Encryption model & independent audits — found from sitemap — Passbolt

Cited by

Facts read from this source

• ISMS Report an error

  “Passbolt SA implements an Information Security Management System (ISMS) aligned with the industry standards.”

• SOC 2 framework Report an error

  “Our Information Security Program follows the criteria set forth by the SOC 2 Framework.”

• Third party audits Report an error

  “Our organization undergoes independent third-party assessments to test our security and compliance controls.”

• Pentest annual Report an error

  “We perform an independent third-party penetration test at least annually to assess the security posture of our services.”

• Bug bounty Report an error

  “We run a bug bounty program to recognise and reward the work of independent security researchers.”

• Owasp guidelines Report an error

  “All the code produced for the core products and associated services must adhere to the OWASP guidelines and recommendation, to prevent common security issues such as cross site scripting (XSS) or SQL injections.”

• Security whitepaper Report an error

  “We publish and maintain a security white paper for the product distributed to our customers, to help them evaluate the residual risks as per their threat model.”

• Provider Report an error

  “Our cloud services are hosted in Europe with Google Cloud Platform (GCP).”

• Gcp certifications Report an error

  “They employ a robust security program with multiple certifications including ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 1, SOC 2, SOC 3, PCI DSS.”

• Database region Report an error

  “All of our data is hosted on Google Cloud Platform (GCP) databases. These databases are all located in Europe.”

• Tenant isolation Report an error

  “For the cloud product, each of the customers workspace data is logically separated in individual databases.”

• Retention deletion Report an error

  “Once they terminate their Passbolt cloud account the data are automatically deleted from our backups within 6 weeks.”

• Encryption at rest Report an error

  “All the cloud data, including the backups, is encrypted at rest using 256-bit Advanced Encryption Standard (AES) with keys stored in a secure storage system.”

• Tls in transit Report an error

  “All customer data transmitted to our servers is protected using strong encryption protocols such as TLS. We ensure encryption of communication not only between the customer and our servers but also internally between all parts of our systems.”

• Vulnerability scanning Report an error

  “We perform vulnerability scanning and actively monitor for new threats. We use static code analyser tools and software dependencies scanners to detect issues and vulnerabilities.”

• Ids Report an error

  “We use an intrusion detection system (IDS) to detect and notify in case of unauthorised access to servers.”

• Backup frequency Report an error

  “Additionally we run incremental backups every day. All backups are scheduled, encrypted, tracked and tested regularly.”

• Disaster recovery tests Report an error

  “We regularly perform disaster recovery tests with unique scenarios.”

• Export backup recommendation Report an error

  “We also recommend our customers to schedule regular backups of their data using export features.”

• Status page Report an error

  “The users can check service availability through a dedicated status page.”

• SSO 2FA Report an error

  “Where available we have Single Sign-on (SSO), 2-factor authentication (2FA) and strong password policies to ensure access to cloud services are protected.”

• Dmarc Report an error

  “For email, our DMARC policy uses SPF and DKIM to verify that messages are authentic.”

• Quarterly access reviews Report an error

  “We perform quarterly access reviews of all team members with access to sensitive systems.”

• Waf Report an error

  “We use several layers of firewalls, including a web application firewall (WAF) to detect and restrict suspicious or undesirable traffic, as well as regular firewalls to further restrict access.”

• Risk assessments annual Report an error

  “We undergo at least annual risk assessments to identify any potential threats, including considerations for fraud.”

• DPA processors list Report an error

  “As part of our Data Protection Agreement we maintain the list of approved data processors with the processors activities, type of personal data, location, implemented safeguards and data transfer mechanism.”

• Last update Report an error

  “14th of July 2026.”

• Self hosting Report an error

  “Passbolt is versatile and can be self-hosted or cloud-hosted.”

• Entity Report an error

  “Copyright © 2026 Passbolt SA. All rights reserved.”

• DPA terms available Report an error

  “Terms Data Protection Agreement Cloud customer terms”

• Background checks Report an error

  “Each employee or contractor undergoes a background check and is requested to disclose any criminal record, previous employer details and education diploma, if any.”

• Confidentiality agreement Report an error

  “All team members are required to sign and adhere to an industry standard confidentiality agreement prior to their first day of work.”

• Security training Report an error

  “All of our team members are required to go through employee security awareness training covering industry standard practices and information security topics such as phishing and password management.”

• Change management Report an error

  “Every code change is signed, tracked in a versioning system and covered by a change management policy, which requires code review by a maintainer.”

• Vendor certifications Report an error

  “We make sure all of our service providers that have access to personal data are certified according to industry security standards and compliance instruments such as ISO27001, PCI-DSS, SOC 2 that enforce strict procedures for both physical and digital security.”

Scores citing this record

• The CISO Encryption model & independent audits
• The CISO Audit logs, policies & reporting
• The CISO Hosting choice, offline access & export
• The CISO European sovereignty
• The Compliance Auditor Encryption model & independent audits
• The Compliance Auditor Hosting choice, offline access & export
• The Compliance Auditor European sovereignty
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer Hosting choice, offline access & export
• The Identity Engineer European sovereignty
• The Skeptic Encryption model & independent audits
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The SME Owner Encryption model & independent audits
• The SME Owner Hosting choice, offline access & export
• The SME Owner European sovereignty