Aller au contenu
EU VETTED

Passbolt

Gestionnaires de mots de passe · Luxembourg
Fondé en 2017 · passbolt.com

Luxembourg-incorporated AGPLv3 open-source team password manager (Passbolt SA), SOC 2 Type II, self-hostable, used by LU/FR government.

Passbolt propose un hébergement européen en Belgique, mais une maison mère ou un sous-traitant américain laisse une exposition matérielle au CLOUD Act. Référencé dans la catégorie Gestionnaires de mots de passe.

Notes d’évaluation

Passbolt SA (9 Avenue du Blues, L-4368 Belvaux, Luxembourg; incorporated 2017, concept since 2011) is a fully AGPLv3 open-source team password manager (even the paid Business tier is open source) built around OpenPGP end-to-end encryption, self-hostable by default with Cloud as a managed alternative, and audited by independent third parties several times a year with all reports public; SOC 2 Type II attested. Customer base includes the Luxembourg government IT body and France's Ministry of the Interior. Founder team active; investors are Luxembourg / EU (Luxinnovation, Scalefund, Yeast, Expon Capital, Airbridge Equity Partners); €11M raised across 2020 (€3M) and the €8M Series A announced January 2025; 30+ remote-first team. The August 2026 re-verify downgrades the hosting posture: the DPA (updated 14 July 2026) and the privacy policy (updated 11 August 2026) now disclose that Passbolt Cloud data is hosted on Google Cloud Platform in Belgium and Germany and fronted by Cloudflare, against a 14-name sub-processor list of which 9 are US-resident (GCP, Cloudflare, AWS SES, Chargebee, HubSpot, New Relic, Slack, Stripe, Zoho), so the default hosted offering carries material CLOUD Act exposure. The Cloud Sovereign and Cloud Enterprise tiers are hosted instead in a sovereign private Luxembourg data centre, and the AGPLv3 self-host route on EU infrastructure remains EU-owned, EU-hosted, with no CLOUD Act exposure.

Constats

CLOUD Act
Actionnariat
Sous-traitants
14 · 9 US

Signaux vérifiés

Juridiction
  • Hébergement UE / adéquation: Oui
  • Opérateur UE / adéquation: Oui
  • Aucune exposition au CLOUD Act: Non
Transparence
  • DPA public: Oui
  • Sous-traitants divulgués: Oui
  • Clients open source: Oui
  • Certification tierce: Oui
CLOUD Act selon le déploiement

L'exposition dépend de votre mode d'exploitation.

SaaS hébergé (par défaut)

Exploité par l'éditeur : les sous-traitants ci-dessous s'appliquent.

Auto-hébergé (open source)

Déployez sur votre propre infrastructure UE et vous contrôlez l'hébergement et chaque sous-traitant.

Aller à

À propos de Passbolt

Passbolt is one of the most transparent open-source password-manager listings in this directory. The legal entity is Passbolt SA at 9 Avenue du Blues, L-4368 Belvaux, Luxembourg, incorporated as a formal company in 2017 after the concept originated within a Luxembourg digital agency in 2011. The product was conceived as a collaborative successor to KeePass, with a focus on team credentials sharing, RBAC, audit logging, and OpenPGP-based end-to-end encryption (1:1 keys per credential). Customer references include the Luxembourg government IT body and the French Ministry of the Interior. These are strong public-sector procurement signals that, combined with the open-source licensing, make Passbolt a natural fit for EU sovereign-procurement workflows.

Licensing and audit transparency are the strongest part of this listing. Both the Community (free) edition AND the paid Business + Enterprise editions are released under the GNU Affero General Public License v3 (AGPLv3). Buyers can fork the codebase, run audits internally, and never face vendor lock-in. The company commissions independent third-party audits multiple times per year with all reports public, including SOC 2 Type II attestation. Encryption is OpenPGP with 1:1 per-credential keys; no server operator (including Passbolt's own Cloud team) can decrypt customer vaults. Self-host deployment supports Docker, Kubernetes (Helm), and native installation on Ubuntu, Rocky Linux, and openSUSE. That gives full flexibility to run on Hetzner, OVHcloud, Scaleway, IONOS, STACKIT, or any other EU GPU / VPS infrastructure. The hosted Cloud has to be read separately, because the default tier is not Luxembourg-hosted. The DPA (updated 14 July 2026) and the privacy policy (updated 11 August 2026) state that Cloud Site data sits on Google Cloud Platform in Belgium and Germany behind Cloudflare for WAF and CDN, against a 14-name sub-processor list of which 9 are US-resident, which is why CLOUD Act exposure for the hosted product is recorded as Significative. The Cloud Sovereign and Cloud Enterprise tiers are hosted instead in a sovereign private data centre in Luxembourg, and the AGPLv3 self-host route on EU infrastructure removes the vendor counterparty altogether.

