Uniqkey
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Danish business password & access manager (Uniqkey A/S, Copenhagen), Danish-hosted, zero-knowledge E2E, ISO 27001, EIFO-backed, NIS2-focused.
Uniqkey is an EU-owned service hosted in Denmark, with no identified CLOUD Act exposure. It is listed under Password managers.
Assessment notes
Uniqkey is a Danish business password-and-access manager operated by Uniqkey A/S (Copenhagen; founded 2017 by Hakan Yagci, backed by Denmark's national promotional bank EIFO plus a €5.35M raise). It is fully Danish-incorporated and EU-owned, hosted entirely on Danish data centres, zero-knowledge end-to-end encryption, ISO 27001 certified, with an explicit 'no third-party data transfer' policy and a dedicated NIS2-compliance posture; gap at audit: DPA and sub-processors URLs not publicly linked; structurally strong EU sovereignty profile with those documents pending public confirmation.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Uniqkey
Uniqkey is a business-focused password and access manager operated by Uniqkey A/S, headquartered in Copenhagen, Denmark. The company was founded in 2017 by Hakan Yagci, is backed by EIFO, Denmark's national export and investment fund (a state promotional bank), and has raised around €5.35M to expand across Europe. That ownership profile is unusually clean for the category: a Danish A/S with national-bank backing, no US parent, no US private equity, and no US venture capital on record.
The product splits into two parts: UniqPass (password management) and UniqAccess (access / SSO-style management), delivered through browser extensions and native apps for iOS, Android, Windows and macOS. The sovereignty story is the selling point. Uniqkey states that all data is hosted on Danish data centres with no third-party data transfer, uses zero-knowledge end-to-end encryption so Uniqkey itself cannot read customer vaults, is ISO 27001 certified, and markets a dedicated NIS2-compliance posture aimed at EU businesses that now fall under the expanded NIS2 directive. Reference customers include the Van Gogh Museum and the Danish public-sector IT supplier KMD, meaningful procurement signals for an EU-buyer audience.
For an EU-sovereignty audit the only gaps are documentation and pricing transparency. The DPA and a sub-processors list were not directly findable on the public site at audit (a B2B vendor of this type certainly provides a DPA to customers; it simply was not linked publicly), which leaves the sub-processor signal unverified pending a next-pass check. Pricing is quote-based: the site advertises "one price, complete solution" with a free trial but does not publish per-user figures, so the EUR entry point is recorded as null. Best fit: EU SMBs and public-sector buyers (especially Nordic ones) that want a business password manager with genuine in-country (Danish) hosting, ISO 27001, zero-knowledge encryption and an explicit NIS2 angle, and who are comfortable with a sales-led pricing process.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Uniqkey
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
Germany · €3.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
heylogin
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
KeePassXC
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
— |
LC-Pass
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€3.99/mo |