Bitwarden
Password manager · bitwarden.com · last read 2026-10-12
Identity
| Legal entity | 8bit Solutions LLC |
|---|---|
| HQ | — |
| Parent company | Bitwarden Inc. |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | bitwarden.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | bitwarden.com | 2026-10-08 |
EU: Customers choose the EU region from a server dropdown when they create their account or organization. The document does not name a plan or a cost for it.
Subprocessor chain
20 third parties · 19 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| 6Sense Insights, Inc. | US | Account-based marketing |
| Amazon Web Services, Inc. | US | Hosting infrastructure |
| BitPay, Inc. | US | Payment processing |
| ChartMogul CMTDE GmbH & Co. KG | DE | Sales analytics |
| Datadog, Inc. | US, EU | Infrastructure monitoring |
| Fastly, Inc. | US | Hosting infrastructure |
| Freshworks, Inc. | US | Customer relationship management |
| GNAU, Inc. d/b/a Rillet | US | Finance analytics |
| Google, LLC | US | Communication tools |
| Hubspot, Inc. | US | Communication tools |
| LinkedIn Corporation | US | Business development/Communication tool |
| Lusha Systems Inc. | US | Sales intelligence |
| Microsoft Corporation | US, EU | Hosting infrastructure |
| Nooks Communications, Inc. | US | Communication tools |
| Outreach Corporation | US | Communication tools |
| Paypal, Inc. including Braintree division | US | Payment processing, Payment gateway |
| Slack Technologies, Inc. | US | Collaboration tool |
| Stripe, Inc. | US | Payment processing |
| Twilio, Inc. (SendGrid) | US | Email service provider |
| Zapier, Inc. | US | Workflow automation |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
No data processing agreement read yet.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | bitwarden.com | 2026-10-08 |
| CPRA · CCPA | Claimed | — | bitwarden.com | 2026-10-08 |
| Data Privacy Framework (DPF) · DPF | Claimed | — | bitwarden.com | 2026-10-08 |
| GDPR | Claimed | — | bitwarden.com | 2026-10-08 |
| HIPAA | Claimed | undergoes annual third-party audits for HIPAA Security Rule compliance | bitwarden.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | in compliance with ISO 27001 control sets surrounding data security | bitwarden.com | 2026-10-08 |
| EU Standard Contractual Clauses (SCCs) | Claimed | — | bitwarden.com | 2026-10-08 |
| SOC2 Type II · SOC2T2 | Available on request | — | bitwarden.com | 2026-10-08 |
| SOC3 | Certificate published | — | bitwarden.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Bitwarden Inc. | Active | non-HR data | 2027-02-04 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Bitwarden Inc. | Active | non-HR data | 2027-02-04 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Bitwarden Inc. | Active | non-HR data | 2027-02-04 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under 8bit Solutions LLC; Bitwarden
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under 8bit Solutions LLC; Bitwarden
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under 8bit Solutions LLC; Bitwarden
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under 8bit Solutions LLC; Bitwarden
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under 8bit Solutions LLC; Bitwarden
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under 8bit Solutions LLC; Bitwarden
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Bitwarden clients | — | Not declared | unknown | bitwarden.com | 2026-10-11 |
| Bitwarden self-hosted server | — | Not declared | unknown | bitwarden.com | 2026-10-11 |
Vulnerability reporting: bitwarden.com (security.txt, expires 2026-11-30; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.