The government just spent ₹180 crore to move 16.68 lakh email accounts to Zoho. People are asking why. The real question is: what took so long?
The NIC Era: A System Past Its Expiry Date
The National Informatics Centre has served India’s digital backbone since 1976. For decades, NIC-managed email running on @nic.in and @gov.in domains was the default communication infrastructure for the Central government. It worked. Mostly. And for a long time, “mostly” was considered good enough.
But the cracks had been widening for years. The NIC email interface was not designed for the smartphone era. Logging in, attaching files, and managing folders on a mobile device was cumbersome enough that officials across ministries simply stopped using it for routine communication. The more pressing problem was not inconvenience – it was what officials did instead.
A pattern emerged across government departments: officials were routing official correspondence through personal accounts on Gmail, Yahoo, and ProtonMail. Government policy discussions, inter-ministerial notes, and sensitive departmental communications were passing through servers in California, Ireland, and Switzerland – servers owned by foreign corporations, governed by foreign law, and entirely outside India’s jurisdictional control.
This was not malice. It was friction. The NIC system made modern communication harder than it needed to be, and officials found workarounds. The result was an unofficial shadow infrastructure of foreign-hosted government communication that no one had formally authorised and no one was formally monitoring.
The Security Wake-Up Call NIC Could Not Survive
Beyond usability, the NIC system carried a more dangerous vulnerability: its own domain names were being weaponised against it.
In early 2025, a sophisticated phishing campaign sent malicious emails to hundreds of government officials, from @nic.in and @gov.in addresses. The attack specifically targeted dormant, poorly secured NIC accounts that had been compromised, then used to send emails that appeared to originate from legitimate government addresses. Officials in the Ministry of External Affairs and Ministry of Defence received these emails.
This was not a new problem. A near-identical attack had hit over 450 top government officials in 2008-2009, including accounts linked to the Prime Minister’s Office and the National Security Adviser. The same architecture. The same vulnerability. Nearly two decades apart.
When a system has been exploited in the same way twice, sixteen years apart, and the underlying vulnerability has not been resolved, it is no longer a security incident – it is a structural failure.
What the Government Chose and Why
On 1 April 2026, MoS for Electronics and IT Jitin Prasada informed the Lok Sabha that the Centre had spent ₹180.10 crore migrating 16.68 lakh official email accounts to a cloud-based platform operated by Zoho. The migration was carried out through NIC, which selected Zoho as the Master System Integrator (MSI) – a key detail, because it means NIC continues to own and operate the system. Zoho is the technology backbone; the Indian government retains full ownership.
The vendor selection was not a political decision or a patriotism-driven preference. It followed a Government e-Marketplace (GeM-CPPP) competitive bidding process, including a Proof of Concept conducted with shortlisted vendors tested against actual government user groups. Zoho won on merit and pricing.
Per-account pricing ranges from ₹170 to ₹300 per month depending on mailbox storage (30 GB to 100 GB). Payments are made on a per-migrated-account basis – the government pays only for what is actually deployed.
The Data Sovereignty Question
The most significant clause in the entire deal is not the price. It is where the data lives.
MeitY’s official Parliamentary affidavit states explicitly, “The cloud-based solution, including Primary and Disaster Recovery data centres, are physically located within India, and no data can be shared or replicated outside the country. The Service Provider, M/s Zoho, is a registered Indian entity subject to Indian laws and jurisdiction.”
This matters enormously. Most SaaS providers including Microsoft 365 and Google Workspace host data on infrastructure they do not own, typically on AWS, Azure, or Google Cloud servers that may be physically located outside India. When an Indian government official sends an email on Microsoft 365, that data may pass through Dublin, Singapore, or Oregon before it arrives.
Zoho owns and operates its own data centres in Mumbai and Chennai. No third-party cloud hyperscaler is involved. The physical hardware is in India. The company is registered in India. The legal jurisdiction is Indian. If a dispute arises over data access or privacy, it is resolved under Indian law by Indian courts, not the US CLOUD Act or European GDPR frameworks.
For a government handling defence procurement correspondence, foreign policy communications, and inter-ministerial policy documents, the question of which country’s law governs data access is fundamental.
The Competitive Economics
The pricing arithmetic is worth examining carefully.
₹180 crore for 16.68 lakh accounts works out to approximately ₹1,080 per account for the current project duration. A comparable Microsoft 365 Government Cloud deployment, with equivalent storage, security, and compliance features, would have cost between ₹5,400 and ₹10,800 per account over the same period, based on Microsoft’s prevailing Government plan pricing in India.
Let me decode 3 things here:
1. Common people think the NIC was good enough, then why this? The truth is that the legacy NIC system was suffering from technical debt so massive it became a national security risk. Before this migration, 1000s of govt officials were secretly using… pic.twitter.com/dASst2hh7T
— Parimal (@Fintech03) April 1, 2026
Google Workspace for Government would have been similarly priced, with the additional complication that Google’s government-tier infrastructure does not have India-local data residency guarantees at the same level Zoho has contractually provided here.
Zoho’s pricing was not a loss-leader or a patriotic discount. It reflected a fundamentally different cost structure: an Indian company, building on its own infrastructure, with no hyperscaler margin built into the price. The savings to the Indian exchequer over the full contract period run into hundreds of crores.
What Zoho Gains
It would be naive to read this purely as national service. Zoho has won something far more valuable than a single government contract.
Zoho co-founder Sridhar Vembu has spent 25 years building a full-stack enterprise software suite: email, CRM, HR management, project management, collaboration tools, analytics, that is a comprehensive alternative to Microsoft 365 and Google Workspace. That suite has been enormously successful in the private sector globally, but has struggled to break into government procurement, where incumbency and familiarity with Microsoft products has historically been a near-insurmountable advantage.
This contract changes that calculus permanently. With 16.68 lakh government officials now using Zoho Workplace as their primary email and communication interface, the switching cost to any competitor, Microsoft, Google, or otherwise, becomes enormous. Government IT departments that retrain officials, migrate data, and rebuild workflows on Zoho will not do so again for at least a decade.
Zoho has not just won a contract. It has established itself as the default government enterprise software platform for the Indian public sector – a position it can build on with collaboration tools, document management, video conferencing, and the broader Zoho One suite in subsequent procurement cycles.
The Larger Picture
The NIC-to-Zoho migration is a small but precise illustration of a larger question India has been grappling with for a decade: whether its critical digital infrastructure should rest on foreign-owned, foreign-hosted, foreign-jurisdiction technology or whether India can build and deploy its own.
The answer, in this case, is unambiguous. An Indian company, Indian data centres, Indian legal jurisdiction, a competitive procurement process, and a price that makes the domestic alternative cheaper than the foreign one.
The 1976 infrastructure served its era. The 2026 infrastructure is being built for the next one.
Subscribe to our channels on WhatsApp, Telegram, Instagram and YouTube to get the best stories of the day delivered to you personally.
