LC-Pass
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
LC by vBoxx GmbH
EU-hosted business password manager from LC by vBoxx GmbH (primary site near Frankfurt); collections, group sharing, central management, unlimited devices; a 1Password / LastPass alternative.
LC-Pass is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Password managers.
Assessment notes
LC-Pass is the business password manager in the leitzcloud suite, operated by LC by vBoxx GmbH (Frankfurt am Main, HRB 117087; part of the Dutch vBoxx group). It stores and shares credentials, credit-card data, and other secrets for teams, with collections, group sharing and per-item rights, central management and reporting, and unlimited items, devices, and synchronisation. The company imprint and data-centre page place the group's servers at maincubes FRA01 in Offenbach am Main, near Frankfurt, with a backup site in Naaldwijk, Netherlands since May 2026; the LC-Pass product page still describes two German locations, so the vendor's pages disagree. Either way the data stays on the group's own EU hardware with no US provider in the chain: EU-owned, EU-hosted, no CLOUD Act exposure. The vendor markets zero-knowledge encryption, but the same page describes 256-bit AES encryption on the servers, and no whitepaper or audit confirms client-side encryption. Held at 4/5 because the AVV is issued through the customer portal rather than published; ISO/IEC 27001 is recorded at infrastructure level because the certificate in force names the sister company vBoxx B.V.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About LC-Pass
LC-Pass is the credential-management component of the leitzcloud suite, operated by LC by vBoxx GmbH (Frankfurt am Main; part of the Dutch vBoxx group). It lets organisations securely store, manage, and share passwords, credit-card details, and other sensitive data, organised into collections with group-based sharing and per-item rights, plus central management and security reports for administrators, account backups, and unlimited items, devices, and synchronisation. A browser extension handles autofill. The positioning is an EU-hosted alternative to 1Password and LastPass for teams that want their secrets held inside EU infrastructure rather than with a US-based provider.
Data runs on the group's own hardware. The company imprint and data-centre page name maincubes FRA01 in Offenbach am Main, near Frankfurt, as the primary site and, since May 2026, Greenhouse Datacenters in Naaldwijk, Netherlands as the georedundant backup site. The LC-Pass page itself still says the data sits in several data centres in Frankfurt and the Palatinate, so the vendor's own pages disagree on the second location; both versions keep data in the EU on the operator's own servers, with no CLOUD Act exposure. On encryption the page uses "zero-knowledge" while also describing 256-bit AES encryption on the servers; until a whitepaper or audit shows client-side encryption, treat it as server-side. ISO/IEC 27001 is certified by TÜV NORD for the group, but the certificate in force names vBoxx B.V. and its appendix of covered entities is not published, so the directory records it at infrastructure level. The AVV is requested in the customer portal and supplied for signature; it is not published at a public URL. Price: EUR 3.99 per user per month. Best fit: DACH SMBs and public-sector-adjacent teams already using or considering leitzcloud who want team credential management under the same operator.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Held by the provider that operates the hosting, not by LC-Pass itself.
Capability matrix
Table 1Capabilities of LC-Pass
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
on requestData Processing Addendum (DPA)— on request
-
missingSub-processors list— missing
-
OpenTerms of Serviceleitzcloud.eu/agb-geschaeftsbedingungen…
Alternatives in this category
-
Germany · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
Lithuania · €2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
heylogin
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
KeePassXC
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
— |
| NordPass Lithuania | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€2/mo |