Zum Inhalt springen
EU VETTED

NordPass

Passwort-Manager · Litauen
Gegründet 2019 · nordpass.com

Lithuanian password manager by Nord Security, zero-knowledge XChaCha20, ISO 27001 + SOC 2, but hosted on AWS (US): material CLOUD Act exposure.

NordPass bietet EU-Hosting in Litauen, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko. Gelistet unter Passwort-Manager.

Bewertungsnotizen

NordPass is the password manager of Nord Security, the Lithuanian cybersecurity group (Vilnius; founded 2019, also behind NordVPN, NordLayer, NordLocker, NordStellar). The product itself is genuinely strong (zero-knowledge XChaCha20 end-to-end encryption, voluntary independent audits, ISO/IEC 27001 + SOC 2 Type 2 attested), but the infrastructure is hosted on AWS (a US-owned hyperscaler) and the vendor's own security page states that customer vault items sit in separate AWS data centres across the US and the EU, so US placement is a live fact and not merely a jurisdictional abstraction; that is material CLOUD Act exposure even with zero-knowledge encryption mitigating the practical risk. The Nord Security cap-table also carries US capital across two rounds: General Catalyst co-led the 2022 $100M round and Warburg Pincus led a second $100M round in September 2023 at a $3B valuation, both minority. Key gaps: AWS-hosted with vault data in US and EU regions, US growth capital on the cap table, and a sub-processor list that the DPA supplies only on written request rather than publishing.

Befund

CLOUD Act
Eigentümer
Unterauftragsverarbeiter
— nicht offengelegt

Geprüfte Signale

Jurisdiktion
  • EU-/Angemessenheits-Hosting: Ja
  • EU-/Angemessenheits-Betreiber: Ja
  • Keine US-CLOUD-Act-Exposition: Nein
Transparenz
  • Öffentlicher AVV: Ja
  • Unterauftragsverarbeiter offengelegt: Nein
  • Open-Source-Clients: Nein
  • Zertifizierung durch Dritte: Ja
Springen zu

Über NordPass

NordPass is the password-manager product of Nord Security, the Lithuanian cybersecurity company headquartered in Vilnius and best known for NordVPN. NordPass launched in 2019 and sits alongside NordVPN, NordLayer, NordLocker and NordStellar in the Nord Security portfolio. As a product it is well-built: zero-knowledge architecture with XChaCha20 end-to-end encryption (data encrypted on-device before it leaves), passkey support, integrated 2FA, secure sharing, data-breach scanning, and a business tier with SSO, activity logging and admin controls. The company voluntarily undergoes independent security audits and holds ISO/IEC 27001 and SOC 2 attestations, plus HIPAA alignment and FIDO Alliance compliance.

For an EU-sovereignty audit, however, NordPass is mid-table rather than top-tier, and the reason is infrastructure, not product quality. NordPass states plainly that it is "hosted on AWS", and its security page goes further: customer vault items sit "in separate AWS data centers across the US and EU". US placement of vault data is therefore something the vendor states outright rather than a jurisdictional abstraction, and Amazon Web Services is in any case a US-owned hyperscaler holding the data at rest. CLOUD Act exposure is recorded as Erheblich. The zero-knowledge encryption is a genuine and important mitigation (AWS holds only encrypted blobs Nord cannot decrypt and AWS cannot read), but it does not change the ownership classification of the infrastructure. Separately, the Nord Security ownership chain carries US capital across two rounds: the 2022 $100M round was co-led by General Catalyst (US) alongside Novator (Iceland) and Burda (Germany), and a second $100M round led by Warburg Pincus (US growth equity) closed in September 2023 at a $3B valuation. Both stakes are minority and founders Tom Okman and Eimantas Sabaliauskas remain co-CEOs, which is why ownership is still recorded as EU-Eigentum. The group uses multiple legal entities across jurisdictions and the DPA names none of them, so the precise NordPass operating entity is not confirmable from a primary register source.

Pricing is freemium: a free tier limited to one active device; Premium at roughly €1.50-2/month on longer plans; Family and Business tiers above. The NordPass pricing page did not render concrete figures to automated fetching at audit, so the EUR entry is approximate. Best fit: individuals and businesses already inside the Nord ecosystem, and buyers who prioritise audited product security and prize zero-knowledge encryption over strict hosting sovereignty. EU buyers who need a clean no-US-infrastructure posture should prefer Proton Pass (CH), or self-host Passbolt (LU) or Psono (DE), since the default hosted tier of each of those two runs on Google Cloud.

Unterauftragsverarbeiter-Karte · nicht offengelegt

Anbieter veröffentlicht keine Liste der Unterauftragsverarbeiter. Schrems-II-Konformität und CLOUD-Act-Risiko lassen sich ohne sie nicht unabhängig prüfen.

Rahmenwerke & Zertifizierungen

ISO/IEC 27001
Aktiv
SOC 2
Aktiv
Hinweis · US-Rahmenwerk

Funktionsmatrix

Tabelle 1Funktionen von NordPass

Passkeys Ja
Autofill Ja
Leak-Überwachung Ja
Familienfreigabe Ja
Datenexport Ja
Geräte Unbegrenzt
Plattformen iOS macOS Windows Android Linux Web

Integration & Zugriff

REST API Nein
SSO (SAML / OIDC) Ja

Compliance & Governance

Audit log Ja
Self-host / on-prem option Nein

Preise & Tarife

ab 2 €/Monat
Freemium
Preisseite ansehen

Öffentliche Dokumente

Anbieter veröffentlicht keine Liste der Unterauftragsverarbeiter. Schrems-II-Konformität und CLOUD-Act-Risiko lassen sich ohne sie nicht unabhängig prüfen.
  • Auftragsverarbeitungsvertrag (AVV)
    business.nordsec.com/legal…
    Öffnen
  • Liste der Unterauftragsverarbeiter
    — fehlt
    fehlt
  • Nutzungsbedingungen
    my.nordaccount.com/legal…
    Öffnen

Alternativen in dieser Kategorie

  • heylogin
    Deutschland · 4 €/Mt.
    EU-souverän
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • KeePassXC
    Deutschland
    EU-souverän
    Öffentl. AVV: Nicht bewertet Subprozessoren: Nein Open Source: Ja
  • LC-Pass
    Deutschland · 3.99 €/Mt.
    EU-souverän
    Öffentl. AVV: Nicht bewertet Subprozessoren: Nein Open Source: Nein
Alle passwort-manager-Alternativen ansehen