Password Management
BeyondTrust Password Safe
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by BeyondTrust Corporation · beyondtrust.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
BeyondTrust Password Safe at a glance
- Vendor
- BeyondTrust Corporation
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates BeyondTrust Password Safe 2.5/5, the mean of 6 judges. BeyondTrust Password Safe scores highest on identity integration and deployment and portability, where scores cluster at 5 to 6. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
BeyondTrust Password Safe alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
BeyondTrust Password Safe scores highest on identity integration and deployment and portability, where scores cluster at 5 to 6. The captured pages document SAML single sign-on with Microsoft Entra ID named, SCIM 2.0 provisioning that revokes access immediately when a user is removed from the identity provider, and both an on-premises physical or virtual appliance and a single-tenant cloud instance on Amazon Web Services with a customer-designated region among six Tier 3 or higher data centers. Audit and policy runs 4 to 6 on uneditable session logs held up to 90 days, syslog events, and scheduled export of session logs, recordings and backups. Security architecture scores cluster at 4: certifications are named, but we found no public information on algorithms, key derivation or client-side encryption model for stored vault contents. Sovereignty sits at 3: self-hosting is the one documented lever, and no region is named as EU. Sharing and access control spreads 4 to 6: lower scores call two vault permissions thin, higher ones credit credential injection without exposing plain text. No public pricing appears in the captured documentation.
Speaks for it
- SCIM 2.0 provisioning maps identity-provider groups to vault group policies and revokes access immediately when a user is removed from the identity provider
- Single sign-on is documented via SAML with Microsoft Entra ID named, alongside Kerberos, RADIUS multi-factor authentication, Active Directory and LDAP
- Both deployment paths are documented — an on-premises physical or virtual appliance and a single-tenant cloud instance on Amazon Web Services with a customer-designated region among six Tier 3 or higher data centers
- Every session is logged in an uneditable text format retained up to 90 days, with authentication and configuration changes generating syslog events
- Independent examinations are named for the hosting environment — ISO/IEC 27001 and SOC 2 Type II — including third-party penetration tests and a customer right to run their own test once per calendar year with notice
Held against it
- We found no public information on the algorithms, key derivation or client-side encryption model protecting stored vault contents
- Beyond the on-premises appliance the sovereignty chain is unstated — we found no public information on the contracting entity's jurisdiction, subprocessor locations, a data-processing agreement or a named EU region
- Vault permissions number exactly two — full administration and graduated report viewing — and we found no public information on time-limited sharing, approval workflows, emergency access or admin account recovery
- The on-premises guide documents a first login with the default credentials admin and password
- The Compliance tab ships disabled until BeyondTrust Support enables it, and session data retention is documented only up to 90 days
Best for
- You run Microsoft Entra ID or Active Directory and need provisioning where removing a user from the identity provider revokes vault access immediately
- You must keep the vault on your own infrastructure — the on-premises physical or virtual appliance is documented down to ports, certificates and DMZ placement
- Your auditors need per-session evidence — uneditable session logs held up to 90 days, syslog events for authentication and configuration changes, and scheduled export of session logs, recordings and backups to a file system or Microsoft SQL Server
Avoid if
- You need fine-grained or time-limited vault sharing — exactly two permissions are documented, with no middle ground between administering all privileged accounts and viewing report events
- You cannot tolerate scheduled downtime — cloud upgrades leave the appliance unavailable for a short time within a three-hour maintenance window
- You expect to leave with your vault contents — the documented export covers session logs, recordings and backups, and we found no public information on export of the vault items themselves
- You require a documented European data chain — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 2 of 5 |
| Sharing, roles & recovery | 2.5 of 5 |
| SSO, directory sync & provisioning | 3 of 5 |
| Audit logs, policies & reporting | 3 of 5 |
| Hosting choice, offline access & export | 3 of 5 |
| European sovereignty | 1.5 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Vault contents are readable by the vendor by its own description: server-side encryption with keys the vendor holds, or no encryption of stored credentials.
3 — Client-side or end-to-end encryption described with the algorithms named; key derivation, audits and the scope of what is encrypted are basic or not described.
5 — A published security whitepaper or security page naming algorithms, key derivation and the client-side encryption model, and an independent audit, penetration test or certification (ISO 27001, SOC 2) named.
