Bitwarden

The Skeptic

The published security whitepaper names the design in full — AES-CBC 256-bit with HMAC-SHA256 integrity, PBKDF2 stretched to 600,000 iterations or Argon2id as an option, RSA-OAEP for sharing — and open-source clients plus a HackerOne-run disclosure program allow outside inspection. We found no public information on any independent audit or certification with a firm and date, any published penetration test, any statement of which fields remain unencrypted, or any disclosed incident history. An incident-response policy is not a disclosure, and a silent incident record is an answer in itself. 5 6 13

Report an error

The Skeptic

Collections, projects, groups and per-collection permissions are documented, and account recovery states its key model plainly — the member's encryption key is wrapped with the organization's public key, the old master password is never visible to anyone, and enrollments, resets and withdrawals are all logged — an organization-held key rather than a vendor backdoor. We found no public information on a waiting period for emergency access, on one-time or time-limited external sharing, on hiding a password while autofill remains allowed, or on approval workflows. Solidly above the base, short of the governed-and-provable tier. 6 7 8 7

Report an error

The Skeptic

The SSO key model is spelled out: authentication is decoupled from decryption, the identity provider is stated never to hold the decryption key, and members unlock via master password, trusted devices or a self-hosted key connector — with the customer able to run their own key server. SCIM, a directory connector and just-in-time provisioning are documented, and a PRF-capable passkey can both log in and decrypt the vault. We found no public information on named identity providers, hardware-key two-step methods, automatic suspension on deprovisioning, or independent review of the key model, which stops this one step short of the top. 6 9 10 13

Report an error

The Skeptic

Over sixty event types for Teams and Enterprise, exportable as CSV or through the public API, feeding six named SIEM platforms, with retention stated as indefinite and a 367-day viewable window — that is a real audit trail. The enforceable policy set is broad: master password requirements, required two-step login, export and PIN removal, autofill behaviour, session timeout. We found no public information on compliance reporting aligned to ISO 27001 or NIS2, on tamper-evident log storage, alerting on anomalous access, or an auditor role separated from access to secrets. 6 11 12 13

Report an error

The Skeptic

Cloud on Azure with storage stated for the EEA and the United States, plus self-hosting documented for Windows, Linux, Docker and Kubernetes with a Helm chart and both standard and lite deployments — the deployment story is genuinely two-track. Export is close to full fidelity: encrypted JSON, a ZIP including attachments, decrypted locally, portable to any Bitwarden account or to another app over the FIDO credential exchange protocol. We found no public information on offline read access during an outage, a status page with incident history, import from named competitors, or a stated procedure if the vendor ends the service. 3 6 13 14

Report an error

The Skeptic

The captured pages state that Bitwarden and its subprocessors store information primarily in the EEA and the United States on Microsoft Azure, while the vendor's own captured pages do not confirm the contracting entity's jurisdiction, ownership, or a subprocessor list with locations; the provenance line records a Delaware incorporation, putting the contracting chain outside the EU. We found no public information on a data-processing agreement covering vault metadata and logs. Open-source code and a self-hosting option that removes the vendor from the data path are the only sovereign pieces; the cloud chain is US-anchored and unverified. 3 6 13

Report an error

The Skeptic

The captured pricing page lists features — unlimited devices, free sharing with another user, Send, an MSP program — and the help pages place business features in tiers (event logs on Teams and Enterprise, policies and account recovery on Enterprise), but we found no public price figures at all: no per-user cost, no seat minimum, no term, no VAT treatment. Without a single number, a buyer can derive no invoice from these pages; this sits below the level of a stated starting price. 2 6 8 11

Report an error