Zoho Cliq: no. Arattai: mostly yes, as of November 2026. Zoho Cliq, the team chat app, encrypts messages in transit and at rest, but Zoho generates and holds the keys, so it is not end-to-end encrypted and has no end-to-end option. Arattai, Zoho's consumer messenger, has end-to-end encrypted direct chats automatically since November 2025, added end-to-end encryption for group chats in September 2026, and end-to-end encrypts audio and video calls. Arattai meetings, channels and its Pocket notes feature are not end-to-end encrypted, and cloud backups are only end-to-end encrypted if you switch that on.
| Feature | Zoho Cliq | Arattai |
|---|---|---|
| One-to-one messages | No: encrypted in transit and at rest with Zoho-managed keys | Yes: automatic for direct chats since the 18 November 2025 rollout |
| Group chats | No | Yes: since the September 2026 update; older messages in existing groups are not |
| Channels | No | No: the whitepaper describes channels as cloud-based |
| Files and media in chats | No | Yes: inside end-to-end encrypted chats |
| Voice and video calls | No: Zoho documents no end-to-end option | Yes: all audio and video calls |
| Meetings | No | No: Arattai says meetings are not end-to-end encrypted |
| Backups | Stored on Zoho servers with Zoho-managed keys | Partial: Google Drive or iCloud; encrypted on the device only if you turn on Encrypted Backup |
| Pocket (personal notes) | Not applicable | No |
| Metadata (who, when, IP address) | Visible to Zoho | Visible to Arattai's servers |
Sources: Encryption at Cliq, Zoho Cliq Help; End-to-End Encryption (E2EE) for Direct Chats and Group Chats, Arattai Help; Arattai E2EE whitepaper v1.0.
How Zoho Cliq Is Encrypted
Zoho's help article on Cliq encryption describes two layers. Data is encrypted in transit between your browser or app and Zoho's servers; Zoho supports TLS 1.2 and 1.3. Stored data is encrypted at the application layer with AES-256, covering chat titles, messages, attachments, reminders, mentions, starred messages and call recordings. The data encryption keys are themselves encrypted with key encryption keys, and all of them are "generated and maintained by our in-house Key Management Service." Full-disk encryption is added in Zoho's India, Australia and Japan data centres.
That is solid protection against network snooping and stolen disks, and it is the same model Slack, Microsoft Teams and Google Chat use by default. It is not end-to-end encryption: Zoho's servers can decrypt Cliq content, which is what makes features like data loss prevention, eDiscovery, retention policies and audit logs possible; Zoho's Cliq security page lists all four as admin tools. None of Zoho's Cliq documentation mentions an end-to-end encryption option for messages or calls.
Zoho also offers Bring Your Own Key through Zoho Directory, which replaces Zoho's key encryption key with one from your own key manager. We could not confirm from Zoho's documentation that Cliq supports it. Either way, a customer-held key for data at rest still leaves Zoho's services decrypting content to run the product, so it would not make Cliq end-to-end encrypted.
Arattai's End-to-End Encryption, Step by Step
Arattai's encryption arrived in stages, and older reporting reflects whichever stage it was written in:
- Before November 2025: calls were already end-to-end encrypted, but text chats were not. In October 2025 Arattai's product head told MediaNama that messages were encrypted in transit, decrypted on the server for processing, and re-encrypted for storage.
- 18 November 2025: end-to-end encryption for direct (one-to-one) chats rolled out. Sridhar Vembu asked users to update and said that once both people were on the new version, "you will only be able to use end-to-end encrypted chat with that contact." Old unencrypted chats became read-only, and Zoho described the change as a system-wide mandate rather than an opt-in.
- 25 September 2026: Vembu announced end-to-end encryption for group messages: "Finally, end to end encryption for group messages is here. Please update the Arattai app." He said it took time because the team "had to redo a lot of the app."
Arattai's help centre now says "End-to-end encryption is available for all group chats." In existing groups, messages from the point marked by an in-chat banner onwards are end-to-end encrypted, while earlier messages stay in the same window and keep their older, server-readable protection. We found no primary statement after September 2026 saying group encryption is still in testing.