8 — A stated list of which fields are and are not encrypted (including URLs and metadata), recurring independent penetration tests or code audits with dates and reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
The captured security pages name certifications — ISO 27001 and SOC 2 Type II for the hosting environment — and describe third-party penetration tests and source code review, but no auditing firm, no dates and no published results are given. Encryption of stored data is described only as appliance-managed session-data encryption through a secret store, with no algorithms, no key derivation and no statement of which fields are and are not encrypted. I found no public information on a bug bounty or a disclosed incident history. 1 2 10
The Identity Engineer
The cloud security page names ISO 27001 and SOC 2 Type 2 for the hosting environment, third parties are contracted for source-code review and penetration testing, and customers may run their own test once per calendar year with advance notice — but I found no named algorithms, key derivation or client-side encryption model for stored vault contents. What is documented is TLS in transit and, on-premises, encryption of session data with keys held in an appliance-managed secret store; on Azure or EC2 deployments the storage-encryption settings are hidden because the platform provides that encryption. I found no published audit reports with dates, no bug bounty or disclosure policy, and no incident history. 1 2 10
The Compliance Auditor
Independent examinations are documented — data-center ISO/IEC 27001 and SOC 2 attestations, third-party penetration tests and source-code review, and customer penetration tests permitted once per calendar year with notice — but the captured pages describe transport TLS and platform-managed storage encryption rather than a client-side encryption model with named algorithms, key derivation or a statement of which fields are protected; we found no public information on a bug bounty, vulnerability disclosure policy or disclosed incident history. 1 2 10 9
The SME Owner
The assurance side is real: ISO/IEC 27001 and SOC 2 Type II certifications for the hosting environment, third-party penetration tests and source-code reviews, and even customer-run penetration tests allowed once a calendar year with notice. What I cannot see is the crypto design for the passwords themselves — the pages describe TLS in transit and at-rest encryption of session data with keys held in a secret store on the appliance, with no named algorithms, no key derivation and no client-side or end-to-end model for vault contents. 1 2 10
The DevOps Engineer
The cloud security page names real examinations — SOC 2 Type 2 and ISO 27001 for the environment — plus third-party penetration tests, source-code review, and a customer's right to run their own penetration test once a calendar year with notice. The cryptography story stops at transport and appliance storage: TLS 1.2 with older versions disableable, and an encryption page managing session recordings behind a secret store. We found no public information on the algorithm or key derivation protecting stored vault credentials, published audit reports, or open-source clients I could review myself. 1 2 10
The Skeptic
Certifications are named — ISO 27001, SOC 2 Type II, plus third-party penetration tests and source-code reviews — but we found no published report, date or finding behind any of them, and no public information naming the algorithms, key derivation or client-side model protecting stored vault credentials; the encryption page we read covers session data on the appliance, with keys held in a secret store there. The on-premises guide documents a first login with the default credentials admin and password, which is exactly the kind of line breach post-mortems are written about. We found no public information on a bug bounty, a vulnerability disclosure policy, or past security incidents. 1 2 9 10
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — A personal password manager by the vendor's own description: no sharing between users is offered.
3 — Shared folders or vaults between users of one account; permission levels, admin recovery and offboarding are basic or not described.
5 — Shared vaults or collections with permission levels (for example read, edit, manage), groups and admin roles, and an admin account recovery or offboarding that keeps a leaver's shared items with the company.
