.png){kind=logo}
Arattai ensures strong call privacy with end-to-end encryption and fully local data storage within India, protecting user sovereignty.
The biggest security gap is missing text encryption, making chats less private compared to WhatsApp and Signal.
Zoho’s commitment to transparency and privacy positions Arattai as a promising Indian alternative, once full message encryption is rolled out.
Zoho's Arattai messaging app has experienced explosive growth. The platform has surged to the top of India's app store downloads with a remarkable hundred-fold increase in users within days.
As the ‘Made in India’ alternative to WhatsApp gains momentum, users are questioning its safety and encryption. Let’s take a look at Arattai's current privacy and security landscape, along with its strengths and limitations.
Arattai fulfills most criteria to be hailed as India’s answer to global messengers, but falls short on the security front. The platform is trustworthy for its call encryption, local hosting of user data, and ad-free promises. However, those who want total privacy will be troubled by the missing text encryption. This aspect dampens the potential to stand on equal footing with privacy fore-runners.
Encryption for Calls: The calling system at Arattai uses an end-to-end encryption protocol wherein every call session uses unique encryption keys. These encryption keys reside only on user devices. Zoho has zero knowledge about the calls, and there is complete confidentiality for the users during voice and video exchanges.
Data Sovereignty: All Arattai's user data resides within India and is hosted across data centers in Mumbai, Delhi, and Chennai, with another one scheduled in Odisha. Zoho has been clear about how nothing goes into global clouds such as AWS, Azure, or even Google, which would have given them more direct steer on the treatment of user information.
No Ad-Driven Model: Arattai’s architecture does not integrate with ad networks or data monetization frameworks. As stated by CEO Sridhar Vembu, the platform’s core policy prohibits user data sales and third-party advertising partnerships.
Also Read: Sridhar Vembu Reveals Secret to Arattai's Success Amid Competition With WhatsApp
Missing Text Encryption: The primary issue lies in Arattai’s absence of end-to-end encryption for text communications. This means:
Text conversations pass through servers without full encryption
Messages could potentially be accessed by Zoho or intercepted during server breaches
Government data requests could expose chat contents more easily
Hackers targeting Arattai's servers could potentially access message content
That’s a big privacy gap, especially compared to WhatsApp, Signal, and Telegram’s Secret Chats, all of which encrypt messages automatically.
Arattai's privacy approach focuses on minimal data collection with the following practices:
Data Collected:
Profile name and phone number
Country code
Profile picture (optional)
Contacts from address book (optional)
Usage data, including device information and IP addresses
Crash reports and analytics (user-controlled)
Data Rights: Users can delete their accounts permanently, though this process is irreversible. The app provides transparency about data storage locations and collection practices.
Third-Party Sharing: Zoho says it doesn’t share your data with advertisers, but its terms do allow some sharing with third parties to keep the app running smoothly.
The app's explosive growth has created significant technical strain:
Delayed delivery of one-time passwords (OTPs)
Slower contact synchronization
Connection lag during peak usage periods
Authentication difficulties during sign-up
The company acknowledges these issues and is rapidly scaling its infrastructure, but these problems raise questions about data security during periods of system stress.
Zoho has committed to the implementation of full end-to-end encryption for messages as its top priority. Additional planned security features include:
Complete message encryption rollout
Improved multi-device synchronization security
Enhanced file sharing protection
API security for third-party integrations
The organization had initially scheduled a significant feature rollout for November 2025. However, escalating market demand may prompt an accelerated release timeline.
As part of Zoho Corporation, Arattai benefits from the parent company's extensive security infrastructure:
SOC 2 Type II compliance
ISO 27001, 27017, and 27018 certifications
GDPR compliance
Regular third-party security audits and penetration testing
Dedicated incident response team and vulnerability management processes
The app's government endorsement by Indian ministers has raised privacy advocates' concerns. Critics note that:
Government backing could facilitate easier surveillance access
Lack of message encryption makes data requests more effective
India's data localization requirements may increase government oversight capabilities
However, supporters argue this represents legitimate digital sovereignty and reduces foreign surveillance risks.
Also Read: Arattai vs WhatsApp: Key Differences You Should Know
Arattai is focusing on keeping Indian data within the nation while staying ad-free, and encrypting calls. Without text message encryption, that security promise does not feel authentic.
While Arattai offers more safety than non-encrypted apps, it still lags behind the security standards of WhatsApp and Signal. Industry observers recommend waiting for the expected encryption update before depending on the app for confidential communication. It remains best suited for general, non-sensitive messaging.
For now, Arattai is India's most successful attempt at digital messaging sovereignty, albeit with significant security limitations that users must carefully consider.
Is the Arattai app safe to use?
Arattai is generally safe for voice and video calls, which are fully end-to-end encrypted. However, text messages are not yet encrypted, so sensitive conversations may not be fully private.
Where is Arattai data stored?
All user data is stored in Indian data centers located in Mumbai, Delhi, and Chennai, with plans for expansion to Odisha. Nothing is hosted on global clouds like AWS, Azure, or Google Cloud.
Does Arattai show ads or sell user data?
No. Arattai operates on an ad-free model, and Zoho has committed to not selling user data or sharing it with third parties for advertising purposes.
How does Arattai compare to WhatsApp or Signal?
Arattai encrypts calls and stores data locally, but it lacks end-to-end encryption for text messages. WhatsApp and Signal both encrypt texts and calls by default.
Will Arattai implement full message encryption?
Yes. Zoho has made full end-to-end encryption for text messages a top priority and plans to roll it out soon, along with enhanced file sharing and multi-device security.
