{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "zoho-desk", "name": "Zoho Desk", "vendor": "Zoho", "vendorUrl": "https://www.zoho.com/desk/", "kind": "http-api", "category": "support", "summary": "Zoho Desk is a hosted helpdesk from Zoho for tickets, contacts, knowledge base articles and support channels. Agents reach it through the REST API v1 behind OAuth 2.0, described in public OpenAPI 3.1 files.", "url": "https://www.anchorterminal.com/tools/zoho-desk", "markdownUrl": "https://www.anchorterminal.com/tools/zoho-desk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zoho-desk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zoho-desk.json", "repo": "https://github.com/zoho/zohodesk-oas", "license": "Proprietary service under Zoho's Terms of Service. The OpenAPI repository on GitHub has no licence file", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 only. A person registers a client in the Zoho API console (a web application, or a self client for one organisation) and approves scopes such as `Desk.tickets.READ`. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken \u003ctoken\u003e` or `Authorization: Bearer \u003ctoken\u003e`. Each token is bound to one Desk organisation, and each data centre has its own accounts host and API host. Registration is self-serve, with no app review or sales approval found for use inside one's own organisation.", "pricing": "freemium", "pricingNotes": "Free edition for three users with 5,000 API credits a day and no card. Paid editions cost $7 to $40 a user a month billed yearly ($9 to $50 monthly) and have a 15-day trial without a card. API calls draw on a daily credit allowance set by edition and user count. Extra credits start at $4.20 a month per 1,000 daily credits and are ordered by email (https://www.zoho.com/desk/pricing.html, checked 2026-10-08).", "priceSummary": "$7 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API document, the OpenAPI files or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://desk.zoho.com/DeskAPIDocument", "openapi": "https://github.com/zoho/zohodesk-oas/tree/main/v1.0", "capabilities": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "tags": [ "hosted", "closed-source", "oauth", "openapi", "webhooks", "free-tier", "no-card", "java", "status-page", "bug-bounty", "soc2" ], "lastRelease": "2026-09-09", "graded": true, "anchor": { "graded": true, "score": 66.6, "grade": "B", "agentReady": false, "rank": 262, "ranked": true, "rankOf": 842, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 63, "payments": 40, "reliability": 75, "schema": 72, "security": 66, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Graded on the REST API v1, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Desk component (20). The incident history loads by script and we could not read it. The status feed shows the Desk component returning to Operational on 3 September 2026 at the same minute as Zoho CRM, Books, Flow, SalesIQ and Deluge, with no other Desk entry since July, so we read the record as minor incidents only without a duration (20 of 30). Daily credits and concurrency are published with numbers per edition (15). A 429 at the daily limit carries Retry-After, and every response reports credits used and remaining. Concurrency 429s carry no Retry-After, and no idempotency or retry guidance for writes was found (10 of 15). No SLA found, and the Terms of Service disclaim uninterrupted service (0). v1 is the current documented version (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "zoho/zohodesk-oas on GitHub holds OpenAPI 3.1.0 files for 185 resources and 911 operations (25). No llms.txt at zoho.com or desk.zoho.com and no Markdown docs found (0). 910 of 911 operations carry a description that states the purpose, often with a note on limits, and little on when not to use one (14 of 20). Parameters carry enums, patterns and length limits, and replies use a discriminated schema per channel. Custom fields make record bodies open (12 of 15). The API document has a curl sample and response per endpoint and a list of error codes, and 658 operations declare an error response (14 of 15). The version is in the path and a compatibility statement promises forum notice of changes, with no dated changelog found (7 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "Graded on the REST API. Lists default to 10 records with at most 50, `include` adds related resources on request, and `fields` exists on some list calls only (18 of 25). `from` and `limit`, saved views, `sortBy` and module search with field filters. Deep offsets cost up to 100 credits a call and search stops at offset 4,999 (18 of 20). Errors carry `errorCode`, `message`, `errorType` and the field as a JSON Pointer (18 of 20). No idempotency key. Drafts can be saved before sending (6 of 20). One official SDK, for Java, and setup needs an hourly token refresh and the right regional host (7 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "OAuth 