# BeyondTrust Password Safe — Password Management

BeyondTrust Password Safe by BeyondTrust Corporation holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-11-03. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: BeyondTrust Corporation (https://beyondtrust.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/password-management/beyondtrust-password-safe
- Alternatives: https://whats-best.ai/software/password-management/beyondtrust-password-safe/alternatives ([markdown](https://whats-best.ai/software/password-management/beyondtrust-password-safe/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-03 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: BeyondTrust Corporation
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

BeyondTrust Password Safe scores highest on identity integration and deployment and portability, where scores cluster at 5 to 6. The captured pages document SAML single sign-on with Microsoft Entra ID named, SCIM 2.0 provisioning that revokes access immediately when a user is removed from the identity provider, and both an on-premises physical or virtual appliance and a single-tenant cloud instance on Amazon Web Services with a customer-designated region among six Tier 3 or higher data centers. Audit and policy runs 4 to 6 on uneditable session logs held up to 90 days, syslog events, and scheduled export of session logs, recordings and backups. Security architecture scores cluster at 4: certifications are named, but we found no public information on algorithms, key derivation or client-side encryption model for stored vault contents. Sovereignty sits at 3: self-hosting is the one documented lever, and no region is named as EU. Sharing and access control spreads 4 to 6: lower scores call two vault permissions thin, higher ones credit credential injection without exposing plain text. No public pricing appears in the captured documentation.

**Speaks for it:**
- SCIM 2.0 provisioning maps identity-provider groups to vault group policies and revokes access immediately when a user is removed from the identity provider
- Single sign-on is documented via SAML with Microsoft Entra ID named, alongside Kerberos, RADIUS multi-factor authentication, Active Directory and LDAP
- Both deployment paths are documented — an on-premises physical or virtual appliance and a single-tenant cloud instance on Amazon Web Services with a customer-designated region among six Tier 3 or higher data centers
- Every session is logged in an uneditable text format retained up to 90 days, with authentication and configuration changes generating syslog events
- Independent examinations are named for the hosting environment — ISO/IEC 27001 and SOC 2 Type II — including third-party penetration tests and a customer right to run their own test once per calendar year with notice

**Held against it:**
- We found no public information on the algorithms, key derivation or client-side encryption model protecting stored vault contents
- Beyond the on-premises appliance the sovereignty chain is unstated — we found no public information on the contracting entity's jurisdiction, subprocessor locations, a data-processing agreement or a named EU region
- Vault permissions number exactly two — full administration and graduated report viewing — and we found no public information on time-limited sharing, approval workflows, emergency access or admin account recovery
- The on-premises guide documents a first login with the default credentials admin and password
- The Compliance tab ships disabled until BeyondTrust Support enables it, and session data retention is documented only up to 90 days

**Best for:**
- You run Microsoft Entra ID or Active Directory and need provisioning where removing a user from the identity provider revokes vault access immediately
- You must keep the vault on your own infrastructure — the on-premises physical or virtual appliance is documented down to ports, certificates and DMZ placement
- Your auditors need per-session evidence — uneditable session logs held up to 90 days, syslog events for authentication and configuration changes, and scheduled export of session logs, recordings and backups to a file system or Microsoft SQL Server

**Avoid if:**
- You need fine-grained or time-limited vault sharing — exactly two permissions are documented, with no middle ground between administering all privileged accounts and viewing report events
- You cannot tolerate scheduled downtime — cloud upgrades leave the appliance unavailable for a short time within a three-hour maintenance window
- You expect to leave with your vault contents — the documented export covers session logs, recordings and backups, and we found no public information on export of the vault items themselves
- You require a documented European data chain — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 2.5/5 | 2/5 | 3/5 | 2.5/5 | 2/5 | 2/5 |
| SSO, directory sync & provisioning | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 |
| Audit logs, policies & reporting | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 2/5 |
| Hosting choice, offline access & export | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audits: SOC II Type 1 · SSAE 16 · SOC 1 Type II · SOC 2 Type II [S1]
- Customer pentesting: yes · once per calendar year · yes [S10]
- Data privacy framework: yes [S1]
- Hosting audits: yes · yes [S10]
- Internal testing: yes · yes [S10]
- ISO 27001: ISO/IEC 27001 · yes [S1]
- Network monitoring: yes · yes [S1]
- Pentesting vendor: yes [S10]
- Ssl enforcement: yes · yes [S1]
- Third party testing: yes · yes [S1]
- Tls versions: yes · yes · yes [S1]
- Vendor access control: yes · yes [S10]
- Vulnerability scanning: yes [S1]

