What's in your vault stays yours.

Client-side encryption

Bitwarden-compatible extensions and apps encrypt your data on your device, with a key derived from your master password, before sending it to your instance. We store encrypted data that we cannot read. We do not know your master password and therefore cannot recover it, so keep it safe. Only the information the service needs to run stays readable: account email addresses, organisation and group membership, creation and modification dates, number of items.

Per-customer isolation

Each customer has its own Vaultwarden container, database, data volume, secrets and address. Instances are not directly exposed to the Internet: a shared HTTPS entry point routes each address to the matching instance. Instances in the same zone may share physical servers.

Backups

Backups are encrypted before they leave the server, with a separate repository and key for each customer, and stored in the same hosting zone as the vault. Restores are tested. When an account is closed, its backups are deleted according to the published retention period.

Hosting zone and data location

The zone you choose determines where your vault and its backups are located. Auxiliary services (payment, email delivery) are provided by subprocessors whose names and locations are published. Your vault content is never sent to the payment provider: it only receives billing information.

Hosting zones

See the list of subprocessors

Operations

Administrative access is protected by multi-factor authentication. Secrets are kept in a dedicated secrets manager. No vault content appears in our logs or metrics. Sensitive operations (creation, restore, suspension, deletion) are logged. Updates are rolled out gradually, with health checks and rollback.

Roles in your organisation

Give everyone the right level of access: owner, admin, manager or user. Owners and admins can access all collections from the admin console.