Password managers

Bitwarden

Open source password manager with an official self-hosting option

Open sourceOpen source Ownership reviewed, controller unresolvedHigh non-EU dependency

Operational dependency warning

Relies heavily on non-European providers

Current public evidence shows 6 non-European infrastructure or email dependencies across 5 providers: Amazon Web Services and Fastly, Fastly, Google, Microsoft, Twilio SendGrid. The reviewed operational path is therefore not entirely European.

Review dependencies ↓

Bitwarden offers password vaults, passkeys, secure sharing and apps for major desktop and mobile platforms. You can use its hosted service or run the official server on infrastructure you choose. The core server is AGPL-3.0 and core clients are GPL-3.0; selected enterprise modules use a commercial source-available licence.

This listing includes the self-hosted software from US vendor Bitwarden, Inc. The vendor also offers separate US and EU cloud regions on Microsoft Azure. Choosing European infrastructure controls where your deployment runs, but does not establish European ownership of the vendor. Vaultwarden is a separate, unofficial compatible server.

Bitwarden, Inc. is a Delaware corporation, file 7654941, incorporated on 28 October 2019, with a published address at 1 N. Calle Cesar Chavez, Suite 102, Santa Barbara, CA 93103. Its 2022 announcement describes PSG's investment as a minority position with board participation, alongside Battery Ventures; current majority and veto rights remain undisclosed. The live Terms still define the provider as 8bit Solutions LLC and affiliates. Florida marks that legacy LLC inactive following voluntary dissolution on 23 March 2023, while Bitwarden's imprint still calls it a wholly owned subsidiary. The precise current contracting entity needs clarification. US federal and California law and California courts are stated, subject to applicable law.

Pricing

A free personal plan is available. Published USD prices with annual billing, excluding tax: Premium $19.80/year; Families $47.88/year for up to six people; Teams $4/user/month; Enterprise $6/user/month. Self-hosting is free, but paid features require a licence from an active cloud subscription. Secrets Manager is a separate product with separate pricing.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Core service hosting

Microsoft Azure (official Bitwarden cloud)

Non-European provider
Observed
Bitwarden says cloud vault data is stored on Azure in the US or EU, with separate account regions. Exact Azure region identifiers are not disclosed in the reviewed pages. The published database PITR policy is seven days with no long-term retention; attachments and Send files are outside PITR. This does not describe self-hosted installations.

Why this matters

Reviewed evidence places Microsoft Azure (official Bitwarden cloud) in the core service path, so customer data may be processed under non-European control. Check the cited source for the documented region and scope.

Core service hosting

Customer-selected infrastructure (self-hosted deployment)

Provider control not verified
Observed
The operator chooses the self-hosted server, storage, backups and SMTP provider. Standard deployments make outbound connections for updates, push and optional sponsorship sync; official offline deployment guides are available. Self-hosting does not change the software vendor's ownership.

Public website

Fastly

Non-European provider
Observed
Google Public DNS on 16 September 2026: bitwarden.com A 151.101.1.91, 151.101.65.91, 151.101.129.91, 151.101.193.91; vault.bitwarden.com CNAME mbz100.bitwarden.map.fastly.net; vault.bitwarden.eu CNAME dualstack.n.sni.us-eu.fastly.net. These are front-door observations, not proof of vault origin or storage location.

Why this matters

Public DNS routes website visits through Fastly. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Supporting services

Amazon Web Services and Fastly

US-controlled cloud
Observed
The first-party subprocessor table lists both as hosting infrastructure in the USA. It does not assign them to vault databases; the separate data-storage documentation identifies Azure for cloud vault data.

Why this matters

The published disclosure lists Amazon Web Services and Fastly for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 alt3.aspmx.l.google.com · 10 alt4.aspmx.l.google.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Authorised outbound email

Braintree, Google, Amazon SES, Freshworks and HubSpot

US-controlled cloud
Observed
Live SPF includes spf.braintreegateway.com, _spf.google.com, amazonses.com, _spf.freshsales.io and 22371289.spf07.hubspotemail.net. These are authorisations to send for the domain, not proof of every actual mail flow, tenant region or storage location.

Why this matters

This domain authorises Braintree, Google, Amazon SES, Freshworks and HubSpot, infrastructure under US ultimate ownership, to send email. If active, recipient details and message content can be processed there. SPF does not prove active use, the selected AWS region, or use of the separately operated AWS European Sovereign Cloud.

Customer email delivery

Twilio SendGrid

Non-European provider
Observed
Named as an email service provider in the USA. A self-hosted operator configures its own SMTP service; the vendor's subprocessor list does not prescribe that SMTP provider.

Why this matters

The service documents Twilio SendGrid for customer email delivery. When selected, message content and recipient details can pass through this non-European provider. The cited source explains the configuration and location.

Message delivery channel

Bitwarden push relay

Provider control not verified
Observed
Self-hosted servers use the Bitwarden push relay by default; an EU relay, own relay or disabling push are documented options. Bitwarden records the installation ID and timestamp of the most recent relay connection. The vendor's ultimate control remains unresolved.

Supporting services

Bitwarden licence and update services

Provider control not verified
Observed
Self-hosting is free, with paid features unlocked by a licence file from an active cloud subscription. Standard deployments connect for updates and selected cloud features; offline operation and manual licensing are documented options. This dependency is separate from storage chosen by the operator.

Payment processing

Stripe, PayPal/Braintree and BitPay

Provider control not verified
Observed
The first-party table lists these payment providers in the USA. Their role concerns payments; no inference is made that they receive decrypted vault contents. This review does not establish ultimate control of every private provider in this group.

Supporting services

Datadog; Google, Slack, Freshworks and other business tools

Provider control not verified
Observed
Datadog is listed for infrastructure monitoring in USA/EU. Google and Slack provide communication/collaboration; Freshworks is CRM. Further listed tools include HubSpot, Outreach, Nooks, 6Sense, LinkedIn, Zapier, Lusha and Rillet, with USA locations. Applicability depends on deployment and data category.

Supporting services

ChartMogul CMTDE GmbH & Co. KG

Provider control not verified
Observed
Listed for sales analytics in Germany. A German processing location or legal entity does not by itself establish ultimate European ownership.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More in Password managers

View all →