Passbolt key facts
Last updated- Legal entity
- Passbolt S.A.
- Headquarters
- France (FR)
- Ownership
- Independent
- Founded
- 2016
- Data hosting
- EU (any EU region)
- Infrastructure
- Self-hosted or Passbolt Cloud (EU)
- Deployment
- Self-hosted, SaaS
- Open source
- Yes
- US Cloud Act exposure
- Low (no US parent)
- Certifications
- BSI (implied by German gov users)
- Replaces
- 1Password, Bitwarden, LastPass, Dashlane, Keepass
About Passbolt
Passbolt is an open-source password manager specifically designed for businesses and teams that prioritize security and digital sovereignty. It utilizes a unique security model based on OpenPGP, where encryption and decryption happen locally on the user's device, ensuring that the server never has access to the master password or private keys. This 'security by design' approach makes it a preferred choice for government agencies and security-conscious organizations. The platform offers a hybrid approach, allowing organizations to choose between a fully managed cloud version hosted in Europe or an on-premise installation behind their own firewall (including air-gapped environments). It extends beyond simple password storage to include secret management for DevOps teams via an API-centric architecture, and robust administrative controls such as fine-grained permissions, single sign-on (SSO), and detailed audit logs to comply with regulatory frameworks like NIS2.
Alternative to
Target Segments
Deployment Options
Hosting & Security
Self-hosted or Passbolt Cloud (EU)
Key Features
Related Articles
All articlesThe First AI Act Standard Is Here: What EN 18286 Means for European AI Providers
On 19 October 2026 the European Commission published the reference to EN 18286:2026 in the Official Journal. It is the first harmonised standard under the AI Act and gives providers of high-risk AI systems a presumption of conformity for quality management. Here is what it covers and what to do next.
20 Oct 2026RegulationThe EU Cloud and AI Development Act: What CADA Means for SaaS Buyers and Vendors
On 3 June 2026 the European Commission published the Cloud and AI Development Act, the centrepiece of its Tech Sovereignty Package. It introduces four cloud sovereignty tiers and restricts foreign processing of sensitive public data. Here is what it actually changes.
12 Jun 2026Digital SovereigntyAfter the US Election: Why 2026 Is the Year EU Companies Must Diversify Cloud Risk
Legal exposure, tariffs, and operational lock-in used to be separate concerns. In 2026 they stack together. Here is a sober playbook for European companies that want to reduce US cloud dependency without breaking what works.
7 May 2026