8 — Recovery and offboarding documented with their key model, granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Shared vault accounts sit on the appliance behind a documented permission model — full administration rights and graduated report viewing (none, own events, all events) — with group policies, LDAP group mapping and no credential access granted by default. Credential injection without exposing plain text passwords is documented, and removal from the identity provider revokes access immediately. I found no public information on admin account recovery, emergency access, time-limited or one-time external sharing, or approval workflows. 1 3 4 5
The Identity Engineer
Vault governance rests on exactly two permissions — full administration of privileged accounts, and a reports permission with three view levels — backed by group policies, LDAP group mapping to teams, and a sensible default of no credential access for ordinary users. I found no public information on admin account recovery, emergency access, what happens to a leaver's shared items, time-limited or hide-password sharing, or approval workflows, so the granularity reads coarse for enterprise deployment. 3 4 1
The Compliance Auditor
Vault access is governed by two permissions — administer vault and view vault reports, the latter split into own-events versus all-events — with group policies, LDAP and SCIM group mapping to permissions, credential injection that uses secrets without exposing plain text, and immediate revocation when a user is removed from the identity provider. We found no public information on emergency access, approval workflows, time-limited or one-time external sharing, or an account-recovery key model. 3 4 1 5
The SME Owner
There is a genuine shared vault — privileged accounts stored centrally on the appliance, personal accounts for individuals without vault permission, admins with full rights, report-viewing in three levels, and group policies mapped from LDAP or SCIM groups — and when someone leaves, access is revoked immediately on removal from the identity provider, which answers my offboarding worry. But the permission set is thin at two vault permissions, and I found no public information on admin account recovery, emergency access or time-limited sharing. 3 4 5
The DevOps Engineer
Access to shared vault accounts is governed by exactly two permissions — full administration and report viewing at three levels — with no credential access granted by default, LDAP and SCIM groups mapped to group policies, and access revoked immediately when a user is removed from the identity provider. Default-deny plus group-driven policy is the right shape, but two coarse permissions is thin for a company vault, with no middle ground between administering everything and seeing only your own report events. We found no public information on time-limited or one-time sharing, emergency access, admin recovery, or what happens to a leaver's personal vault accounts. 1 3 4 5
The Skeptic
The vault sits inside the remote-access appliance's permission model: exactly two permissions — full administration of privileged accounts stored on the appliance, and report visibility split into own-events versus all-events — carried by group policies and by LDAP groups mapped to teams, while users without the admin permission keep only their own personal generic accounts. We found no public information on view-only or time-limited sharing, sharing with external parties, admin account recovery, emergency access, or how a leaver's personal accounts are handled. 3 4 1
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — A consumer product by the vendor's own description, with no business administration, SSO or directory connection offered.
3 — Users invited by email or CSV with two-factor authentication; SSO, directory sync and hardware keys are basic or not described.
5 — SSO with named identity providers (Entra ID, Okta, Google), SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — The SSO unlock documented with how the vault key is derived or released and designed so the vendor cannot derive it, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
SAML single sign-on, RADIUS multi-factor authentication, Kerberos, Active Directory and LDAP are documented, and SCIM 2.0 provisioning reflects identity-provider groups into group policies with immediate revocation on removal. Microsoft Entra ID is named explicitly, including its licence requirements for vault account discovery. I found no public information on the key model behind an SSO unlock, on FIDO2 or hardware keys, or on passkey support. 1 5 6
The Identity Engineer
SCIM 2.0 provisioning maps identity-provider groups to group policies that drive vault permissions, and access is revoked immediately when a user is removed from the identity provider — exactly the leaver behaviour I run Entra ID for — with Entra ID SSO and MFA documented alongside SAML, Kerberos, RADIUS and LDAP. The SSO unlock's key model is undocumented, I found no public information on FIDO2 hardware keys or passkeys for the vault, and only one SCIM provider can be configured. Vault account management works only against Entra ID Domain Services domain controllers and requires the customer to hold both an Entra ID license and an Entra ID Domain Services license — an extra Microsoft cost and constraint worth flagging. 5 6 1
The Compliance Auditor
SAML single sign-on with Kerberos, a named Microsoft Entra ID integration providing single sign-on and MFA, and SCIM 2.0 provisioning with group-driven policies and immediate revocation on deprovisioning are documented, alongside Active Directory and LDAP directories. We found no public information on how a vault key is derived or released at SSO unlock, on FIDO2 hardware keys, or on passkey support. 1 5 6
The SME Owner
Single sign-on via SAML with Microsoft Entra ID named, Active Directory and Kerberos integration, RADIUS multi-factor, and SCIM 2.0 provisioning of users and groups with immediate revocation — the joiner-leaver wiring is documented, which is what I need for a forty-person team. The pages are silent on how the vault is unlocked under SSO, and I found no public information on hardware security keys or passkeys. 1 5 6
The DevOps Engineer
Single sign-on via SAML with Microsoft Entra ID named, RADIUS multi-factor authentication, Active Directory and LDAP directory sources, and SCIM 2.0 provisioning whose groups drive vault group policies with access revoked immediately when a user is removed from the identity provider — a directory story I could wire into existing pipelines. The Entra integration carries a documented constraint worth budgeting: vault management works only with Entra ID Domain Services domain controllers and requires both an Entra ID licence and an Entra ID Domain Services licence. We found no public information on hardware security keys, passkeys, or how the vault key is derived or released behind a single sign-on unlock. 1 5 6
The Skeptic
Single sign-on is documented with SAML, Entra ID is named for SSO and MFA, and SCIM 2.0 provisioning lets group policies be selected by SCIM group with access revoked immediately when a user is removed from the identity provider — though only one SCIM provider can be configured. We found no public information on how the vault key is derived or released behind the SSO unlock, on FIDO2 or hardware security keys, or on passkey support. 1 5 6
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No administration by the vendor's own description: a personal tool with no admin console, logs or policies.
