Encryption model & independent audits — found from sitemap — Bitwarden

Cited by

Facts read from this source

• Encryption Report an error

  “End-to-end encryption: Lock your passwords and private information with end-to-end AES-CBC 256 bit encryption with HMAC authentication, salted hashing, and Key Derivation Functions such as PBKDF2 SHA-256 or Argon2id.”

• Zero knowledge Report an error

  “Zero knowledge encryption: Bitwarden team members cannot see your passwords. Your data remains end-to-end encrypted with your individual email and master password. Bitwarden never stores and cannot access your master password or your cryptographic keys.”

• Open source Report an error

  “The source code for all Bitwarden software products is hosted on GitHub and we welcome everyone to review, audit, and contribute to the Bitwarden codebase.”

• Vulnerability disclosure Report an error

  “the Bitwarden Vulnerability Disclosure Program enlists the help of the hacker community at HackerOne to make Bitwarden more secure.”

• Audit frequency Report an error

  “Third-party security reviews and assessments of applications and/or the platform are performed at a minimum of once per year.”

• Regulations Report an error

  “Bitwarden complies with AICPA SOC2 Type 2 / Data Privacy Framework, GDPR, and CCPA regulations.”

• Certifications Report an error

  “Bitwarden certifications include: SOC2 Type II (renewed annually) SOC3 (renewed annually) ISO 27001”

• ISMS Report an error

  “The Bitwarden Security and Compliance Program is based on the ISO27001 Information Security Management System (ISMS).”

• Hibp integration Report an error

  “the option to check known data breaches for the master password using an integration with Have I Been Pwned (HIBP)”

• Alternative login Report an error

  “Log in with device: Initiate an authentication request from a Bitwarden client and complete authentication by approving the request on a device you're already logged in to.”

• Passkey login Report an error

  “Log in with passkeys: Use a passkey to log in to a Bitwarden client and, if the passkey is PRF-capable, use it to decrypt your vault data.”

• SSO trusted devices Report an error

  “SSO with trusted devices: SSO with trusted devices allows users to authenticate using SSO and decrypt their vault using a device-stored encryption key, eliminating the need to enter a master password.”

• Twofactor Report an error

  “Two-step login (also called "two-factor authentication" or "2FA") is an extra layer of security for online accounts, designed to protect access to Bitwarden even if someone has the master password.”

• Recovery code Report an error

  “Bitwarden provides users a recovery code that they can use to turn off two-step login in the event a secondary device is lost”

• Emergency access Report an error

  “Premium users, including members of paid organizations (Families, Teams, or Enterprise) can designate trusted emergency contacts who may request access to their vault in cases of emergency.”

• Account recovery Report an error

  “Account recovery allows designated administrators of Enterprise organizations to recover member accounts and restore access in the event that an employee forgets their master password.”

• Kdf iterations Report an error

  “Bitwarden uses Password-Based Key Derivation Function 2 (PBKDF2) with 600,000 iteration rounds to stretch the user's master password with a salt of the user's email address.”

• Argon2id option Report an error

  “users may elect to change their key derivation function to Argon2id after the account has been created”

• Master password hash Report an error

  “the Master Password Hash is hashed again using PBKDF2-SHA256 with a random salt and 600,000 iterations”

• Key rotation Report an error

  “During a password change operation, users have the option to rotate (i.e. change) their User Symmetric Key (referred to as "account encryption key" in-product).”

• Organizations Report an error

  “In order to enable sharing, you need to first create an organization. A Bitwarden organization is an entity that relates users together that want to share items.”

• Access controls Report an error

  “Bitwarden organizations use collections, projects, and groups to logically group together vault data and users”

• Event logs Report an error

  “Event logs are available for Teams and Enterprise organizations for both Password Manager and Secrets Manager.”

• Siem Report an error

  “Several Security Information and Event Management (SIEM) integrations are available for Bitwarden: Splunk Panther Elastic”

• Vault health reports Report an error

  “Reports, for example the Reused Passwords and Weak Passwords reports, are run locally on the Bitwarden client application.”

• Tls Report an error

  “Bitwarden uses TLS/SSL to secure communications between Bitwarden clients and user devices to the Bitwarden cloud.”

• Hsts Report an error

  “Bitwarden also implements HTTP Security headers such as HTTP Strict Transport Security (HSTS), which will force all connections to use TLS.”

• Provider Report an error

  “Bitwarden processes and stores all data securely in the Microsoft Azure cloud using services that are managed by the team at Microsoft, including Azure Kubernetes Services (AKS).”