**Data**
- Export integration client: session logs · recordings · backups · Windows · defined periodic schedule [S1]
- Export plugins: file system · Microsoft SQL Server [S1]

**Hosting**
- Data centers: Tier 3 or higher · 6 · yes [S1]
- Ip assignment: IP assigned randomly from regional address pool; AWS IP ranges doc referenced [S10]
- License package process: Software license package issued by BeyondTrust Technical Support, encoded with the appliance's DNS A-record and SSL certificate; required before any client software use [S9]
- Mobile client certificates: BeyondTrust mobile clients exist and need SSL root and intermediate certificates [S9]
- On prem appliance: Privileged Remote Access can be deployed on-premises as a physical or virtual B Series Appliance [S9]
- Provider: Amazon Web Services · single tenant EC2 instance [S10]

**Integrations**
- API: yes [S1]
- Ldap: yes [S1]
- SCIM API account required: SCIM API enabled on an API account [S5]
- SCIM API URL: [*host]/api/scim/v2 [S5]
- SCIM single provider limit: 1 [S5]
- SCIM version: 2.0 [S5]

**Product**
- Access method: Privileged Remote Access /login URL · Chromium-based browser [S7]
- Admin auto permissions: yes [S3]
- Administer vault permission: Allowed to Administer Vault [S3]
- Anonymization failover sync: Anonymization incomplete until sync across all nodes or backup B Series Appliances [S7]
- Anonymization job status refresh: 15 · 24 [S7]
- Anonymization requires display name: yes [S7]
- Anonymization status in session reports: yes [S7]
- Appliance requirements: Requires two power outlets, high-speed network connection, router/switch, unique static IP, private DNS A-record, SSL certificates or self-signed certificate, and software licensing package [S9]
- Auth protocols: yes · yes · yes [S1]
- Authentication sources: yes · Microsoft Active Directory [S1]
- Auto updates: yes · yes [S1]
- Automatic upgrade option: yes [S10]
- Browser requirement: Chromium-based browser required [S2]
- Cloud signin URL: app.beyondtrust.io [S3]
- Compliance reporting purpose: Detailed records of system and user activity to ensure adherence to policies and regulatory requirements [S7]
- Compliance tab disabled by default: no · BeyondTrust Support [S7]
- Credential injection: yes · yes [S1]
- Credential manager: Endpoint Credential Manager (ECM) integrates SRA with password vaults [S1]
- Csr generation: yes [S1]
- Customer data isolation: yes · no [S1]
- Default admin credentials: Default admin credentials admin/password for first login to /login interface [S9]
- Default credential access: no [S3]
- Default group policy: default group policy can be applied to all authenticating users [S5]
- Dmz deployment recommendation: yes [S9]
- Encryption access path: Storage > Encryption [S2]
- Encryption page purpose: Encryption page manages encryption of session data stored on the B Series Appliance [S2]
- Endpoint anonymization: yes · endpoint name · hostname · IP address [S7]
- Endpoint anonymization custom terms: custom search terms such as account numbers supported [S7]
- Entra domain services only: Vault only works with Entra ID Domain Services domain controllers [S6]
- Entra license requirement: yes · yes [S6]
- Entra SSO MFA: yes · yes [S6]
- Features: remote control of computers and mobile devices, chat support, skills-based routing, ITSM integration, smart collaboration, embeddable support components, reporting [S10]
- Firewall optional ports: HTTP to HTTPS redirect · 80 [S1]
- Firewall ports: all session traffic · 443 [S1]
- Group policy configuration: yes [S3]
- Ldap group mapping: LDAP groups can be mapped to teams for permissions [S1]
- Maintenance window: short, within window · 3 [S10]
- Network location options: outside firewall · DMZ · inside firewall [S9]
- Os support: Windows · Mac · Linux · mobile · laptops · desktops · servers · kiosks · point-of-sale systems · smartphones · network devices [S1]
- Outbound port 443: yes [S9]
- Physical security: man traps / air lock · badged access · securely locked cages · biometric access · securely isolated storage area · 24/7 security personnel [S1]
- Protected user rotation requirement: yes [S3]
- Rbac: yes [S10]
- Recording retention: 90 [S1]
- SCIM group policy mapping: group policies selectable by SCIM group [S5]
- SCIM provisioning: SCIM integration automates user and group provisioning [S5]
- SCIM revocation: yes [S5]
- Security features: yes · yes · yes [S10]
- Service principal delete warning: Deleting a service principal deletes all associated accounts [S6]
- Service principal fields: Domain Name · Tenant ID · Client ID · Client Secret [S6]
- Service principal validation: yes [S6]
- Session capabilities: file uploads/downloads · remote desktop control · system information · diagnostics · command line · registry editor [S1]
- Session id: 32-character GUID (LSID) [S1]
- Session logging: text-based, uneditable · 90 [S1]
- Session recording audit: yes · yes [S1]
- Shadow account import: no [S6]
- Storage encryption initial limit: 4 [S2]
- Storage encryption secret store required: yes [S2]
- Storage tab hidden azure ec2: yes · yes [S2]
- Syslog events: authentication · configuration changes · yes [S1]
- Tls encryption: All communications are encrypted via TLS with secure outbound connections between endpoints and the appliance [S9]
- User anonymization: yes · username · display name · email address [S7]
- User anonymization deletes recordings: yes [S7]
- Vault administer permission: full rights to discover, add, modify, and manage privileged accounts stored on the Appliance · Allowed to Administer Vault [S4]
- Vault entra discovery: Vault can discover and manage Microsoft Entra ID Domain Services accounts; requires a service principal defined on the Vault > Domains page [S6]
- Vault permissions count: 2 [S3]
- Vault permissions count: 2 [S4]
- Vault personal accounts without admin permission: no · yes [S4]
- Vault reports permission levels: Not Allowed · View Only His/Her Events · View All Events · Allowed to View Vault Reports [S4]
- Video recording: yes [S1]
- View vault reports levels: Not Allowed · View Only His/Her Events · View All Events [S3]