2.0 with scopes per module and operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because Zoho's OAuth guide documents the refresh call with the refresh token and client secret in the URL query string as one of three options (20 of 30). READ-only scopes, calls bound by the user's profile permissions, a draft and send-for-review path for replies, and a 60-day recycle bin for deleted tickets. Spam deletion is permanent and no approval step guards bulk updates (15 of 20). Tickets hold customer-written text and no prompt-injection guidance was found (3 of 15). A ticket history endpoint lists actions per ticket and a dashboard shows credit use. A portal-wide audit log for Desk was not established (8 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 naming Zoho Desk and ISO/IEC 27001 (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). Edition prices are public, $7 to $40 a user a month billed yearly, and extra API credits have a published rate from $4.20 a month per 1,000 daily credits (20). The Free edition covers three users with 5,000 API credits a day, and the 15-day trial needs no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "The OpenAPI files were last changed on 9 September 2026, 29 days before this check (30). The repository has dated commits on 2, 8 and 9 September 2026, three in the last 90 days, all within one week (20). The developer forum named as the place for API notices loads by script, so replies and dates were unread, and no dated changelog was found (6 of 15). The only official SDK is for Java, version 1.3.0 for Java 7 and above, with no release date found (5 of 15). No public repository or CI for the SDK (2 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 62, provenance 95", "reason": "Closed service under the Zoho Terms of Service, last updated 2 March 2022. The OpenAPI repository has no licence file (15 of 30). The privacy policy of 22 December 2025 says data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). The API document promises forum notice and a transition period for deprecations without stating a length, and marks deprecated fields without dates (8 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names regions and cities (15 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. Lists default to 10 records with at most 50, `include` adds related resources on request, and `fields` exists on some list calls only (18 of 25). `from` and `limit`, saved views, `sortBy` and module search with field filters. Deep offsets cost up to 100 credits a call and search stops at offset 4,999 (18 of 20). Errors carry `errorCode`, `message`, `errorType` and the field as a JSON Pointer (18 of 20). No idempotency key. Drafts can be saved before sending (6 of 20). One official SDK, for Java, and setup needs an hourly token refresh and the right regional host (7 of 15).", "maintenance": "The OpenAPI files were last changed on 9 September 2026, 29 days before this check (30). The repository has dated commits on 2, 8 and 9 September 2026, three in the last 90 days, all within one week (20). The developer forum named as the place for API notices loads by script, so replies and dates were unread, and no dated changelog was found (6 of 15). The only official SDK is for Java, version 1.3.0 for Java 7 and above, with no release date found (5 of 15). No public repository or CI for the SDK (2 of 10).", "payments": "No x402, MPP or L402 (0). Edition prices are public, $7 to $40 a user a month billed yearly, and extra API credits have a published rate from $4.20 a month per 1,000 daily credits (20). The Free edition covers three users with 5,000 API credits a day, and the 15-day trial needs no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0).", "reliability": "Graded on the REST API v1, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Desk component (20). The incident history loads by script and we could not read it. The status feed shows the Desk component returning to Operational on 3 September 2026 at the same minute as Zoho CRM, Books, Flow, SalesIQ and Deluge, with no other Desk entry since July, so we read the record as minor incidents only without a duration (20 of 30). Daily credits and concurrency are published with numbers per edition (15). A 429 at the daily limit carries Retry-After, and every response reports credits used and remaining. Concurrency 429s carry no Retry-After, and no idempotency or retry guidance for writes was found (10 of 15). No SLA found, and the Terms of Service disclaim uninterrupted service (0). v1 is the current documented version (10).", "schema": "zoho/zohodesk-oas on GitHub holds OpenAPI 3.1.0 files for 185 resources and 911 operations (25). No llms.txt at zoho.com or desk.zoho.com and no Markdown docs found (0). 