Strictly necessary cookies (session, security) are always on. Analytics uses Pirsch (cookieless). With your consent, any advertising on the site can be personalised via cookies. Without consent, ads stay generic and untracked, but may still appear.
Read the privacy notice
French-founded, now US-headquartered (NYC). Significant US-VC funding.
Alternatives
6
CLOUD Act · none
4
Free tier
5
Disclosure:Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Which are the closest Dashlane alternatives?
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
AGPLv3 Rust Bitwarden-compatible server by Daniel García (Spain), self-host-only, no company, no telemetry; EU-maintained, no CLOUD Act exposure when run on EU infrastructure.
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
Spain
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
GPLv3 fully-offline desktop password manager (KeePassXC Team, Weimar DE, est. 2016): no cloud, no servers, no telemetry; structurally zero CLOUD Act exposure.
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