Pricing is open-source-friendly and procurement-grade. Community Edition is free under AGPLv3 with unlimited users, core feature set, browser extensions, API, role-based access, with community support only. The paid ladder then splits by deployment. Self-hosted Pro Edition is €4.50 per user per month billed annually (10-user minimum, volume discounts above 100 users) and adds tags, LDAP provisioning, SSO (Microsoft, Google, OpenID), account recovery, audit logs, and a packaged VM appliance with next-business-day email support. On the hosted side, Cloud Business is 5 € per user per month billed monthly, same 10-user minimum, on Google Cloud in Belgium and Germany; Cloud Sovereign is €7 per user per month billed annually in a sovereign private data centre in Luxembourg that the vendor describes as an ISO 27001 certified hosting environment; Cloud Enterprise is custom on that same Luxembourg data centre, with 4-hour SLA, white-glove migration, custom development, and disaster-recovery consulting. Non-profits qualify for special pricing. Best fit: EU public-sector buyers, regulated industries (finance, defence, healthcare), teams that need SAML / LDAP SSO with audit-log compliance, and any procurement-grade buyer who wants AGPLv3 source-availability plus SOC 2 Type II attestation on a Luxembourg-incorporated open-source vendor.

Carte des sous-traitants · 14

Source
  • Amazon Web Services US
    États-Unis

    Transactional email delivery (SES)

  • Chargebee US
    États-Unis

    Subscription and invoice management

  • Cloudflare US
    États-Unis

    Web application firewall and content delivery network

  • Google Cloud Platform US
    États-Unis

    Website and cloud data hosting; Passbolt Cloud databases located in Belgium and Germany

  • HubSpot US
    États-Unis

    CRM and customer support

  • New Relic US
    États-Unis

    Performance and security monitoring

  • Slack US
    États-Unis

    Support and alerting

  • Stripe US
    États-Unis

    Payment processing

  • Zoho US
    États-Unis

    Accounting

  • Aikido EU
    Belgique

    Web application firewall

  • Chartmogul EU
    Allemagne

    Subscription and invoice management

  • n8n EU
    Allemagne

    Integration platform

  • Odoo EU
    Belgique

    Accounting

  • Thales Cyber Solutions EU
    Luxembourg

    Security Operations Center

Source : liste publiée des sous-traitants de l’éditeur, lue le 26 août 2026.

9 sous-traitants sur 14 sont détenus par des capitaux américains ou établis aux États-Unis. Exposition au CLOUD Act applicable.

Référentiels & certifications

SOC 2
Active
Information · cadre US

Matrice de fonctionnalités

Tableau 2Fonctionnalités de Passbolt

Passkeys Non
Remplissage auto Oui
Surveillance des fuites Oui
Partage familial Oui
Export des données Oui
Appareils Illimité
Plateformes iOS Android Windows Linux

Intégration & accès

REST API Oui
SSO (SAML / OIDC) Oui

Conformité & gouvernance

Audit log Oui
Self-host / on-prem option Oui

Tarifs & paliers

à partir de 5 €/mois
Freemium
Voir la page tarifs

Documents publics

  • Contrat de sous-traitance (DPA)
    www.passbolt.com/terms…
    Ouvrir
  • Liste des sous-traitants
    www.passbolt.com/terms…
    Ouvrir
  • Conditions d'utilisation
    www.passbolt.com/legal…
    Ouvrir

Alternatives dans cette catégorie

  • heylogin
    Allemagne · 4 €/mois
    Souverain UE
    DPA public: Oui Sous-traitants: Oui Open source: Non
  • KeePassXC
    Allemagne
    Souverain UE
    DPA public: Non évalué Sous-traitants: Non Open source: Oui
  • LC-Pass
    Allemagne · 3.99 €/mois
    Souverain UE
    DPA public: Non évalué Sous-traitants: Non Open source: Non
Voir toutes les alternatives gestionnaires de mots de passe

Présent dans ces guides