910 of 911 operations carry a description that states the purpose, often with a note on limits, and little on when not to use one (14 of 20). Parameters carry enums, patterns and length limits, and replies use a discriminated schema per channel. Custom fields make record bodies open (12 of 15). The API document has a curl sample and response per endpoint and a list of error codes, and 658 operations declare an error response (14 of 15). The version is in the path and a compatibility statement promises forum notice of changes, with no dated changelog found (7 of 15).", "security": "OAuth 2.0 with scopes per module and operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because Zoho's OAuth guide documents the refresh call with the refresh token and client secret in the URL query string as one of three options (20 of 30). READ-only scopes, calls bound by the user's profile permissions, a draft and send-for-review path for replies, and a 60-day recycle bin for deleted tickets. Spam deletion is permanent and no approval step guards bulk updates (15 of 20). Tickets hold customer-written text and no prompt-injection guidance was found (3 of 15). A ticket history endpoint lists actions per ticket and a dashboard shows credit use. A portal-wide audit log for Desk was not established (8 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 naming Zoho Desk and ISO/IEC 27001 (20).", "transparency": "Closed service under the Zoho Terms of Service, last updated 2 March 2022. The OpenAPI repository has no licence file (15 of 30). The privacy policy of 22 December 2025 says data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). The API document promises forum notice and a transition period for deprecations without stating a length, and marks deprecated fields without dates (8 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names regions and cities (15 of 20)." }, "sources": [ { "what": "API document", "url": "https://desk.zoho.com/DeskAPIDocument", "seen": "2026-10-08" }, { "what": "OpenAPI repository (clone)", "url": "https://github.com/zoho/zohodesk-oas", "seen": "2026-10-08" }, { "what": "webhook document", "url": "https://desk.zoho.com/support/WebhookDocument.do", "seen": "2026-10-08" }, { "what": "Java SDK", "url": "https://www.zoho.com/desk/developers/javasdk", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.zoho.com/desk/pricing.html", "seen": "2026-10-08" }, { "what": "price values read by the pricing page", "url": "https://www.zohowebstatic.com/sites/zweb/json/pricing/desk-pricing-val.json", "seen": "2026-10-08" }, { "what": "OAuth refresh", "url": "https://www.zoho.com/accounts/protocol/oauth/web-apps/access-token-expiry.html", "seen": "2026-10-08" }, { "what": "OAuth token limits", "url": "https://www.zoho.com/accounts/protocol/oauth/token-limits.html", "seen": "2026-10-08" }, { "what": "status page", "url": "https://us.zohostatus.com/", "seen": "2026-10-08" }, { "what": "status RSS", "url": "https://us.zohostatus.com/rss", "seen": "2026-10-08" }, { "what": "status incident history (script-drawn, unread)", "url": "https://us.zohostatus.com/incident_history", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://www.zoho.com/terms.html", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.zoho.com/privacy.html", "seen": "2026-10-08" }, { "what": "GDPR and DPA", "url": "https://www.zoho.com/gdpr.html", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.zoho.com/privacy/sub-processors.html", "seen": "2026-10-08" }, { "what": "data centres", "url": "https://www.zoho.com/know-your-datacenter.html", "seen": "2026-10-08" }, { "what": "compliance", "url": "https://www.zoho.com/compliance.html", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.zoho.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Zoho MCP", "url": "https://www.zoho.com/mcp/", "seen": "2026-10-08" }, { "what": "developer forum (script-drawn, unread)", "url": "https://help.zoho.com/portal/community/zoho-desk/zoho-desk-developer-apis", "seen": "2026-10-08" }, { "what": "RDAP for zoho.com", "url": "https://rdap.verisign.com/com/v1/domain/zoho.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the incident history at us.zohostatus.com/incident_history, which loads by script. The duration and cause of the 3 September 2026 event were not read", "unchecked: status pages for data centres other than the US", "unchecked: the Zoho Desk Developer APIs forum, which loads by script, so no dated API notice or staff reply was read", "unchecked: the sub-processor directory at zoho.com/privacy/sub-processors.html, which loads by script", "unchecked: a portal-wide audit log for Zoho Desk. The help centre pages we tried returned articles for other Zoho products", "unchecked: Maven coordinates, release date and download counts for the Java SDK, and GitHub stars for the OpenAPI repository", "unchecked: Zoho Desk release notes at zoho.com/desk/whats-new.html, which load by script", "unchecked: the Zoho contracting entities page, not re-read today", "The pricing page showed prices in rupees to our reader. US dollar prices come from the price file the page loads", "The