ZOHO CORPORATION LIMITED

Zoho CRM Plus - Unified Customer Experience Platform

Zoho CRM Plus is a unified platform for public-sector engagement and service delivery. Supporting Central Government, Councils, Housing providers, Universities and Grant Management teams by consolidating interactions, casework and workflows into one system including governmental campaigns, citizen engagement, improving insight, consistency and accountability while reducing manual effort and fragmented tools.

Features

• Amalgamates interactions, casework and communications across government public service environments
• Instant dashboard displays for service performance metrics, compliance and decision-making
• Streamlines routine processes, approvals and follow-ups to reduce administrative workload
• Manages email, phone, webchat and webform enquiries within one system
• Strict configurable access governance controls to store and process datasets
• Citizen engagement functionality with full auditability of all service communications
• Structured handling of service requests, issues and multi-stakeholder interactions
• Cohesive cross-platform integrations supporting disconnected teams and fragmented system dataflows
• Mobile-friendly integrations supporting field working and live citizen engagement
• Identifies patterns, anomalies and trends enabling faster evidence-based decisions

Benefits

• Easy workflow automation builder to digitise and automate repetitive tasks
• Real-time custom dashboard views expedite consistent decision-making and resolve enquiries
• Transparent auditable activity logs for accountable public service records retention
• Interdepartmental data sharing improving coordination, reducing duplication and silo working
• Flexible scalability to meet growing or shrinking organisational needs demand
• Actionable visually intuitive insights improving rapid decisions and resource allocation
• 360-degree view of constituent, business and stakeholder engagement interactions services
• Consistent communication templates improving stakeholder experience across all service interactions
• Enables quick onboarding through simple interfaces and standardised guided workflows
• Flexible easily configurable organisation-level role team or individual customisation options

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at zohouk-gcloud@eu.zohocorp.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

355979867943897

Contact

Corie Robinson
+44 2038072092
zohouk-gcloud@eu.zohocorp.com

About your service

• Service categories:

  Applications

  Customer relationship management

  • Marketing campaign management
  • Digital commerce
  • Sales force productivity and management
  • Contact centre
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Only cloud-based deployment and no support for an on-premise setting.
• System requirements:
  • Stable internet connectivity Chrome
  • Chrome - 10 and above
  • Mozilla Firefox - 8 and above
  • IE - 10 and above
  • Safari - 5 and above
  • Opera - 12.1 and above