One caution: some of Arattai's own pages lag behind. As of 4 November 2026, the arattai.in FAQ still has an answer saying end-to-end encryption for one-to-one chats is "in the works and coming soon," the homepage says only that "Direct chats and calls are encrypted end-to-end," and the whitepaper still contains a paragraph calling group chats cloud-based alongside a full section on how group messages are end-to-end encrypted. The help centre article and Vembu's announcement are the most recent statements, so we have gone with them.
What Protocol Arattai Uses
Arattai's whitepaper says its end-to-end encryption is built on the Signal protocol: X3DH to set up sessions using Curve25519 identity, signed and one-time pre-keys, and the Double Ratchet for forward secrecy. Each message or file is encrypted with a fresh random AES-256-GCM key, and that key is encrypted with the Signal session for every device in the chat. Accounts can have up to five devices.
Group chats and broadcast lists use Sender Keys, the scheme WhatsApp also uses for groups. Each sender's device creates a Sender Key, sends it to every member's device over one-to-one Signal sessions, and then encrypts each group message once. Arattai resets a sender's key when a member or device is removed and at least every 12 days by default, and signs every group message so members can check who sent it.
Arattai says the design is "currently undergoing independent review and audit by top external security auditors." No audit report has been published yet.
What Arattai Doesn't End-to-End Encrypt
- Meetings. Arattai's help centre says plainly that "meetings are not end-to-end encrypted," even though one-to-one and group audio and video calls are.
- Channels and Pocket. Channels, which broadcast to large audiences, are described in the whitepaper as cloud-based. Pocket, Arattai's personal notes space, is stored and synced without end-to-end encryption.
- Metadata. Sender and recipient IDs, timestamps, message types, reactions, call and meeting notifications and IP addresses are visible to Arattai's servers. Arattai says this metadata is encrypted at rest on its servers.
- Backups, unless you opt in. Chat backups go to your own Google Drive or iCloud. Arattai offers an Encrypted Backup setting that encrypts the backup on your device with a backup key or recovery code before upload. Without it, your backup's privacy depends on your cloud account. If you lose the key, Arattai says it cannot recover the backup.
- Older chats. Direct chats from before November 2025, and group messages from before encryption was switched on for that group, were not end-to-end encrypted when they were sent.
Arattai and India's SIM-Binding Rule
On 28 November 2025 India's Department of Telecommunications directed messaging apps that identify users by Indian mobile number to work only while the registered SIM is active in the device, and to log web and desktop sessions out periodically. Early reports said every six hours; in April 2026 the government told the Rajya Sabha that no specific period has been stipulated and that logouts are risk-based. Arattai was named in the directive alongside WhatsApp, Telegram, Signal, Snapchat, ShareChat, JioChat and Josh. Inc42 reported in October 2026 that the rule is set to take effect from 1 January 2027 and that Arattai has said it is working to comply. SIM binding is about account identity rather than message content, so it doesn't change Arattai's encryption, but it will change how Arattai's linked web and desktop devices behave. Our post on WhatsApp, encryption and traceability in India covers the wider regulatory picture.
Which Zoho App Fits Which Need
Cliq and Arattai are built for different jobs, and their encryption reflects that. Cliq is a workplace tool where the organisation is expected to own, search, retain and audit conversations, so Zoho keeps the content readable on its servers. Arattai is a personal messenger, and since 2025 Zoho has moved it to the same end-to-end model as WhatsApp and Signal.
For businesses that means Cliq protects you from outsiders on the network and from disk theft, but not from the platform, a compromised admin account or legal requests served on Zoho. Arattai's end-to-end encryption doesn't carry over into Cliq. Compare how other workplace tools handle this in Is Slack end-to-end encrypted? and Is Google Chat end-to-end encrypted?, or see the full list of which messaging apps are end-to-end encrypted.
If you want team chat where messages are end-to-end encrypted by default, Lupyd uses the Signal Protocol for direct messages and MLS for group channels, and encrypts files and backups on your device. Its group calls are not yet end-to-end encrypted. Try Lupyd.
