Aller au contenu
EU VETTED

NordPass

Gestionnaires de mots de passe · Lituanie
Fondé en 2019 · nordpass.com

Lithuanian password manager by Nord Security, zero-knowledge XChaCha20, ISO 27001 + SOC 2, but hosted on AWS (US): material CLOUD Act exposure.

NordPass propose un hébergement européen en Lituanie, mais une maison mère ou un sous-traitant américain laisse une exposition matérielle au CLOUD Act. Référencé dans la catégorie Gestionnaires de mots de passe.

Notes d’évaluation

NordPass is the password manager of Nord Security, the Lithuanian cybersecurity group (Vilnius; founded 2019, also behind NordVPN, NordLayer, NordLocker, NordStellar). The product itself is genuinely strong (zero-knowledge XChaCha20 end-to-end encryption, voluntary independent audits, ISO/IEC 27001 + SOC 2 Type 2 attested), but the infrastructure is hosted on AWS (a US-owned hyperscaler) and the vendor's own security page states that customer vault items sit in separate AWS data centres across the US and the EU, so US placement is a live fact and not merely a jurisdictional abstraction; that is material CLOUD Act exposure even with zero-knowledge encryption mitigating the practical risk. The Nord Security cap-table also carries US capital across two rounds: General Catalyst co-led the 2022 $100M round and Warburg Pincus led a second $100M round in September 2023 at a $3B valuation, both minority. Key gaps: AWS-hosted with vault data in US and EU regions, US growth capital on the cap table, and a sub-processor list that the DPA supplies only on written request rather than publishing.

Constats

CLOUD Act
Actionnariat
Sous-traitants
— non divulgué

Signaux vérifiés

Juridiction
  • Hébergement UE / adéquation: Oui
  • Opérateur UE / adéquation: Oui
  • Aucune exposition au CLOUD Act: Non
Transparence
  • DPA public: Oui
  • Sous-traitants divulgués: Non
  • Clients open source: Non
  • Certification tierce: Oui
Aller à

À propos de NordPass

NordPass is the password-manager product of Nord Security, the Lithuanian cybersecurity company headquartered in Vilnius and best known for NordVPN. NordPass launched in 2019 and sits alongside NordVPN, NordLayer, NordLocker and NordStellar in the Nord Security portfolio. As a product it is well-built: zero-knowledge architecture with XChaCha20 end-to-end encryption (data encrypted on-device before it leaves), passkey support, integrated 2FA, secure sharing, data-breach scanning, and a business tier with SSO, activity logging and admin controls. The company voluntarily undergoes independent security audits and holds ISO/IEC 27001 and SOC 2 attestations, plus HIPAA alignment and FIDO Alliance compliance.

For an EU-sovereignty audit, however, NordPass is mid-table rather than top-tier, and the reason is infrastructure, not product quality. NordPass states plainly that it is "hosted on AWS", and its security page goes further: customer vault items sit "in separate AWS data centers across the US and EU". US placement of vault data is therefore something the vendor states outright rather than a jurisdictional abstraction, and Amazon Web Services is in any case a US-owned hyperscaler holding the data at rest. CLOUD Act exposure is recorded as Significative. The zero-knowledge encryption is a genuine and important mitigation (AWS holds only encrypted blobs Nord cannot decrypt and AWS cannot read), but it does not change the ownership classification of the infrastructure. Separately, the Nord Security ownership chain carries US capital across two rounds: the 2022 $100M round was co-led by General Catalyst (US) alongside Novator (Iceland) and Burda (Germany), and a second $100M round led by Warburg Pincus (US growth equity) closed in September 2023 at a $3B valuation. Both stakes are minority and founders Tom Okman and Eimantas Sabaliauskas remain co-CEOs, which is why ownership is still recorded as Propriété UE. The group uses multiple legal entities across jurisdictions and the DPA names none of them, so the precise NordPass operating entity is not confirmable from a primary register source.

Pricing is freemium: a free tier limited to one active device; Premium at roughly €1.50-2/month on longer plans; Family and Business tiers above. The NordPass pricing page did not render concrete figures to automated fetching at audit, so the EUR entry is approximate. Best fit: individuals and businesses already inside the Nord ecosystem, and buyers who prioritise audited product security and prize zero-knowledge encryption over strict hosting sovereignty. EU buyers who need a clean no-US-infrastructure posture should prefer Proton Pass (CH), or self-host Passbolt (LU) or Psono (DE), since the default hosted tier of each of those two runs on Google Cloud.

Carte des sous-traitants · non divulgué

L'éditeur ne publie pas de liste de sous-traitants. La conformité Schrems II et l'exposition au CLOUD Act ne peuvent pas être vérifiées indépendamment sans elle.

Référentiels & certifications

ISO/IEC 27001
Active
SOC 2
Active
Information · cadre US

Matrice de fonctionnalités

Tableau 1Fonctionnalités de NordPass

Passkeys Oui
Remplissage auto Oui
Surveillance des fuites Oui
Partage familial Oui
Export des données Oui
Appareils Illimité
Plateformes iOS macOS Windows Android Linux Web

Intégration & accès

REST API Non
SSO (SAML / OIDC) Oui

Conformité & gouvernance

Audit log Oui
Self-host / on-prem option Non

Tarifs & paliers

à partir de 2 €/mois
Freemium
Voir la page tarifs

Documents publics

L'éditeur ne publie pas de liste de sous-traitants. La conformité Schrems II et l'exposition au CLOUD Act ne peuvent pas être vérifiées indépendamment sans elle.
  • Contrat de sous-traitance (DPA)
    business.nordsec.com/legal…
    Ouvrir
  • Liste des sous-traitants
    — manquant
    manquant
  • Conditions d'utilisation
    my.nordaccount.com/legal…
    Ouvrir

Alternatives dans cette catégorie

  • heylogin
    Allemagne · 4 €/mois
    Souverain UE
    DPA public: Oui Sous-traitants: Oui Open source: Non
  • KeePassXC
    Allemagne
    Souverain UE
    DPA public: Non évalué Sous-traitants: Non Open source: Oui
  • LC-Pass
    Allemagne · 3.99 €/mois
    Souverain UE
    DPA public: Non évalué Sous-traitants: Non Open source: Non
Voir toutes les alternatives gestionnaires de mots de passe