User support

• Email or online ticketing support: Yes
• Support response times: We offer free technical support eight hours per workday, as well as Premium and Enterprise support tiers that make our experts available 24/5 and 24/7, respectively. The response time for Premium would be 3 hours and as of Enterprise would be 1 hour.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Zoho tests its web chat functionality as part of its broader accessibility assurance programme aligned with WCAG 2.2 AA. Testing includes validation of web chat interfaces with assistive technologies such as screen readers, keyboard-only navigation and screen magnification tools to ensure users can initiate, read and respond to chat interactions without barriers.; ; Testing activities focus on keyboard operability, logical focus order, accessible labelling, readable notifications, colour contrast and compatibility with commonly used assistive technologies. Automated accessibility testing tools are complemented by manual testing carried out by trained internal teams to identify issues that require human assessment.; ; Accessibility testing is incorporated into the development and quality assurance lifecycle for web-based features, including web chat, to ensure updates do not introduce regressions. Issues identified through testing or user feedback are logged, prioritised and remediated as part of ongoing product improvements.; ; While Zoho does not run customer-specific assistive technology trials for each deployment, accessibility validation is consistently applied across the platform to support inclusive use of web chat functionality for all users.
• Onsite support: Yes, at extra cost
• Support levels: All Zoho CRM Plus subscriptions include Classic Support at no additional cost. Classic Support provides access to Zoho’s helpdesk, online documentation, and incident reporting, with issues handled according to defined severity levels.; ; Customers may optionally purchase Premium Support for an additional fee (see Pricing Document). Premium Support provides a dedicated point of contact, prioritised handling of incidents, accelerated escalation, and enhanced onboarding and technical guidance.; ; Incident severity levels and response targets; ; Support requests are categorised and managed as follows:; ; Severity 1 (Critical); Service unavailable or severe business impact; • Initial response: 1 hour; • Problem determination: 4 hours; • Resolution, restoration or workaround: 8 hours; ; Severity 2 (High); Major functionality impaired; • Initial response: 8 hours; • Problem determination: 2 days; • Resolution, restoration or workaround: 4 days; ; Severity 3 (Medium); Partial loss of functionality or degraded performance; • Initial response: 24 hours; • Problem determination: 7 days; • Resolution, restoration or workaround: 14 days; ; Premium Support improves prioritisation and coordination but does not change the availability SLA. Full details are defined in Zoho’s published Service Level Agreement.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: New users can begin using Zoho CRM Plus through the free trial, which provides access to core features and allows organisations to explore the service before deployment. To support onboarding, Zoho provides a wide range of online resources, including detailed user documentation, step-by-step setup guides, knowledge-base articles, onboarding checklists and instructional videos. These materials help users understand key functions, configure initial settings and navigate the interface independently.; ; Zoho also offers live and recorded webinars covering product fundamentals, feature overviews and best-practice guidance for administrators and end users. Within the product, guided setup tools assist administrators in configuring modules, workflows, permissions and integrations during initial implementation.; ; All paid subscriptions include Classic Support, enabling users to contact Zoho’s support team via ticket or email for onboarding questions or early configuration assistance. Customers who choose to purchase Premium Support receive a dedicated point of contact to guide their onboarding activities and support alignment with organisational requirements.; ; These onboarding options allow organisations to adopt Zoho CRM Plus at their own pace while ensuring help is available throughout the setup process.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of a contract, users can extract their data from Zoho CRM Plus using the export tools available within each application. Most applications in the suite provide built-in export options through the user interface, allowing administrators to download data in common formats such as CSV, XLS or JSON. These exports include records, activities, configuration data and other information permitted by the application’s export functions.; ; For organisations that require automated or large-scale extraction, Zoho provides REST APIs to retrieve data programmatically, subject to the user’s permissions and API rate limits.; ; If specific datasets cannot be exported directly from the interface or require additional support, users may contact Zoho Support for guidance. Support can assist with export processes, explain available options and ensure organisations have access to their data before contract closure.; ; Zoho does not restrict users from exporting their data, and organisations retain the ability to extract information prior to terminating the service.
• End-of-contract process: At the end of a paid contract, Zoho CRM Plus accounts that are not renewed automatically revert to the free edition. Users retain access to their data, but certain paid features and administrative capabilities become unavailable. The account remains accessible for data review and export, provided users sign in periodically.; ; If an account remains inactive for more than 120 days after contract expiry, Zoho will schedule the account and its associated data for deletion in line with Zoho’s data retention policy. Once deleted, the data cannot be recovered or exported.; ; Data export during the active subscription and throughout the post-expiry access period is included in the service at no additional cost. Standard support for data extraction using built-in export tools is also included.; ; Additional costs apply only if an organisation chooses optional paid services, such as Premium Support, which can provide guided offboarding assistance or custom export help. No charges are applied for account closure or basic data return.; ; This process ensures organisations have sufficient opportunity to access and extract their data before the service is fully deactivated.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile applications are designed for end users and provide secure access to Zoho CRM Plus data while on the move. Users can view records, update information, manage tasks, log activities and receive notifications. Administrator-level configuration, customisation or system setup cannot be performed through the mobile app and must be completed in the desktop version.; ; The Zoho CRM Plus mobile application is available as a native app for iPhone, iPad and Android devices. Mobile access supports role-based permissions, ensuring users only see information appropriate to their access level.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Zoho CRM Plus provides a unified web interface that brings multiple Zoho applications into a single workspace. Users can access CRM, service management, marketing, analytics and collaboration tools from one tab without switching between separate windows. The interface presents shared navigation, consistent layouts and common data views, enabling users to move between functions efficiently. This centralised design supports end-to-end processes such as managing enquiries, campaigns, cases and reporting within one environment.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Zoho CRM Plus is developed in alignment with WCAG 2.2 AA accessibility guidelines. Zoho performs accessibility reviews using assistive technologies such as screen readers, keyboard-only navigation and screen magnification tools to validate usability of core workflows. Testing includes compatibility checks with commonly used assistive tools and verification that interactive elements, focus order, colour contrast and labelling meet accessibility requirements. Zoho undertakes periodic audits and remediation activities as part of its accessibility compliance programme.
• API: Yes
• What users can and can't do using the API: Zoho CRM Plus provides open REST APIs across the applications in the suite to support integration, data exchange and automation. Users can perform actions such as creating, updating, retrieving and deleting records (subject to their permissions), triggering workflows, and accessing audit information.; ; APIs cannot be used to bypass role-based access controls, modify system-level configurations, change subscription settings, or perform administrative actions reserved for the web interface. API usage is governed by rate limits, authentication requirements and the user’s assigned permissions.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Zoho CRM Plus allows organisations to customise the service to match their operational processes, data structures and service workflows. Customisable elements include modules, fields, page layouts, forms, automation rules, approval processes, journeys, dashboards, reports, email templates, roles, profiles, data-sharing settings, and customer communication channels. Individual applications within the suite can also be tailored to sector-specific requirements such as case management, service requests, marketing activities or enquiry handling.; ; Customisation is performed through the administrative interface using configuration tools, drag-and-drop builders, workflow editors and permission settings. No coding is required for standard customisation, although optional developer tools and REST APIs are available for organisations that want to extend functionality or integrate with external systems.; ; Only authorised administrator-level users can configure system-wide settings, create or modify workflows, change data structures, manage security controls, or adjust organisation-wide preferences. Standard end users can personalise their views, filters, dashboards and notifications within the permissions set by their administrators.; ; This approach allows organisations to adapt Zoho CRM Plus to their processes while maintaining controlled governance over configuration changes.

