Zoho Desk for Financial Services: Controls, Audit Log, Cost

Zoho Desk can carry a bank, lender, broker or insurer's support desk, but the controls an auditor asks about sit mostly on one edition. The audit log, sandbox, data sharing rules and field encryption are Enterprise only, at $40 per agent per month billed annually or $50 billed monthly ^[1]. Professional ($23 per agent per month billed annually, $35 billed monthly) already gives you Blueprint maker-checker flows, approvals and field-level access. Per-agent pricing grows with headcount, and every agent must sit on the same edition; the pricing breakdown has the full rules. One hard limit first. Zoho Desk is not on Zoho's PCI list, so card data does not belong in it.

A regulated support day, from inbox to sign-off

The day starts with channels landing in departments. DSB Bank in Suriname, per Zoho's customer story, routes telephone, email, bank mail and Facebook into Zoho Desk, and a Yeastar PBX integration opens a ticket for every incoming call. Telephony starts on Professional, and so does multi-department work: Professional gives you 10 departments, Enterprise 50. A financial firm in another Zoho use case runs five departments, from investor grievances to settlement, with routing by availability, shift schedules or round robin, which is also a Professional feature.

Next comes the clock. ET Money, an Indian wealth platform, runs a 24-hour first-response SLA with three policies by product and priority, according to its story. Supervisor rules chase silent customers at 24 and 48 hours, then close the ticket. Anything past seven back-and-forth exchanges goes to a supervisor automatically. Strata escalates a ticket left unassigned for two hours and raises it to priority one after eight business hours. SLAs scale by edition: 4 on Standard, 10 per department on Professional, 20 per department on Enterprise.

Managers follow the day from their phones. Radar, Zoho's manager app, is included on every edition, Free too. OATS, an accounting and payroll outsourcer, says its managers use it to see who is online and which tickets cross the SLA. Its story also reports 98 to 100 percent SLA compliance. That figure is the customer's claim, not a benchmark you should plan around. Its SLA policies give regular invoices two working days and urgent cases one.

Maker-checker and approvals with Blueprint

Blueprint is where a regulated desk earns its keep. It turns a ticket's life into fixed stages, and each transition can demand a reply, a comment, an attachment, a resolution or a submission for approval before the ticket moves. Professional allows one active Blueprint per department; Enterprise allows 20, with strict mode and custom functions reserved for Enterprise. Approvals themselves, ticket sharing and collision detection start on Professional. Under that line, you have no enforced sign-off at all.

The customer stories show the pattern clearly. CreditAccess Grameen, an Indian microfinance lender, uses one Blueprint that stops field officers from closing tickets they resolve and sends them to managers for review. A second one blocks reopening without approval. OATS runs an Accounts Payable Blueprint with Maker, Checker and Escalation stages, plus a separate Order to Cash flow. PandaPay, a Montreal payments provider, uses a Client Care Blueprint to verify authorization before anyone gets access to a merchant record.

Two Enterprise tools tighten data entry. Validation rules (up to 50 per department) reject bad field values before a save, and custom modules (10) hold records that are not tickets. Zoho's pet insurance example keeps an Insurance Details module visible only to the support department. Our automation guide covers the rule limits edition by edition.

Who sees what: roles, profiles, sharing and encryption

Access in Zoho Desk is built from four pieces. Profiles set what a person can do; roles set whose records they can see. Data sharing rules decide whether a module is private or public, and field encryption hides values even from people who can open the record. The counts and gates differ sharply by edition: custom profiles run 5, 25 and 50 on Standard, Professional and Enterprise, custom roles 5, 25 and 250.

Data sharing works as Private, Public Read-only or Public Read/Write/Delete per module. Under Private, only the record owner, their superiors and admins see a record. Two details matter for a compliance review. Support admins still see every ticket in their department, whatever the setting. And attachments, comments and time entries follow the record, so anyone who can view a ticket sees them too. Peers in the same role see each other's data only if Share Data with Peers is switched on.