3 — An admin console with an activity list and a password health or strength report; exportable logs and enforceable policies are basic or not described.
5 — Event logs covering logins, item access, sharing and admin changes, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Logs exportable or available through an API with native SIEM integration to named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
Every session is logged — users, tools used, chat transcripts and actions — in uneditable text logs retained up to 90 days, with authentication and configuration-change events sent to a syslog server and session logs, recordings and backups exportable on a schedule through a Windows integration client or to Microsoft SQL Server. Compliance reporting of user and system activity exists, though the compliance tab is disabled until BeyondTrust Support enables it. I found no public information on enforceable master-password or MFA policies, password health or breach reports, or retention beyond the 90-day session data. 1 7
The Identity Engineer
Every session is logged in an uneditable text format covering users, tools used, chat transcripts and actions, retained up to 90 days; authentication events and configuration changes emit syslog events; session video recording and real-time monitoring are available; and compliance reporting provides detailed records of system and user activity, though that tab ships disabled until BeyondTrust Support enables it. Report visibility is tiered so a user can see only their own events while others see all. I found no public information on enforceable master-password, sharing or export policies, or on password-health and breach reports. 1 7 4
The Compliance Auditor
Session events are logged in an uneditable text format with users, tools and actions and retained up to 90 days, authentication and configuration changes emit syslog events, and a Windows integration client exports session logs, recordings and backups on a defined schedule to a file system or Microsoft SQL Server. The compliance reporting functionality is disabled by default until BeyondTrust Support enables it, and we found no public information on enforceable master-password or MFA policies, breach-monitoring reports, alerting on anomalous access, or reports aligned to ISO 27001 or NIS2. 1 7 3
The SME Owner
Every session is logged in an uneditable text log kept up to 90 days, sessions can be recorded on video with real-time monitoring, authentication and configuration changes go out as syslog events, and a Windows integration client exports logs and recordings to a file system or Microsoft SQL Server. The compliance reporting module is disabled by default until the vendor enables it on request, and I found no public information on password health or breach-monitoring reports. 1 7
The DevOps Engineer
Every session is logged as an uneditable text log held for up to 90 days, authentication and configuration changes generate syslog events, sessions can be recorded and monitored in real time, and a Windows integration client exports session logs, recordings and backups on a defined schedule — syslog is the export path my pipeline needs. Compliance reporting provides detailed records of system and user activity, though the Compliance tab ships disabled and requires a support request to enable. We found no public information on password-health or breach-monitoring reports, enforceable master-password policies, or log retention beyond the 90-day session maximum. 1 7
The Skeptic
Every session is logged as an uneditable text record with users, tools and chat transcripts for up to 90 days, and every authentication event and configuration change emits a syslog event to an external server; the compliance reporting that details system and user activity is disabled by default until BeyondTrust Support enables it. We found no public information on enforceable master password or MFA policies, on password health or breach-monitoring reports, or on retention beyond the stated 90-day maximum. 1 7
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Vault data cannot leave the product: the vendor states that no export is offered.
3 — Apps for common platforms and browsers and an export of vault items (for example CSV); hosting region, offline access and export completeness are basic or not described.
5 — Clients for Windows, macOS, iOS, Android and the major browsers, offline access to the vault, an EU region or self-hosted option, and export and import of vault data including from named competitors.
