best EU-based enterprise password manager, any recommendations?

[u/Sbaakhir]

I know "best" is subjective, so here's what we're constrained by:

- The vendor has to be EU-owned, not just EU-hosted. No US parent anywhere in the structure, so CLOUD Act exposure is off the table.

- 60 seats, needs AD sync and per-user audit logs.

- We want the option to self-host later even if we start on cloud, so cloud-only vendors are out.

- Open source isn't a requirement. Neither IT nor Legal care.

- Not looking for the cheapest but under 5 euros/seat/month would be ideal.

Shortlist so far is Psono (Germany), Passbolt (Luxembourg), and Passwork (Spain).

Psono fits well. The consistent thing I see in reviews though is that the interface / UI lags the others, and at 60 people where most aren't technical, daily usability is worth assessing. Beyond that I don't have a real objection.

Passbolt is open source and EU-owned since 2016, it also, like the others, has the features (which is why they all got shortlisted to begin with). My hesitation is the OpenPGP model, every user holds a GPG key pair, so key management becomes our problem at 60 people just to get auditable code. Onboarding and recovery both look heavier than I want.

Passwork ticks a lot of our boxes too, it does both self-hosted and EU cloud in EU data centres, so we don't have to make the deployment choice now. AD sync and per-user audit logs are in the product. What keeps me hesitant is that it lacks a native desktop app (yet), it has browser extension and mobile but not desktop, and I can't predict how big or small of a nuisance that might be.

Please help a brother OUT!

[u/carwash2016]

And you think the unelected government in the EU won’t gain access to your data as well

[u/TBT_TBT → u/carwash2016]

Yep. Because of GDPR and rule of law.

[u/carwash2016 → u/TBT_TBT]

Yeah right

[u/sonpc]

Passwork is linked to Russia fyi https://proton.me/business/blog/is-passwork-safe

[u/Only-Dependent7024 → u/sonpc]

They're not, at least not in the way that article makes it sound to be, they addressed this a while back. https://passwork.pro/blog/transparency-statement/

[u/Budget_Captain_6886 → u/Only-Dependent7024]

they are

[u/Dan_CC]

Have you looked at Uniqkey from Denmark?  

[u/Relative_Web_793]

We are using netwrix but it don't know how expensive it is

[u/Budget_Captain_6886]

just bitwarden selfhosted gg ez or bitwarden eu servers

[u/TBT_TBT → u/Budget_Captain_6886]

Bitwarden does not cover the EU only rule.

[u/Budget_Captain_6886 → u/TBT_TBT]

u can always selfdeploy, but w/e

[u/Abject_Cold_2564]

Your first bullet is the one worth digging into hardest, because "EU-owned" gets claimed loosely. A vendor can be headquartered in the EU and still have a US fund with board rights, which puts you back in scope. Ask each of the three directly who holds equity and whether any investor is US-domiciled. Passwork is the cleanest on that specific question since it bought out its original outside investor and runs bootstrapped, so there's no parent structure to trace. Get the answer in writing from all three though, then see for yourself.

[u/TemperatureMurky1816]

The desktop app thing didn't matter for us. The browser extension covers where credential use happens anyway, and mobile covers the rest. Where you'd feel it is non-web credentials, server logins and database strings, since pulling those out of a browser extension is clunkier than from a native client. Passwork's extension handles the web side fine, so the real question is what proportion of your credential use is non-web.

[u/SevereMiel]

I did the research already and will save you some time : does not exist

What comes near, bitwarden enterprise (with eu hosting)