Scaling

• Independence of resources: Zoho CRM Plus is hosted on a multi-tenant cloud architecture designed to maintain consistent performance regardless of other users’ activity. The service scales horizontally and vertically by allocating additional compute and storage resources as required. Load balancers distribute traffic across multiple servers to prevent bottlenecks. Performance is continuously monitored using real-time metrics, enabling proactive adjustments. Redundant components and failover mechanisms ensure high availability, and systems automatically switch to backup resources if a failure occurs. This approach ensures users experience stable, predictable performance even during periods of increased demand.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users can export their data by accessing the individual applications within Zoho CRM Plus where the data is stored. Most applications provide built-in export options through the user interface, allowing administrators to download records in common formats such as CSV or XLS. Organisations that require automated extraction can use the available REST APIs, subject to permissions and rate limits. If any dataset cannot be exported directly, users may contact Zoho Support for guidance or assistance with completing the export.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: Zoho protects data within its network using layered security controls. Data stored in Zoho data centres is encrypted at rest using strong encryption standards. Internal traffic between services, storage systems and disaster recovery sites is encrypted to prevent unauthorised access. Zoho operates fully controlled data centres with restricted physical access, continuous monitoring and dedicated security systems. Network protections include firewalls, intrusion detection and prevention, and segmentation to isolate sensitive components and limit lateral movement. Access to production systems is restricted to authorised personnel following strict authentication, logging and approval processes.