Frequently Asked Questions
Is Zoho Cliq end-to-end encrypted?
No. Zoho Cliq encrypts data in transit and at rest with AES-256, but the keys are generated and maintained by Zoho's own key management service, so Zoho's servers can decrypt Cliq messages, files and call recordings. Zoho documents no end-to-end encryption option for Cliq.
Is Arattai end-to-end encrypted?
Mostly. Direct chats have been end-to-end encrypted automatically since November 2025, group chats since the September 2026 update, and all audio and video calls are end-to-end encrypted. Meetings, channels and Pocket are not, and backups are only end-to-end encrypted if you turn on Encrypted Backup.
Are Arattai group chats end-to-end encrypted?
Yes, on current app versions. Sridhar Vembu announced group end-to-end encryption on 25 September 2026, and Arattai's help centre says it is available for all group chats. In existing groups, only messages after the encryption banner are end-to-end encrypted.
What encryption protocol does Arattai use?
The Signal protocol. Arattai's whitepaper describes X3DH key agreement and the Double Ratchet for direct chats, Sender Keys for groups and broadcasts, and AES-256-GCM for message and file content.
Are Arattai backups end-to-end encrypted?
Only if you enable it. Backups go to Google Drive or iCloud, and the Encrypted Backup setting encrypts them on your device with a backup key or recovery code before upload. Arattai cannot recover an encrypted backup if you lose that key.
Final Takeaway
Zoho runs two very different encryption models. Cliq is encrypted in transit and at rest with keys Zoho controls, which suits organisations that want search, retention and eDiscovery, but it is not end-to-end encrypted. Arattai now end-to-end encrypts direct chats, group chats and calls using the Signal protocol, with gaps in meetings, channels, Pocket and backups you haven't encrypted. Check which app your conversations actually live in before assuming they're private.
Sources & References
- Encryption at Cliq, Zoho Cliq Help
- Safeguard your team communication with Zoho Cliq, Zoho
- Zoho Cliq data privacy, Zoho
- Encryption at Zoho, Zoho
- BYOK overview, Zoho Directory Help
- End-to-End Encryption (E2EE) for Direct Chats and Group Chats, Arattai Help
- About Chat Backup, Arattai Help
- Arattai end-to-end encryption whitepaper v1.0 (PDF), Arattai
- Arattai FAQ, Arattai
- Arattai calls are end-to-end encrypted, chats are not, MediaNama, October 2025
- "Please update Arattai": Sridhar Vembu ahead of encryption rollout, Business Today, 18 November 2025
- Arattai rolls out end-to-end encryption for group chats, Storyboard18, 25 September 2026
- Summary of DoT directives on SIM binding, DSCI, December 2025
- India orders messaging apps to work only with active SIM cards, The Hacker News, December 2025
- WhatsApp, Telegram SIM-binding mandate to take effect from January 1, Inc42, October 2026
Last updated: 4 November 2026.
- ✓ Zoho Cliq encrypts messages, attachments and call recordings in transit and at rest with AES-256, but Zoho's own key management service generates and holds the keys, so Cliq is not end-to-end encrypted and has no end-to-end option.
- ✓ Arattai direct chats have been end-to-end encrypted automatically since the 18 November 2025 rollout; older unencrypted direct chats became read-only.
- ✓ Sridhar Vembu announced end-to-end encryption for Arattai group chats on 25 September 2026; in existing groups only messages after the encryption banner are covered.
- ✓ Arattai uses the Signal protocol (X3DH and the Double Ratchet) for direct chats, Sender Keys for groups and broadcasts, and end-to-end encrypts all audio and video calls, but not meetings, channels or Pocket.
- ✓ Arattai backups go to Google Drive or iCloud and are encrypted on the device only if you turn on Encrypted Backup; Arattai was also named in India's November 2025 SIM-binding directive.
The workspace where nothing leaks
End-to-end encrypted channels and chat for your team, built on the Signal Protocol and MLS. Available on macOS, Windows, Linux and Android.