webhook document lists an Ultimate edition that the pricing page does not sell. Which editions map to it is not established", "Zoho MCP lists Zoho Desk among its apps. Its Desk tools, limits and prices were not found, so the grade covers the REST API only", "Whether failed calls and 429 responses use credits is not stated in the reviewed pages", "The Terms of Service bar use of the services for competitive or benchmarking purposes, which matters before our probes run", "The lead was right on the vendor, URL, docs link and interface" ] }, "negative": 0, "verdict": "Public OpenAPI 3.1 files cover 911 operations, OAuth scopes separate read, create, update and delete per module, and replies can be saved as drafts or sent for review before a customer sees them. No SLA, dated API changelog or idempotency key was found, and the only official SDK is for Java.", "bestFor": "Teams already on Zoho who want an agent to read tickets, draft replies for review, add private comments and change status with narrow scopes, and small teams that want a free edition with API access.", "strengths": [ "OpenAPI 3.1 files for 185 resources and 911 operations are public on GitHub, last changed on 9 September 2026", "OAuth scopes split tickets, contacts, tasks, articles and events into READ, CREATE, UPDATE and DELETE", "`draftReply`, `sendDraft` and `sendForReview` let an agent stage a reply for a person before it is sent", "A 429 at the daily credit limit carries Retry-After, and every response reports credits used and remaining", "Free edition for three users with 5,000 API credits a day, and a 15-day trial of paid editions without a card" ], "weaknesses": [ "No SLA found, and the Terms of Service disclaim uninterrupted service", "No dated API changelog. Changes are announced in a community forum that loads by script", "No idempotency key on writes, and Retry-After is absent on concurrency 429s", "The only official SDK is for Java, version 1.3.0, with no release date or source repository found", "Webhooks need Professional or higher. Free and Standard have none", "Zoho's OAuth guide documents a refresh call with the client secret in the URL query string" ], "agentNotes": [ "Use the `api_domain` returned with the token. Each data centre has its own host, such as desk.zoho.com, desk.zoho.eu and desk.zoho.in", "Send `Authorization: Zoho-oauthtoken \u003ctoken\u003e` and refresh hourly. Put refresh parameters in the POST body, not the URL", "Create replies with `POST /api/v1/tickets/{id}/draftReply`, then `sendDraft` or `sendForReview`. `sendReply` emails the customer", "Add internal notes with `POST /api/v1/tickets/{id}/comments` and `isPublic` false", "Page with `from` and `limit` (50 at most). Deep offsets cost more credits, from 3 a call under 2,000 records to 100 above 100,000" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 63, "payments": 40, "reliability": 75, "schema": 72, "security": 66, "transparency": 62 }, "provenanceScore": 95 }, "connect": { "http": "curl -X GET \"https://desk.zoho.com/api/v1/tickets?limit=5\" \\\n -H \"orgId: $ZOHO_DESK_ORG_ID\" \\\n -H \"Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN\"" }, "letme": { "capability": "https://letme.dev/support.tickets", "tool": "https://letme.dev/zoho-desk" }, "sameCompany": [ "zoho-books", "zoho-zeptomail", "zoho-crm", "zoho-recruit", "zoho-people", "zoho-mail" ], "notable": [ "API use is counted in credits per calendar day in the data centre's time zone. Free and trial 5,000, Express 25,000 plus 100 a user, Standard 50,000 plus 250, Professional 75,000 plus 500, Enterprise 100,000 plus 1,000 (https://desk.zoho.com/DeskAPIDocument)", "There is no per-minute limit. Concurrent calls per portal are capped at 5 on Free, 10 on Express and Standard, 15 on Professional and 25 on Enterprise (https://desk.zoho.com/DeskAPIDocument)", "zoho/zohodesk-oas holds OpenAPI 3.1.0 files for 185 resources and 911 operations, with six commits between 16 March and 9 September 2026 and no licence file (https://github.com/zoho/zohodesk-oas)", "Extra API credits are bought by email to support or through an account manager, at $4.20 a month per 1,000 daily credits for the first 25,000, falling to $0.75 above 250,000 (https://desk.zoho.com/DeskAPIDocument)", "Webhooks cover tickets, contacts, accounts, agents, tasks, articles and messaging events, signed with a JWT in the `X-ZDesk-JWT` header. Professional enables 5, Enterprise 10 and Ultimate 20 (https://desk.zoho.com/support/WebhookDocument.do)", "The Terms of Service say the customer agrees not to use the services for any form of competitive or benchmarking purposes (https://www.zoho.com/terms.html)", "Zoho MCP, a separate Zoho product, lists Zoho Desk among the apps it connects by OAuth. Its tools, limits and prices were not found on the public page (https://www.zoho.com/mcp/)", "The US status feed shows the Zoho Desk component returning to Operational on 3 September 2026 together with Zoho CRM, Books, Flow, SalesIQ and Deluge (https://us.zohostatus.com/rss)" ], "area": "business", "details": [ { "label": "API", "value": "REST API v1 at https://desk.zoho.com/api/v1 (US). Tickets, threads, comments, contacts, accounts, agents, departments, tasks, articles, community, search, views, webhooks, automation and messaging endpoints. 