Zum Inhalt springen
EU VETTED

Passbolt

Passwort-Manager · Luxemburg
Gegründet 2017 · passbolt.com

Luxembourg-incorporated AGPLv3 open-source team password manager (Passbolt SA), SOC 2 Type II, self-hostable, used by LU/FR government.

Passbolt bietet EU-Hosting in Belgien, doch ein US-Mutterkonzern oder Unterauftragsverarbeiter hinterlässt ein materielles CLOUD-Act-Risiko. Gelistet unter Passwort-Manager.

Bewertungsnotizen

Passbolt SA (9 Avenue du Blues, L-4368 Belvaux, Luxembourg; incorporated 2017, concept since 2011) is a fully AGPLv3 open-source team password manager (even the paid Business tier is open source) built around OpenPGP end-to-end encryption, self-hostable by default with Cloud as a managed alternative, and audited by independent third parties several times a year with all reports public; SOC 2 Type II attested. Customer base includes the Luxembourg government IT body and France's Ministry of the Interior. Founder team active; investors are Luxembourg / EU (Luxinnovation, Scalefund, Yeast, Expon Capital, Airbridge Equity Partners); €11M raised across 2020 (€3M) and the €8M Series A announced January 2025; 30+ remote-first team. The August 2026 re-verify downgrades the hosting posture: the DPA (updated 14 July 2026) and the privacy policy (updated 11 August 2026) now disclose that Passbolt Cloud data is hosted on Google Cloud Platform in Belgium and Germany and fronted by Cloudflare, against a 14-name sub-processor list of which 9 are US-resident (GCP, Cloudflare, AWS SES, Chargebee, HubSpot, New Relic, Slack, Stripe, Zoho), so the default hosted offering carries material CLOUD Act exposure. The Cloud Sovereign and Cloud Enterprise tiers are hosted instead in a sovereign private Luxembourg data centre, and the AGPLv3 self-host route on EU infrastructure remains EU-owned, EU-hosted, with no CLOUD Act exposure.

Befund

CLOUD Act
Eigentümer
Unterauftragsverarbeiter
14 · 9 US

Geprüfte Signale

Jurisdiktion
  • EU-/Angemessenheits-Hosting: Ja
  • EU-/Angemessenheits-Betreiber: Ja
  • Keine US-CLOUD-Act-Exposition: Nein
Transparenz
  • Öffentlicher AVV: Ja
  • Unterauftragsverarbeiter offengelegt: Ja
  • Open-Source-Clients: Ja
  • Zertifizierung durch Dritte: Ja
CLOUD Act je nach Betrieb

Die Exposition hängt davon ab, wie Sie dieses Produkt betreiben.

Gehostetes SaaS (Standard)

Anbieterbetrieben: die unten genannten Unterauftragsverarbeiter gelten.

Selbst gehostet (Open Source)

Auf eigener EU-Infrastruktur betreiben: Sie kontrollieren Hosting und jeden Unterauftragsverarbeiter.

Springen zu

Über Passbolt

Passbolt is one of the most transparent open-source password-manager listings in this directory. The legal entity is Passbolt SA at 9 Avenue du Blues, L-4368 Belvaux, Luxembourg, incorporated as a formal company in 2017 after the concept originated within a Luxembourg digital agency in 2011. The product was conceived as a collaborative successor to KeePass, with a focus on team credentials sharing, RBAC, audit logging, and OpenPGP-based end-to-end encryption (1:1 keys per credential). Customer references include the Luxembourg government IT body and the French Ministry of the Interior. These are strong public-sector procurement signals that, combined with the open-source licensing, make Passbolt a natural fit for EU sovereign-procurement workflows.

Licensing and audit transparency are the strongest part of this listing. Both the Community (free) edition AND the paid Business + Enterprise editions are released under the GNU Affero General Public License v3 (AGPLv3). Buyers can fork the codebase, run audits internally, and never face vendor lock-in. The company commissions independent third-party audits multiple times per year with all reports public, including SOC 2 Type II attestation. Encryption is OpenPGP with 1:1 per-credential keys; no server operator (including Passbolt's own Cloud team) can decrypt customer vaults. Self-host deployment supports Docker, Kubernetes (Helm), and native installation on Ubuntu, Rocky Linux, and openSUSE. That gives full flexibility to run on Hetzner, OVHcloud, Scaleway, IONOS, STACKIT, or any other EU GPU / VPS infrastructure. The hosted Cloud has to be read separately, because the default tier is not Luxembourg-hosted. The DPA (updated 14 July 2026) and the privacy policy (updated 11 August 2026) state that Cloud Site data sits on Google Cloud Platform in Belgium and Germany behind Cloudflare for WAF and CDN, against a 14-name sub-processor list of which 9 are US-resident, which is why CLOUD Act exposure for the hosted product is recorded as Erheblich. The Cloud Sovereign and Cloud Enterprise tiers are hosted instead in a sovereign private data centre in Luxembourg, and the AGPLv3 self-host route on EU infrastructure removes the vendor counterparty altogether.