8 — Both EU cloud and self-hosted or on-premises deployment documented, Linux clients, a status page with incident history, an encrypted full-fidelity export covering all item types including attachments, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
On-premises deployment as a physical or virtual appliance is documented in detail — network placement, certificates, licensing package — while cloud instances run single-tenant on Amazon Web Services with a choice among six Tier 3 or higher regional data centres, and clients cover Windows, Mac, Linux and mobile. Documented export covers session logs, recordings and backups rather than a full-fidelity vault export. I found no public information on a status page with incident history, offline access during an outage, or a documented end-of-service access procedure. 1 9 10
The Identity Engineer
Both deployment models are documented: a single-tenant EC2 instance in Amazon Web Services with a customer-designated regional data center among six Tier 3 or higher facilities, and an on-premises physical or virtual appliance with DMZ placement guidance. Clients cover Windows, Mac, Linux and mobile, and a Windows integration client exports session logs, recordings and backups on a schedule to a file system or Microsoft SQL Server. I found no public information on a named EU region, a status page with incident history, or a full-fidelity vault export, and the cloud maintenance window leaves the appliance unavailable for a short time during upgrades. 1 9 10
The Compliance Auditor
Both deployment paths are documented — an on-premises physical or virtual appliance and a cloud instance hosted on a single-tenant Amazon EC2 instance, with a regional data center designation among six Tier 3 or higher sites — plus clients for Windows, macOS, Linux and mobile and a Chromium-based browser interface. We found no public information on a named EU region, offline vault access during a vendor outage, a status page with incident history, or export of the vault items themselves, since the documented export covers session logs, recordings and backups. 9 10 1
The SME Owner
On-premises deployment as a physical or virtual appliance is documented down to power outlets and DMZ placement, and the cloud option is a single-tenant instance on Amazon Web Services with a regional data center the customer designates, with clients for Windows, Mac, Linux and mobile. The export path I can see covers session logs, recordings and backups; I found no public information on exporting the vault contents themselves, on offline access, or on a European region. 1 9 10
The DevOps Engineer
The on-premises path is documented the way I want it: a physical or virtual appliance with network placement options, ports, certificate requirements and a licensing package, with failover and backup appliances mentioned in passing for multi-node environments. Cloud deployments run as a single-tenant EC2 instance in Amazon Web Services with a customer-designated region among six Tier 3 or higher data centres, an API is available for automation, and a Windows integration client exports session logs, recordings and backups to a file system or SQL Server on a schedule. We found no public information on documented backup and high-availability procedures, offline vault access during an outage, or a full-fidelity export of vault items, and cloud upgrades take the appliance offline briefly inside a three-hour maintenance window. 1 7 9 10
The Skeptic
On-premises deployment as a physical or virtual appliance is documented down to ports and certificates, alongside a cloud instance that is single-tenant on AWS across six Tier 3 or higher data centers with a customer-designated region, and clients cover Windows, Mac, Linux and mobile. The documented export path carries session logs, recordings and backups; we found no public information on export of the vault credentials themselves, on a named EU region, on vault access during a vendor outage — the upgrade window makes the appliance unavailable for a time — or on a status page with incident history. 1 9 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Proven non-EU on every dimension the evidence covers: non-EU vendor and contracting entity and non-EU hosting, with no EU or self-hosted option stated.
3 — One European element proven: an EU data region, an EU contracting entity or EU representative, a self-hosted option, or a published DPA, with the rest of the chain unstated.
5 — EU hosting as standard or selectable, or a self-hosted option, and an EU contracting entity or EU representative, with a DPA offered; the parent company or parts of the chain (support, analytics, email, client distribution) are unstated or non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
One European-facing element is proven: the self-hosted appliance option removes the vendor's cloud from the data path, with cloud hosting on Amazon Web Services and regional data-centre designation available, and Data Privacy Framework compliance is claimed. The captured pages give no jurisdiction for the contracting entity, no named EU region, no subprocessor list and no data-processing agreement, so the rest of the chain is unstated. 1 9 10
The Identity Engineer
The one proven element is the self-hosted option: an on-premises appliance that keeps the vendor out of the data path, alongside single-tenant AWS hosting with regional data-center designation — though no region is named as EU. Contracting entity, parent company, data residency, subprocessors and DPA are all unstated in the captured pages, so the chain beyond self-hosting cannot be assessed. 9 10 1
The Compliance Auditor
The captured pages prove a self-hosted option — an on-premises appliance deployment that removes the vendor's cloud from the data path — and cloud hosting on Amazon Web Services with a selectable regional data center, but no region is named as EU. We found no public information on the contracting entity's jurisdiction, a subprocessor list, or a data processing agreement; the vendor states Data Privacy Framework compliance. 9 10 1
The SME Owner
The one European-relevant element the pages prove is self-hosting: the product runs on your own appliance in your own network, taking the vendor's cloud out of the data path, though licensing and updates still route through the vendor's support. The rest of the chain is unstated in these captures — contracting entity and jurisdiction, data residency, subprocessors, a data protection agreement — with cloud hosting on Amazon Web Services, no European region named, and Data Privacy Framework compliance the only cross-border commitment mentioned. 1 9 10
The DevOps Engineer
The one sovereignty lever these pages prove is the on-premises appliance, which keeps the vault inside my own network; the cloud offering runs on a single-tenant EC2 instance in Amazon Web Services with a region selectable among six data centres, and the vendor cites Data Privacy Framework compliance for European data privacy. We found no public information on the contracting entity's jurisdiction, subprocessor locations, or a data-processing agreement. Sovereignty here is something I would have to build myself by self-hosting, not something the vendor documents end to end. 1 9 10
The Skeptic
Every sovereignty dimension — contracting entity, data residency, data processing agreement — is unknown on the captured pages; hosting is on AWS with a selectable region that is never named, and the stated Data Privacy Framework compliance speaks to privacy handling rather than a European chain. The one proven element is the on-premises appliance, which takes the vendor's cloud out of the data path, with the rest of the chain unstated. 1 9 10
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A public "from" price or one priced tier, per user or flat.
