Skip to content
Independently verified · Quarterly re-audit
EU VETTED
Curated collection

Password managers without US sub-processors

European password managers verified to run with no US sub-processors — compared on ownership, hosting region, CLOUD Act exposure and sub-processor chain.

In short

The password managers listed here operate with no US sub-processors in the data path — an EU/EEA/Switzerland operator with no US parent and no US-incorporated processor, or software you run entirely yourself. Passbolt (Luxembourg — open-source, SOC 2 Type II, EU-hosted) and Uniqkey (Denmark, Copenhagen — Danish-hosted business access management) are the strongest managed team options; Psono (Germany) is the self-hostable open-source alternative, and KeePassXC (offline desktop) plus Vaultwarden (self-hosted, Bitwarden-compatible) remove the cloud operator entirely. Vault contents are end-to-end encrypted in all of them — the jurisdictional bar on this page concerns the account, metadata and service layer that encryption does not cover.

Last verified June 2026 DISCLOSURE Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.

Password managers without US sub-processors, as listed on this page, means one of two things: a managed service whose operating company is incorporated in the EU, EEA or Switzerland, holds no US parent, and routes no customer data through a US-incorporated processor — or software that runs entirely under your own control, offline or self-hosted, so that no third-party operator exists in the first place. Both routes clear the same bar; they get there differently, and the listing marks which is which.

This category rewards strictness unusually well. Credentials are the keys to everything else an organisation runs, and the password manager's own service layer — accounts, metadata, sharing structures, the update channel — concentrates trust even when vault contents are end-to-end encrypted. The European field here is genuinely strong: open-source team products from Luxembourg and Germany, a Danish business access platform, and mature offline and self-hosted options. Every entry is sourced to the vendor's public documentation and re-verified quarterly.

Why it matters

The CLOUD Act extends US government reach to data held by any company subject to US jurisdiction, regardless of server location. Password managers are a special case in two directions at once. In one direction, end-to-end encryption genuinely limits what any operator could disclose — vault contents are unreadable without the user's master password, whoever holds the ciphertext. In the other, the service layer around the vault is more sensitive than in most SaaS: account identities map your organisation's people, vault metadata shows what exists and when it is used, team-sharing structures mirror your permission model, and the client-update channel can technically deliver whatever its controller ships.

That second direction is why jurisdiction still matters after encryption. A US-incorporated operator can be compelled to produce what it holds — metadata, account data — and is itself the supply chain for the clients that handle plaintext locally. The tools on this page either place that operator in an EU/EEA/Swiss jurisdiction with no US parent, or remove the operator entirely by putting the server, or the encrypted file itself, in your hands. Each listing records ownership, hosting and the sub-processor chain as separate, evidenced signals.

How to choose

Start with the operating model your team can sustain. Managed European services (Passbolt cloud, Uniqkey) suit teams that want SSO, provisioning and support with no operations burden — compare them on audit posture (SOC 2, pentest publication), browser-extension quality and per-seat price. Self-hosted servers (Psono, Passbolt CE, Vaultwarden) suit teams with existing EU infrastructure and the discipline to patch and back up; they reduce the jurisdictional question to your own hosting choice. Offline managers (KeePassXC) fit individuals and small technical teams that can live without built-in sync, or that sync the encrypted database through storage they already trust.

For regulated buyers, treat the password manager's operator like any other processor: any US incorporation in the chain is typically a veto, and the self-hosted and offline routes are often the shortest path through procurement. For SMBs, the binding constraints are onboarding friction and recovery flows — check how each product handles a forgotten master password and offboarding before committing. Use the sort and filter controls on the listing above to narrow by hosting country, open-source licence or pricing.

SWITCHING GUIDES

Switching from a US categories.password_managers tool?

Side-by-side European alternatives — same hosting, ownership and CLOUD Act checks — for the most-replaced categories.password_managers tools.

FAQ

Frequently asked questions

Password vaults are end-to-end encrypted — why does US jurisdiction still matter?
Encryption protects vault contents, not the service around them. The operator still holds account and billing data, vault metadata such as entry counts and access timestamps, sharing structures in team products, and the client-update channel. Those remain reachable by legal process against the operator, and the update channel is a supply-chain dependency on whoever controls it — which is why the operator's jurisdiction is recorded independently of the encryption model.
What counts as 'no US sub-processors' on this page?
Either the operating company is EU/EEA/Swiss with no US parent and no US-incorporated sub-processor in the data path — the directory's 'CLOUD Act exposure: none' bar — or the product runs entirely under your control (offline or self-hosted), so no third-party operator exists at all.
Do offline and self-hosted password managers have sub-processors at all?
Effectively no — that is their structural advantage. An offline manager like KeePassXC stores an encrypted file you control, with no vendor cloud; a self-hosted server like Vaultwarden or Psono makes you the operator, so the chain collapses to your own hosting choice. The trade-off is that updates, backups and availability become your responsibility.
How do these relate to Bitwarden, 1Password or LastPass?
Those three are operated by US-incorporated companies, which places them outside this page's bar regardless of where data is hosted. Vaultwarden is an independent open-source server implementation compatible with Bitwarden's clients — hosted by you on European infrastructure, it keeps the client ecosystem while replacing the US-operated service layer. Each profile records the operator and ownership separately so the distinction stays visible.
Can I import my existing vault?
Generally yes. CSV import from the major US incumbents is standard across the tools here, and Vaultwarden accepts Bitwarden exports natively. What needs manual re-creation is typically shared collections, attachments and TOTP seeds, depending on the source — each profile notes the documented import paths.
Methodology

How we verified every listing here.

For each product we read the public DPA, sub-processors document, hosting region declaration, certifications, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.

Read methodology →