Pricing is open-source-friendly and procurement-grade. Community Edition is free under AGPLv3 with unlimited users, core feature set, browser extensions, API, role-based access, with community support only. The paid ladder then splits by deployment. Self-hosted Pro Edition is €4.50 per user per month billed annually (10-user minimum, volume discounts above 100 users) and adds tags, LDAP provisioning, SSO (Microsoft, Google, OpenID), account recovery, audit logs, and a packaged VM appliance with next-business-day email support. On the hosted side, Cloud Business is 5 € per user per month billed monthly, same 10-user minimum, on Google Cloud in Belgium and Germany; Cloud Sovereign is €7 per user per month billed annually in a sovereign private data centre in Luxembourg that the vendor describes as an ISO 27001 certified hosting environment; Cloud Enterprise is custom on that same Luxembourg data centre, with 4-hour SLA, white-glove migration, custom development, and disaster-recovery consulting. Non-profits qualify for special pricing. Best fit: EU public-sector buyers, regulated industries (finance, defence, healthcare), teams that need SAML / LDAP SSO with audit-log compliance, and any procurement-grade buyer who wants AGPLv3 source-availability plus SOC 2 Type II attestation on a Luxembourg-incorporated open-source vendor.

Unterauftragsverarbeiter-Karte · 14

Quelle
  • Amazon Web Services US
    Vereinigte Staaten

    Transactional email delivery (SES)

  • Chargebee US
    Vereinigte Staaten

    Subscription and invoice management

  • Cloudflare US
    Vereinigte Staaten

    Web application firewall and content delivery network

  • Google Cloud Platform US
    Vereinigte Staaten

    Website and cloud data hosting; Passbolt Cloud databases located in Belgium and Germany

  • HubSpot US
    Vereinigte Staaten

    CRM and customer support

  • New Relic US
    Vereinigte Staaten

    Performance and security monitoring

  • Slack US
    Vereinigte Staaten

    Support and alerting

  • Stripe US
    Vereinigte Staaten

    Payment processing

  • Zoho US
    Vereinigte Staaten

    Accounting

  • Aikido EU
    Belgien

    Web application firewall

  • Chartmogul EU
    Deutschland

    Subscription and invoice management

  • n8n EU
    Deutschland

    Integration platform

  • Odoo EU
    Belgien

    Accounting

  • Thales Cyber Solutions EU
    Luxemburg

    Security Operations Center

Quelle: veröffentlichte Unterauftragsverarbeiter-Liste des Anbieters, gelesen am 26 Aug 2026.

9 von 14 Unterauftragsverarbeitern sind in US-Eigentum oder haben ihren Sitz in den USA. CLOUD-Act-Risiko anwendbar.

Rahmenwerke & Zertifizierungen

SOC 2
Aktiv
Hinweis · US-Rahmenwerk

Funktionsmatrix

Tabelle 2Funktionen von Passbolt

Passkeys Nein
Autofill Ja
Leak-Überwachung Ja
Familienfreigabe Ja
Datenexport Ja
Geräte Unbegrenzt
Plattformen iOS Android Windows Linux

Integration & Zugriff

REST API Ja
SSO (SAML / OIDC) Ja

Compliance & Governance

Audit log Ja
Self-host / on-prem option Ja

Preise & Tarife

ab 5 €/Monat
Freemium
Preisseite ansehen

Öffentliche Dokumente

  • Auftragsverarbeitungsvertrag (AVV)
    www.passbolt.com/terms…
    Öffnen
  • Liste der Unterauftragsverarbeiter
    www.passbolt.com/terms…
    Öffnen
  • Nutzungsbedingungen
    www.passbolt.com/legal…
    Öffnen

Alternativen in dieser Kategorie

  • heylogin
    Deutschland · 4 €/Mt.
    EU-souverän
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • KeePassXC
    Deutschland
    EU-souverän
    Öffentl. AVV: Nicht bewertet Subprozessoren: Nein Open Source: Ja
  • LC-Pass
    Deutschland · 3.99 €/Mt.
    EU-souverän
    Öffentl. AVV: Nicht bewertet Subprozessoren: Nein Open Source: Nein
Alle passwort-manager-Alternativen ansehen

In diesen Übersichten gelistet