**Support**
- License request email: License package obtained by emailing FQDN, root SSL certificate segment and status page screenshot to BeyondTrust Technical Support [S9]

## Questions

### Is BeyondTrust Password Safe European?

Not determined: the vendor’s pages as captured do not say where BeyondTrust Password Safe is based.

### Where does BeyondTrust Password Safe store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does BeyondTrust Password Safe have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to BeyondTrust Password Safe?

As of 3 Nov 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Bitwarden (3.5/5)](https://whats-best.ai/software/password-management/bitwarden) and [Proton Pass (3.5/5)](https://whats-best.ai/software/password-management/proton-pass) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [BeyondTrust Password Safe alternatives](https://whats-best.ai/software/password-management/beyondtrust-password-safe/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (docs.beyondtrust.com/pra/docs/cloud-security, docs.beyondtrust.com/pra/docs/on-prem-storage-encryption, docs.beyondtrust.com/pra/docs/cloud-user-permissions, docs.beyondtrust.com/pra/docs/pf-vault-user-permissions, docs.beyondtrust.com/pra/docs/scim, docs.beyondtrust.com/pra/docs/cloud-vault-entra-id and 4 more). If the vendor publishes it somewhere else, send us the page.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Encryption model & independent audits — found from sitemap: https://docs.beyondtrust.com/pra/docs/cloud-security (checked 2026-11-03)
- [S2] Encryption model & independent audits — found from sitemap: https://docs.beyondtrust.com/pra/docs/on-prem-storage-encryption (checked 2026-11-03)
- [S3] Sharing, roles & recovery — found from sitemap: https://docs.beyondtrust.com/pra/docs/cloud-user-permissions (checked 2026-11-03)
- [S4] Sharing, roles & recovery — found from sitemap: https://docs.beyondtrust.com/pra/docs/pf-vault-user-permissions (checked 2026-11-03)
- [S5] SSO, directory sync & provisioning — found from sitemap: https://docs.beyondtrust.com/pra/docs/scim (checked 2026-11-03)
- [S6] SSO, directory sync & provisioning — found from sitemap: https://docs.beyondtrust.com/pra/docs/cloud-vault-entra-id (checked 2026-11-03)
- [S7] Audit logs, policies & reporting — found from sitemap: https://docs.beyondtrust.com/pra/docs/cloud-compliance-reports (checked 2026-11-03)
- [S8] Audit logs, policies & reporting — found from sitemap: https://docs.beyondtrust.com/pra/docs/splunk (checked 2026-11-03)
- [S9] Hosting choice, offline access & export — found from sitemap: https://docs.beyondtrust.com/pra/docs/on-prem-install (checked 2026-11-03)
- [S10] Hosting choice, offline access & export — found from sitemap: https://docs.beyondtrust.com/pra/docs/cloud-deployment-guide (checked 2026-11-03)

---

Cite as: whats-best.ai, "BeyondTrust Password Safe — Password Management", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/password-management/beyondtrust-password-safe

Corrections: https://whats-best.ai/correct/1465?target=page