911 operations in the OpenAPI files" }, { "label": "Credentials", "value": "OAuth 2.0 through Zoho Accounts, with server, client, mobile, device and self client flows. Access tokens last one hour. A refresh token is optional and lasts until revoked. Tokens are bound to one Desk organisation" }, { "label": "Auth scopes", "value": "`Desk.\u003cmodule\u003e.\u003coperation\u003e` with READ, CREATE, UPDATE, DELETE, WRITE and ALL. Modules include tickets, contacts, tasks, basic, search, events, articles, settings and custommodule" }, { "label": "Rate limits", "value": "Credits per day. Free and trial 5,000. Express 25,000 plus 100 a user. Standard 50,000 plus 250. Professional 75,000 plus 500. Enterprise 100,000 plus 1,000. At most 5,000,000 with add-ons. Concurrency 5, 10, 10, 15 and 25" }, { "label": "Credit costs", "value": "A record fetched by ID 1. List and search calls 3 to 100 by offset. Update many 1 per 2 records. Move to trash and restore 6 per record" }, { "label": "Rate limit headers", "value": "`X-Rate-Limit-Request-Weight-v3`, `X-Rate-Limit-Remaining-v3`, and `Retry-After` on a 429 at the daily limit" }, { "label": "Replies and notes", "value": "`sendReply`, `draftReply`, `sendDraft` and `sendForReview` on a ticket for email, Facebook and forum channels. Comments are public or private through `isPublic`" }, { "label": "Pagination", "value": "`from` and `limit`, default 10 and at most 50 a call. Search accepts `from` 0 to 4,999. `include` adds related resources" }, { "label": "Errors", "value": "HTTP status plus `errorCode`, `message` and, for invalid data, `errorType` and `fieldName` as a JSON Pointer" }, { "label": "Webhooks", "value": "Up to 20 configured a portal. Enabled 0 on Free and Standard, 5 on Professional, 10 on Enterprise, 20 on Ultimate. A callback must answer 200 within 5 seconds. JWT in `X-ZDesk-JWT`" }, { "label": "Data centres", "value": "US, EU, India, Australia, Canada, Japan, China, Saudi Arabia, Singapore and UAE, each with its own API host" }, { "label": "SDK", "value": "Java SDK 1.3.0 for Java 7 and above, a JAR download from zoho.com with a Maven guide" }, { "label": "Certifications", "value": "SOC 2 Type 2 naming Zoho Desk, ISO/IEC 27001, 27701, 27017 and 27018 valid to 21 August 2028 (https://www.zoho.com/compliance.html)" } ], "unitPrices": [ { "item": "Express", "unit": "seat-month", "usd": 7, "note": "billed yearly; $9 billed monthly" }, { "item": "Standard", "unit": "seat-month", "usd": 14, "note": "billed yearly; $20 billed monthly" }, { "item": "Professional", "unit": "seat-month", "usd": 23, "note": "billed yearly; $35 billed monthly" }, { "item": "Enterprise", "unit": "seat-month", "usd": 40, "note": "billed yearly; $50 billed monthly" }, { "item": "Add-on API credits, first 25,000 a day", "unit": "credit", "usd": 0.0042, "note": "$4.20 a month per 1,000 daily credits, falling to $0.75 above 250,000; ordered by email to support" } ], "provenance": { "legalEntity": "Zoho Corporation Private Limited", "domain": "zoho.com", "domainRegistered": "2004-01-16", "domainNote": "The US API answers at desk.zoho.com. Other data centres use Zoho domains such as desk.zoho.eu, desk.zoho.in and desk.zohocloud.ca.", "endpointOnVendorDomain": true, "terms": "https://www.zoho.com/terms.html", "privacy": "https://www.zoho.com/privacy.html", "statusPage": "https://status.zoho.com", "changelog": "https://help.zoho.com/portal/community/zoho-desk/zoho-desk-developer-apis", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. They name the applicable Zoho contracting entity by region (https://www.zoho.com/legal/zoho-contracting-entities.html), which we did not re-read today.", "The privacy policy was last updated on 22 December 2025. Its Part II covers service data held in Zoho products.", "security.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028.", "The API document says changes are announced in the Zoho Desk Developer APIs forum. The forum loads by script and no dated entry could be read. No other API changelog was found.", "status.zoho.com redirects to us.zohostatus.com, which lists a Zoho Desk component.", "RDAP for zoho.com gives a registration date of 2004-01-16." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Zoho Corporation Private Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "zoho.com, registered 2004-01-16 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "zoho.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.zoho.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.zoho.com/terms.