• Encryption at rest Report an error

  “It is configured with an encryption-at-rest technology provided by Azure called Transparent Data Encryption (TDE). TDE performs real-time encryption and decryption of the entire Bitwarden cloud database”

• Column encryption Report an error

  “Bitwarden server applications perform their own encryption of sensitive database columns related to your user account.”

• Retention Report an error

  “We retain Administrative Data for as long as you are a customer of Bitwarden and as required by law. If you terminate your relationship with Bitwarden, we will delete your Personal Information in accordance with our data retention policies.”

• Code scanning Report an error

  “Bitwarden source code is scanned by the following set of tools whenever a push is made to any branch in any Bitwarden repository: SonarQube”

• Threat prevention Report an error

  “Bitwarden performs continuous security monitoring of our networks, assets, data, and services leveraging services and tools including but not limited to Security Information Event Management (SIEM), established Security Operations Center (SOC), Vulnerability Management, Data Loss Prevention (DLP), and Endpoint Detection and Response (EDR).”

• Waf cdn Report an error

  “Bitwarden uses Content Delivery Network (CDN) services in order to provide Web Application Firewalls (WAF) at the edge, better DDoS protection, distributed availability, and caching.”

• Business continuity Report an error

  “Bitwarden employs a full range of disaster recovery and business continuity practices from Microsoft Azure that are built into the Bitwarden cloud.”

• Incident response Report an error

  “Bitwarden maintains a Security Incident Response policy and plan which is designed to minimize the overall impact of cyber incidents”

• Secrets manager Report an error

  “Bitwarden Secrets Manager empowers developers, DevOps, and IT teams to store, share, and automate machine secrets like authentication keys, database passwords, and API keys.”

• Passwordless dev Report an error

  “Bitwarden Passwordless.dev provides APIs and tools needed for developers to implement FIDO2 WebAuthn based passkey authentication”

• Public API Report an error

  “Teams and Enterprise organizations may also use the Bitwarden public API to gather more data for their event logs.”

• Passkey algorithm Report an error

  “Passkeys, stored in the vault are generated using the ES256 algorithm.”

Scores citing this record

• The CISO Encryption model & independent audits
• The CISO Sharing, roles & recovery
• The CISO SSO, directory sync & provisioning
• The CISO Audit logs, policies & reporting
• The CISO European sovereignty
• The CISO Encryption model & independent audits
• The CISO Sharing, roles & recovery
• The CISO SSO, directory sync & provisioning
• The CISO Audit logs, policies & reporting
• The CISO European sovereignty
• The Compliance Auditor Encryption model & independent audits
• The Compliance Auditor Sharing, roles & recovery
• The Compliance Auditor SSO, directory sync & provisioning
• The Compliance Auditor Audit logs, policies & reporting
• The Compliance Auditor Hosting choice, offline access & export
• The Compliance Auditor European sovereignty
• The Compliance Auditor Encryption model & independent audits
• The Compliance Auditor Sharing, roles & recovery
• The Compliance Auditor SSO, directory sync & provisioning
• The Compliance Auditor Audit logs, policies & reporting
• The Compliance Auditor European sovereignty
• The Compliance Auditor Pricing transparency
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer Sharing, roles & recovery
• The DevOps Engineer SSO, directory sync & provisioning
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer Sharing, roles & recovery
• The DevOps Engineer SSO, directory sync & provisioning
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer Sharing, roles & recovery
• The Identity Engineer SSO, directory sync & provisioning
• The Identity Engineer Audit logs, policies & reporting
• The Identity Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer Sharing, roles & recovery
• The Identity Engineer SSO, directory sync & provisioning
• The Identity Engineer Audit logs, policies & reporting
• The Identity Engineer European sovereignty
• The Skeptic Encryption model & independent audits
• The Skeptic Sharing, roles & recovery
• The Skeptic SSO, directory sync & provisioning
• The Skeptic Audit logs, policies & reporting
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The Skeptic Pricing transparency
• The Skeptic Encryption model & independent audits
• The Skeptic Sharing, roles & recovery
• The Skeptic SSO, directory sync & provisioning
• The Skeptic Audit logs, policies & reporting
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The Skeptic Pricing transparency
• The SME Owner Encryption model & independent audits
• The SME Owner Sharing, roles & recovery
• The SME Owner European sovereignty
• The SME Owner Encryption model & independent audits
• The SME Owner Sharing, roles & recovery
• The SME Owner SSO, directory sync & provisioning
• The SME Owner Audit logs, policies & reporting
• The SME Owner European sovereignty