Availability and resilience

• Guaranteed availability: Zoho guarantees a monthly service availability of 99.9% for Zoho CRM Plus, measured on a calendar-month basis. Availability reflects the percentage of time the production service is operational and accessible, excluding scheduled maintenance windows and circumstances defined in Zoho’s SLA.; ; Current and historical availability information for all Zoho services is published at (https://zohostatus.com), where users can view real-time service status and incident history.; ; If Zoho does not meet the guaranteed availability level in a given month, customers are eligible to request service credits in accordance with Zoho’s Service Level Agreement. Service credits are applied to future billing cycles and are calculated based on the extent to which availability fell below the stated commitment.; ; Service credits must be requested by the customer within the timeframe specified in the SLA. They are the exclusive remedy for failure to meet the availability commitment. Zoho does not provide financial refunds.
• Approach to resilience: Zoho CRM Plus is designed with built-in resilience across its application, network and data layers. Application data is stored on resilient storage systems that are replicated across geographically separate data centres. Data in the primary data centre is replicated to a secondary site in near real time. If the primary site becomes unavailable, services can fail over to the secondary data centre, enabling continuity of operations with minimal disruption.; ; Both data centres use multiple independent ISPs and incorporate redundant networking, compute and storage components to reduce single points of failure. Physical resilience measures include power redundancy, backup generators, temperature and environmental controls, and fire-prevention and suppression systems.; ; Zoho maintains a documented Business Continuity and Disaster Recovery programme that covers critical operations such as infrastructure management and customer support. These plans are tested periodically to validate recovery procedures and service continuity.
• Outage reporting: Zoho communicates outages through several channels. All service components, including Zoho CRM Plus, are monitored and reported on the public status dashboard at: https://zohostatus.com; ; This dashboard provides real-time and historical availability information, incident updates and maintenance notifications.; ; For planned maintenance, customers are notified in advance through in-product banners, email notifications and posts on Zoho’s community channels. Planned work is typically scheduled outside peak business hours to minimise disruption.; ; For unplanned outages, Zoho posts real-time updates on the public status dashboard and provides email notifications to affected customers. Updates may also be shared through support channels and community announcements. The dashboard remains the primary source for ongoing incident details, recovery progress and service restoration confirmation.; ; Zoho does not provide an API for outage notifications; customers rely on the public dashboard and email communication.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Zoho restricts access to management interfaces and support environments through least-privilege and role-based permissions. Only authorised personnel may access production systems, and authentication requires strong passwords, multi-factor authentication and the use of hardened devices on a segregated administrative network. All administrative actions are logged and periodically audited. Support staff do not have direct access to customer data unless explicitly authorised for a specific support request. Any access is logged, monitored and governed by strict internal policies. These controls prevent unauthorised access and ensure management interfaces and support channels remain secure and controlled.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Other standards include ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II, HIPAA-compliant controls for eligible services, and CSA STAR Level 1 certification. These frameworks cover privacy management, cloud security, protection of personal data, independent assurance reporting, and cloud control transparency.
• Information security policies and processes: Zoho maintains a comprehensive information security management programme aligned with ISO/IEC 27001, supported by additional standards including ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701 and SOC 2 Type II. This programme establishes the policies, procedures and technical controls used to protect customer data from unauthorised access, alteration, disclosure or loss.; ; Zoho’s documented policies cover areas such as access control, encryption, asset management, physical security, secure development, incident response, vulnerability management, supplier management and data privacy. Policies extend to employee responsibilities, acceptable use requirements and confidentiality obligations. These documents are communicated to staff during onboarding and reinforced through mandatory periodic training.; ; Information security governance is managed by Zoho’s central Security and Compliance team, which reports into senior leadership. Control owners are designated across engineering, operations, support and facilities teams, with responsibility for implementing and monitoring relevant controls. Zoho conducts internal reviews, technical monitoring, access audits and risk assessments to ensure policies are followed.; ; Policies are formally reviewed at least annually or whenever significant operational or regulatory changes occur. Compliance with Zoho’s information security policies is independently validated through recurring external audits for ISO and SOC certifications.; ; These processes ensure consistent alignment with industry best practices and regulatory expectations.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Zoho follows documented configuration and change management processes aligned with ISO/IEC 27001 and SOC 2 controls. Service components are recorded in configuration repositories where ownership, versions and lifecycle status are tracked. All changes are assessed for security and privacy impact, reviewed by appropriate approvers and implemented with defined rollback procedures. Audit logs are maintained for traceability. High-risk or service-affecting changes receive additional security review. Emergency changes follow an expedited but controlled workflow. Zoho notifies customers of changes that may materially affect their use of the service. These processes ensure controlled, secure and traceable updates to the platform.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Zoho operates a structured vulnerability management process using certified third-party scanners, internal security tools and periodic automated and manual penetration testing. Potential threats are identified through continuous monitoring, vulnerability feeds, public advisories, security mailing lists and industry threat-intelligence sources. When a vulnerability is detected, it is logged, assessed for severity and risk, and assigned to an owner. Critical vulnerabilities are prioritised for immediate remediation, and patches or mitigating controls are deployed as quickly as possible following validation. All remediation activity is tracked to closure, with verification performed by the security team to ensure the issue has been resolved.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Zoho monitors its services using centralised logging, automated alerting and continuous analysis of events across applications, network traffic and system activity. Logs include access, audit, administrator and security events, which are stored securely and monitored for anomalies such as unusual authentication behaviour or unauthorised access attempts. When a potential compromise is identified, alerts are escalated to the Security Incident Response Team for investigation. Incidents are assessed, contained and remediated according to severity, with high-risk events addressed immediately. Zoho follows documented incident response procedures and tracks each incident through to closure, including post-incident review.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Zoho maintains documented incident management procedures for common security, privacy and service events. Incidents are logged, categorised and handled by Zoho’s Security Incident Response Team using predefined investigation, containment and recovery workflows. ; ; Users can report security or privacy incidents directly via email, where they receive high-priority attention. Other service-related issues can be raised through standard support channels. ; ; When an incident affects a customer, Zoho provides notifications and a summary reports outlining the event, impact and corrective actions. Broad service incidents are communicated through service announcements, status pages or community channels. ; ; Post-incident reviews help prevent recurrence.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Zoho CRM Plus provides a 30-day free trial for up to 10 users. It includes full access to all suite applications and core features. Premium Support and long-term data storage are not included. After 30 days, the trial expires unless upgraded, and trial data may be removed per retention policy.
• Link to free trial: https://www.zoho.com/crm/crmplus/pricing.html

