What is Zoho’s Shared Responsibility Model?

Zoho’s shared responsibility model sets out which security tasks Zoho handles for Zoho Creator, and which ones are down to you as the account owner. Understanding the split helps UK businesses configure their applications securely and stay compliant with data protection obligations.

What Zoho is responsible for

• Infrastructure and hardware: securing the cloud infrastructure Zoho Creator runs on, including physical security, networking and firewalls.
• Software security: vulnerability management, secure coding practices, and protection against threats such as SQL injection and cross-site scripting.
• Data protection: keeping customer data isolated from other accounts, encrypting data in transit, and maintaining data integrity.
• Availability: maintaining uptime and business continuity through data replication across data centres.
• Backups: system level encrypted backups with integrity checks.

What you are responsible for

• Access control: setting strong passwords, enabling multi-factor authentication, and managing user permissions.
• Application design: defining the security needs of your application and avoiding hard coding sensitive data into it.
• Data accountability: making sure only authorised users can access your data and that it stays accurate.
• Encryption at rest: enabling encryption for sensitive fields within your applications.
• Monitoring: reviewing logs, audit trails and user activity for anything unusual.
• Compliance: carrying out your own data protection assessments and obtaining proper consent for processing personal data.

Shared responsibilities

Some areas rely on both parties working together, including identity management, encryption standards, backups, logging and incident response.