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-03-02", "words": 4052, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 2nd March 2022.", "says": "Last updated 2022-03-02" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Accordingly, each party agrees to the governing law (without regard to choice or conflicts of law rules) and to the exclusive jurisdiction of the courts mentioned herein in case of any dispute or lawsuit arising out of or in connection with this Agreement ." }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT SHALL ZOHO’S ENTIRE LIABILITY TO YOU IN RESPECT OF ANY SERVICE, WHETHER DIRECT OR INDIRECT, EXCEED ONE THOUSAND DOLLARS ($1000) OR THE FEES PAID BY YOU DURING THE TWELVE (12) MONTHS PRIOR TO THE FIRST EVENT GIVING RISE TO SUCH LIABILITY, WHICHEVER IS HIGHER.", "says": "Capped at the fees paid in the 12 months before the claim or $1000" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you provide any information that is untrue, inaccurate, outdated, or incomplete, or if Zoho has reasonable grounds to suspect that such information is untrue, inaccurate, outdated, or incomplete, Zoho may terminate your user account and refuse current or future use of any or all of the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "If we make significant changes to the Agreement that affect your rights, you will be provided with at least 30 days advance notice of the changes by email to your primary email address.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "In addition to all other terms and conditions of this Agreement, you shall not: (i) transfer the Services or otherwise make it available to any third party;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Services for any form of competitive or benchmarking purposes", "costsPoints": true }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated on: 2nd March 2022." } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal.", "quote": "If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date." }, { "date": "2026-10-08", "text": "Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active.", "quote": "We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days." }, { "date": "2026-10-08", "text": "If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant.", "quote": "If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you." } ] }, { "kind": "privacy", "url": "https://www.zoho.com/privacy.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-12-22", "words": 6377, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 22nd Dec 2025.", "says": "Last updated 2025-12-22" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy tells you what information we collect from you, what we do with it, who can access it, and what you can do about it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "After you terminate your account, your data will be automatically deleted from our active database within 6 months and from our backups within 3 months after that.", "says": "Names a period of 6 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "If you ask about our products through one of our referral programs or reselling partners, or sign in to one of our products through an authentication service provider like LinkedIn or Google, they'll pass on your contact information to us." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We share your information only in the ways that are described in this Privacy Policy, and only with parties who adopt appropriate confidentiality and security measures." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The European Economic Area (EEA) provides certain rights to data subjects (including access, rectification, erasure, restriction of processing, data portability, and the right to object and to complain)." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you wish to update or delete your testimonial, you can contact us at privacy@zohocorp.com", "says": "privacy@zohocorp.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or otherwise providing personal information or service data to us, you understand that the processing, transfer, and storage of your personal information or Service Data within the United States of America, the European Economic Area (EEA) and other countries where Zoho operates.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images.", "quote": "so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition." }, { "date": "2026-10-08", "text": "Zoho says it uses an organisation's data to develop models specific to that organisation.", "quote": "(ii) using your organization's data for developing models specific for your organization." }, { "date": "2026-10-08", "text": "After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later.", "quote": "Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zoho-desk.json", "live": { "slug": "zoho-desk", "vendorStatus": { "page": "https://status.zoho.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:42.65135167Z" }, "updatedAt": "2026-10-09T07:58:42.65135167Z" } } }