Auditors sometimes ask whether penetration testing is done to check that your data is secure. This article explains who is responsible for penetration testing of your Zoho system and where to find Zoho's security information for your audit.

Applies to: Zoho – All clients

Background

Your system runs on Zoho's cloud platform, so penetration testing of the hosting infrastructure is done by Zoho, not by Aurelian.

• Zoho runs regular automated and manual penetration tests.
• Zoho also runs a bug bounty program and has a responsible disclosure policy.
• Customer data is encrypted in transit and at rest.
• Each customer's data is logically separated from other customers' data.

Where to find Zoho's security information

Zoho publishes its security information in the Zoho Security FAQ. You can share this link with your auditor.