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Wednesday 3 September 2025
• What the ISO/IEC 27001 doesn’t cover: ISO/IEC 27001 certifies our Information Security Management System (ISMS) and confirms that we have appropriate governance, controls, and continual improvement processes in place to manage information security risks within the defined scope of certification.; ; The certification does not certify individual products or specific technical features in isolation. Instead, it applies to the management framework, policies, processes, and controls that govern how information security is implemented and operated across our in-scope services.; ; Activities, systems, or services outside the formally defined ISMS scope are not covered by the ISO/IEC 27001 certification. This may include third-party services or infrastructure not operated or controlled by us, or internal systems not directly involved in the delivery of certified services.; ; ISO/IEC 27001 also does not replace or automatically include other standards (such as ISO/IEC 27017 or ISO/IEC 27018 - Which Zoho Corporation has obtained both certifications), which address cloud-specific controls and protection of personally identifiable information and are assessed separately where applicable.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Thursday 23 March 2023
• What the ISO 9001 doesn’t cover: ISO 9001:2015 certifies our Quality Management System (QMS) and confirms that we have defined, implemented, and continually improved processes to ensure consistent service delivery within the certified scope.; ; The certification does not certify individual products, features, or technical performance in isolation. It focuses on the management framework for quality rather than guaranteeing specific service outcomes, configurations, or performance levels for individual services.; ; Activities, systems, or services outside the formally defined QMS scope are not covered by the ISO 9001 certification. This may include third-party services, customer-managed configurations, or internal processes not directly involved in the delivery and support of in-scope services.; ; ISO 9001 also does not address information security, privacy, or data protection controls, which are covered separately under standards such as ISO/IEC 27001 and related certifications.
• Quality management systems (QMS): Yes
• CSA STAR certification: Yes
• CSA STAR accreditation date: Monday 4 August 2025
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: Zoho’s listing in the CSA Security, Trust & Assurance Registry (STAR) is based on a STAR Level 1 Self-Assessment, which documents how our cloud security controls align with the Cloud Security Alliance Cloud Controls Matrix (CCM).; ; The STAR self-assessment applies to the security control framework and governance practices for our cloud services. It does not certify individual products, specific service configurations, or customer-managed settings in isolation.; ; Activities or services outside the scope of the published STAR self-assessment, including customer-controlled configurations, integrations with third-party services, or infrastructure not operated or controlled by Zoho, are not covered.; ; CSA STAR also does not replace other standards covering information security, privacy, or quality management, which are addressed separately through certifications such as ISO/IEC 27001 and related standards.; ; In summary, CSA STAR provides transparency into our cloud security controls within scope, but not independent certification or coverage of out-of-scope services or configurations.
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Df4a2fb2-58c7-428b-b622-0d1dbd68ae22
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 061e91c4-e56a-4f0c-a09c-66fea8d9c587
• Other security certifications: Yes
• Any other security certifications:
  • ISO/IEC 27017 (Cloud Security Controls)
  • ISO/IEC 27018 (Protection of PII in public cloud)
  • ISO/IEC 27701 (Privacy Information Management / PIMS)
  • SOC 2 Type II
  • CSA STAR (Level 1 Self-Assessment)
  • Data Security and Protection Toolkit (DSPT)
  • GDPR

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Creation of outreach activities to create a pipeline of employees for the future contract delivery

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at zohouk-gcloud@eu.zohocorp.com. Tell them what format you need. It will help if you say what assistive technology you use.