yes [S5]
- Updated date: 2022-03-02 [S5]
- VAT id: DE340244058 [S4]

**Pricing**
- Annual discount: 10 [S2]
- Auto renewal: yes · 7 [S5]
- Billing creditcard short term: yes [S5]
- Flexible: custom quote via sales [S2]
- Free tier: yes · yes [S1]
- Free tier downgrade: yes [S5]
- Free trial: yes [S5]
- Notice before renewal days: 7 [S5]
- Pay as you go: yes [S2]
- Payment methods: Visa · MasterCard · American Express · PayPal · bank transfer (annual) · check (annual) [S2]
- Price changes: yes [S5]
- Taxes: yes · yes [S5]
- Trial: 15 · no [S2]
- Trial end: free plan, data retained [S2]
- Trial limits: 5 · 15 · Enterprise [S2]
- VAT: yes [S2]
- Volume discounts: yes [S2]

**Product**
- Account administrators: yes [S5]
- Ad sync available: yes [S9]
- Admin dashboard: Central admin dashboard to monitor Zoho One usage, user activities and app usage across the organization [S8]
- AI usage: yes · yes [S3]
- Anti malware: yes [S6]
- App launcher: All business apps (Zoho and Marketplace) accessible via the My Apps launcher across devices [S8]
- Audit logging for customers: yes [S6]
- Audit trails: yes [S1]
- Background checks: yes [S6]
- Beta services: yes · yes [S5]
- Browser extensions: Chrome · Firefox · Edge · Safari · Vivaldi · Brave [S2]
- Bug bounty: security@zohocorp.com · yes · https://bugbounty.zohocorp.com/ [S6]
- Conditional app provisioning: Admins can automate app provisioning based on predefined condition rules (conditional assignment) [S8]
- Data isolation: yes [S6]
- Data ownership: yes [S6]
- Ddos protection: yes [S6]
- Dedicated security teams: yes [S6]
- Demo available: yes [S2]
- Disaster recovery: yes [S6]
- Dmarc: yes [S6]
- Employee access logging: yes [S3]
- Encryption: SSL/TLS · AES-256 [S1]
- Endpoint encryption: yes [S6]
- Enterprise features: AD integration, SSO for cloud apps, access-control workflow, custom notifications, Okta/OneLogin integration, helpdesk integration, SIEM integration, rebranding, unlimited webhooks, Okta user sync [S2]
- Firewall review: yes [S6]
- Free features: unlimited passwords/notes/devices; autofill, passwordless unlock, generator, security dashboard, backup, offline, mobile apps, browser extensions, audit trails, MFA via Zoho OneAuth, Zoho app integration [S2]
- Free migration onboarding: yes [S1]
- Granular sharing: granular password sharing with access-control workflow [S1]
- Iam MFA included: yes [S1]
- Integration unlimited webhooks: yes [S2]
- Integration webhooks: 10 [S2]
- Ldap support: yes [S9]
- Least privilege: yes [S6]
- Marketplace: One Marketplace offers third-party apps and extensions for the Zoho One platform [S8]
- MFA: Touch-ID/Face-ID · push · QR code · TOTP [S6]
- Mobile apps: iOS · Android [S1]
- Network redundancy: yes [S6]
- Network segmentation: yes [S6]
- Newsletter optout: yes · no [S5]
- No ad monetization: Customer data is never monetized for advertisement purposes [S7]
- No data processing under 16: 16 [S3]
- Passwordless: yes [S1]
- Physical security biometrics: yes [S6]
- Plan comparison pdf: edition comparison available as PDF download [S2]
- Privacy own tools: Zoho uses its own tracking tools hosted in its data centres; data is never monetized for advertisement purposes [S10]
- Production access controls: yes [S6]
- Professional features: user groups, folder sharing, Break Glass account, webhooks (10 free), CLI, report scheduler, unauthorized access alerts, geolocation restriction, Azure/Google Workspace user sync, folder activity reports [S2]
- SAML SSO: yes · LDAP · ADFS [S6]
- SAML SSO: SAML · yes [S8]
- Sdlc change management: yes [S6]
- Security overview: Security page covers data, operational and physical security across company, infrastructure, data, identity, operations, incident management, disclosure, vendor management and customer controls [S6]
- Security training: yes [S6]
- Self hosted analytics tools: own data centers · yes [S4]
- Self hosted analytics tools: No third-party visitor tracking software; own tools hosted in own data centres [S7]
- Service description: Cloud-Software und Anwendungen für Unternehmen inkl. Offline- und Mobilanwendungen [S5]
- SSO: yes [S6]
- SSO ldap sync: Zoho One SSO syncs with LDAP servers such as Active Directory [S8]
- Unlimited passwords notes docs: yes [S1]
- User segments: Privat · Teams · Unternehmen · Entwickler [S1]
- Vendor management: yes [S6]
- Vulnerability management: yes [S6]
- Waf: yes [S6]
- Yubikey MFA: YubiKey multifactor authentication supported for Zoho One admins [S8]
- Yubikey support: yes [S6]
- Zd services: user provisioning · user data sync (email address, username) · password sync · scheduled sync with selectable frequency [S9]
- Zdsync scope: email addresses · passwords · yes [S9]
- Zero knowledge: yes [S1]
- Zoho directory purpose: Zoho Directory is a centralized Zoho-designed directory for managing user details [S9]

**Support**
- Basic email only: Basic support is email-only (edition mapping not fully shown in table) [S2]
- Priority channels: Priority support: email, phone, remote [S2]
- Privacy contact: privacy@zohocorp.com [S3]
- Standard plan: Premium technical support included in Standard plan [S2]
- Unauthorized access contact: accounts@zohocorp.com [S5]

## Questions

### Is Zoho Vault European?

No. whats-best.ai classifies Zoho Vault as Rest of world.

### Where does Zoho Vault store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Zoho Vault have a free plan?

Yes. Zoho Vault has a free plan, per [the vendor’s page captured 13 Oct 2026](https://whats-best.ai/evidence/7097).

### What are the best alternatives to Zoho Vault?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Zoho Vault alternatives](https://whats-best.ai/software/password-management/zoho-vault/alternatives).

## What this page leaves out

- 16 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.zoho.com/de/vault/ (checked 2026-10-13)
- [S2] Pricing page: https://www.zoho.com/de/vault/pricing.html (checked 2026-10-13)
- [S3] Privacy policy: https://www.zoho.com/de/privacy.html (checked 2026-10-13)
- [S4] Legal notice: https://www.zoho.com/de/impressum.html (checked 2026-10-13)
- [S5] Terms of service: https://www.zoho.com/de/terms.html (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.zoho.com/security.html (checked 2026-10-13)
- [S7] Encryption model & independent audits — found from sitemap: https://www.zoho.com/security-faq.html (checked 2026-10-13)
- [S8] SSO, directory sync & provisioning — found from sitemap: https://www.zoho.com/one/user-management-provisioning-sso.html (checked 2026-10-13)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://www.zoho.com/mail/help/adminconsole/active-directory-sync.html (checked 2026-10-13)
- [S10] Audit logs, policies & reporting — found from sitemap: https://www.zoho.com/compliance.html (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://www.zoho.com/policy.html (checked 2026-10-13)

---

Cite as: whats-best.ai, "Zoho Vault — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/zoho-vault

Corrections: https://whats-best.ai/correct/675?target=page