Encryption has trade-offs. Enterprise encrypts up to 10 custom fields per module with AES ^[2]. An encrypted field drops out of reports, automation conditions, advanced filters and sorting, and predictive search needs the whole word. Standard-field encryption covers up to 20 fields in Contacts only, through early access, and Zoho's help says it cannot be reversed yet. Decide which fields to encrypt before you build reports on them.

Audit trail, sandbox and the compliance paperwork

The audit log is the record an examiner wants. It tracks about 38 entities, including roles, workflows, Blueprints, assignment rules and custom functions. Each entry carries the time, the user, the IP address, the department, the action and, for updates, the old and new values ^[3]. You can filter it and export up to 60 days at a time as CSV. Anyone with admin access sees it, including actions in departments they cannot open. Plan your export routine around that window.

Sandbox gives Enterprise accounts up to three test copies, each deployable to production on its own. That is how a change-controlled team edits a Blueprint, an SLA or a sharing rule without touching live tickets. You cannot add agents inside a sandbox or take backups there, so it tests configuration, not staffing. The REST API also has sandbox endpoints to create, rebuild, validate changesets and deploy, which suits teams that want change records outside the admin screens.

On paperwork, Zoho's compliance page lists Zoho Desk in its SOC 2 + HIPAA Type 2 report, audit period 1 December 2023 to 30 September 2024 ^[4]. Zoho-wide certifications include ISO/IEC 27001, 27701, 27017 and 27018. Zoho Desk is not in the SOC 1 report or the PCI list. Verified admins download reports under an online NDA. A GDPR data processing agreement comes on request from legal@zohocorp.com, and Zoho's HIPAA guide says insurers can request a Business Associate Agreement template from the same address.

Where the data lives and what the AI sees

Region is chosen at sign-up. Zoho lists Desk data centers in the US, EU, IN, AU, CN, JP, CA, SA and UAE, and its Terms map the region from the sign-up IP, so set up from the country you mean. Moving later is possible on request. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or 1.3. Full disk encryption is available only in the EU, IN, AU and JP data centers. Saudi hosting appears on the pricing page from Professional.

AI needs the same care. Zia's own generative model runs on Professional and Enterprise, hosted by Zoho in your region, but only in the US, IN, AU, EU, JP and CA data centers. Express and Standard get generative AI only through your own OpenAI key, and then ticket content goes to OpenAI under its terms, although Zoho masks specific fields first. Only one generative AI service can be active per organization. Zoho's privacy policy limits AI use of service data to anonymized samples and models specific to your organization. The pre-built Desk AI agents are Enterprise only, for selected users in the US and IN data centers.

What the controls cost per seat

The control stack decides the edition. Take a 15-agent team billed annually: Enterprise comes to $600 a month and Professional to $345 a month, a gap of $255 a month or $3,060 a year, by our arithmetic. That gap buys the audit log, sandbox, data sharing rules and field encryption. If your examiners need none of those, Professional covers maker-checker and field-level access for less.

Reviewers change the sum slightly. Compliance staff who only read tickets and leave private comments can be light agents, an add-on from Standard at $6 per light agent per month, while Enterprise includes 50. For 15 full agents, the Enterprise premium is $17 per agent per month, so free reviewer seats close the gap only at 43 or more reviewers. Below that, the case for Enterprise rests on the controls, not on seat savings.

Plans renew automatically unless you tell Zoho at least seven days before renewal or downgrade to Free. An annual plan downgraded mid-term earns a credit as a subscription extension, not cash. Full refunds come in the first 30 days of a monthly plan or 45 days of an annual one, or within five business days or 15 days after a forgotten monthly or annual renewal. Read the buyer's checklist before you sign.

The bottom line

Zoho Desk fits a financial services or insurance support team that wants enforced workflows and clear access rules at a per-agent price. Professional is the floor for maker-checker: Blueprint, approvals, field-level access and 10 departments. Enterprise is where the audit log, sandbox, sharing rules and field encryption live, and most regulated teams will end up there. Check your data center before sign-up. Keep card data out entirely, because Zoho Desk is not on Zoho's PCI list.