5 — Per-user prices public for the business tiers with the billing period stated and the main features per tier listed.
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO not rated — no public information
I found no public information on prices, tiers, seat minimums, add-ons or licence terms on the captured pages; the only cost-adjacent statements are that the update interval is chosen at purchase and that using the vault with Microsoft Entra ID requires additional Microsoft licences. No annual cost can be computed from what was captured. 1 6 10
The Identity Engineer not rated — no public information
We found no public information on pricing in the captured documentation pages — no per-user price, tier structure, seat minimum, add-on, minimum term or VAT treatment. The only cost-related fact is that using Vault with Microsoft Entra ID Domain Services requires the customer to hold both an Entra ID license and an Entra ID Domain Services license, which is a Microsoft-side cost rather than a BeyondTrust price. 6
The Compliance Auditor not rated — no public information
We found no public information on pricing transparency: the captured documentation pages state no per-user prices, tiers, seat minimums, add-ons or contract terms, and obtaining appliance licensing proceeds by requesting a license package from Technical Support rather than through a published price. 1 9 10
The SME Owner not rated — no public information
We found no public information on pricing in the captured pages: no per-user price, no tiers, no seat minimums, no minimum term, nothing an owner could turn into an annual invoice. The only licensing described is a software package that the vendor's technical support builds per appliance after you email them your details — a support conversation, not a published price. 1 2 3 4 5 6 7 8 9 10
The DevOps Engineer not rated — no public information
We found no public information on pricing: none of the captured documentation pages mentions a per-user price, tier structure, seat minimum, add-on price or minimum term. A buyer cannot compute an annual cost from these pages. 1 9 10
The Skeptic not rated — no public information
We found no public pricing information on the captured pages: no price per user, no tier or feature comparison, no seat minimum and no minimum term appears anywhere in the documentation we read, so a buyer cannot compute an annual cost from these pages alone. 1 7 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about BeyondTrust Password Safe
Is BeyondTrust Password Safe European?
Not determined: the vendor’s pages as captured do not say where BeyondTrust Password Safe is based.
Where does BeyondTrust Password Safe store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does BeyondTrust Password Safe have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to BeyondTrust Password Safe?
As of 3 Nov 2026, the panel rates Password Depot (3.5/5), Bitwarden (3.5/5) and Proton Pass (3.5/5) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: BeyondTrust Password Safe alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (docs.beyondtrust.com/pra/docs/cloud-security, docs.beyondtrust.com/pra/docs/on-prem-storage-encryption, docs.beyondtrust.com/pra/docs/cloud-user-permissions, docs.beyondtrust.com/pra/docs/pf-vault-user-permissions, docs.beyondtrust.com/pra/docs/scim, docs.beyondtrust.com/pra/docs/cloud-vault-entra-id and 4 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (10)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Encryption model & independent audits — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 2 Encryption model & independent audits — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 3 Sharing, roles & recovery — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 4 Sharing, roles & recovery — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 5 SSO, directory sync & provisioning — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 6 SSO, directory sync & provisioning — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 7 Audit logs, policies & reporting — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 8 Audit logs, policies & reporting — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 9 Hosting choice, offline access & export — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →
- 10 Hosting choice, offline access & export — found from sitemap docs.beyondtrust.com Checked 3 Nov 2026 Details →