Forum
How Secure is Zoho’s Arattai After the New End-to-End Encryption Update?
If you've been tracking the homegrown privacy space, you probably remember when Arattai by Zoho saw a massive spike in downloads last year during the big "Make in India" push. While it had a familiar interface, a few tech reviewers noted at the time that its encryption protocols were still a work in progress.
Well, Zoho just quietly dropped a massive security upgrade that changes the game.
Arattai has officially rolled out full End-to-End Encryption (E2EE) for all direct one-to-one chats and calls!
I’ve been digging through their newly published security white paper, and here is a quick breakdown of how this upgrade shapes the app's privacy model:
🔒 What’s Actually Protected?
According to their official documentation, it isn't just basic text that is locked down. The cryptographic keys are generated and stored strictly on your device, meaning not even Zoho can read or intercept your data. The encryption covers:
-
Standard text messages, replies, forwards, and quoted texts
-
All shared media (photos, videos, audio clips, documents, and file captions)
-
Voice and video calls
-
Live locations and contact cards
💡 The Big Tech Catches to Keep in Mind:
Before you completely switch your family or business teams over, there are a few important implementation quirks to note:
-
Signing Out Deletes Your Messages: Because the secret keys are locked to your hardware, signing out clears all secret keys. Since E2EE cloud backup features are still under active development, logging out means you will completely lose your existing chat histories.
-
Multi-Device Limits: You can stay signed in on up to 5 devices simultaneously (Android, iOS, Web, and Desktop) with the encryption syncing across all of them.
-
Group Chats are Next: E2EE is currently limited to direct 1-to-1 chats. Group chat encryption and "Pocket" personal storage encryption are still being built out.
⚖️ Arattai vs. WhatsApp / Telegram?
The biggest selling point here remains Zoho’s core philosophy: Zero Ads and Zero Tracking. Unlike mainstream apps that monetize interaction data or metadata profiles to feed ad algorithms, Arattai explicitly states that your data isn't their business model. Plus, for those concerned with data sovereignty, all user data is stored strictly on secure servers within India.
You'll know the encryption is active when you see a secure green icon pop up right next to your chat name. Note that you and the person you're messaging must be updated to the latest app versions for E2EE to trigger.
What do you guys think? Does native end-to-end encryption make you want to give Arattai another solid try as a primary messenger, or are you too locked into the WhatsApp/Signal ecosystems to migrate?