Privacy policy — Passbolt

Cited by

Facts read from this source

• Registration jurisdiction Report an error

  “Our company is registered in the Grand Duchy of Luxembourg. We are therefore subject to Luxembourg and Europe legislative texts on data protection and privacy.”

• No sale of personal data Report an error

  “We will not sell, rent or loan any personal information to any third party.”

• Provider Report an error

  “We primarily use Google Cloud Platform to host our websites. The Cloud Site data is hosted in Belgium and Germany.”

• Waf cdn Report an error

  “We use CloudFlare to provide caching of our website for performance as well as an application firewall for security purpose.”

• No analytics in products or cloud Report an error

  “We do not collect analytics and advertising data in the Products or on the Cloud Site.”

• Encryption Report an error

  “We encrypt access to all of our services using SSL. We ensure encryption of communication not only between you and our servers but also internally between parts of our application.”

• E2e encrypted passwords Report an error

  “The passwords you store in Passbolt products are end-to-end encrypted, using state of the art peer-reviewed cryptographic libraries.”

• Strong authentication Report an error

  “Where possible we offer and use strong authentication mechanisms, including for example second factor authentication and anti-phishing mechanisms.”

• Vendor standards Report an error

  “We make sure all of our service providers implement industry standards and compliance instruments such as ISO27001, PCI-DSS, SOC 2.”

• International transfers Report an error

  “The European Commission has recognised the adequacy, with the GDPR, of the level of protection implemented by the United States for companies that have adhered to the Data Privacy Framework. For companies that have not adhered to the Data Privacy Framework, Standard Contractual Clauses issued by the European Commission have been put in place.”

• Rights response time Report an error

  “We can also edit/delete/get access to any personal information that we hold within 30 to 90 days of the request you make by contacting us: dpo@passbolt.com, depending if the request is complex.”

• Backup retention Report an error

  “For example terminated cloud account data will be purged from backups after 60 days.”

• Portability Report an error

  “You can also export your data from the paid version to the free version of the software, or from the cloud version to the self-hosted software product.”

• Policy last updated Report an error

  “This privacy policy was last updated on 1st of October 2026.”

• Payment handling Report an error

  “We do not have direct access to your credit card or debit card information. This information is collected in a secure iframe and processed securely directly by the third party payment processing services involved”

5 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The CISO European sovereignty
• The CISO Pricing transparency
• The Compliance Auditor European sovereignty
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The DevOps Engineer Pricing transparency
• The Identity Engineer European sovereignty
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The SME Owner European sovereignty
• The SME Owner Pricing transparency