Password Management
Dashlane
EU origin, foreign-owned Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Dashlane SAS · www.dashlane.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Dashlane at a glance
- Vendor
- Dashlane SAS
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Dashlane 2/5, the mean of 6 judges. Dashlane, a password manager from Dashlane SAS in Paris whose group is headquartered in New York, deploys through a browser extension. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Dashlane, a password manager from Dashlane SAS in Paris whose group is headquartered in New York, deploys through a browser extension. The scoring favors cryptography and identity: security architecture, identity integration and audit and policy are the strongest bands — 5 to 7, 5 to 7 and 6 to 7 — on named algorithms (AES256-CBC-HMAC, Argon2d with stated parameters, a separate 40-byte device key), annual independent penetration testing shared through a public Trust Center, SSO with Azure, Okta and Google Workspace over SAML 2.0 with SCIM-driven provisioning and deprovisioning, and telemetry into five named SIEM platforms with CLI and REST API access. The weak bands are structural: deployment and portability scores 1 to 2, sharing and access control sits at 3 with no spread, and sovereignty and pricing transparency spread 1 to 3, with judges crediting the published commercial terms at the top and those weighing absent price figures and unnamed subcontractors at the bottom. We found no per-user or tier price in the captured pages; the enterprise package is tailored with dedicated account management.
Speaks for it
- Publishes concrete cryptography — AES256-CBC-HMAC, Argon2d with stated parameters, and a separate 40-byte device key
- Documents SSO with Azure, Okta and Google Workspace over SAML 2.0, SCIM-driven provisioning and deprovisioning, and a Confidential SSO vault unlock with no master password required
- Streams telemetry natively into five named SIEM platforms — CrowdStrike, Datadog, Microsoft Sentinel, Panther and Splunk — with CLI and REST API access for custom pipelines
- Reports annual independent penetration testing with results shared publicly through the Trust Center, and an Intigriti bug bounty under a CISA-aligned disclosure policy
- States that admin activity logs are encrypted end-to-end and zero-knowledge, and that Dashlane cannot access decrypted data under any circumstances
Held against it
- We found no per-user or tier price in the captured pages; the enterprise package is described as tailored with dedicated account management
- Deployment is documented as a browser extension with a 99.9% monthly availability figure the terms call a performance target rather than a warranty, and we found no public information on self-hosting, offline access, or an export and import path
- We found no public information on sharing roles or permission levels, admin account recovery, emergency access, or what happens to a departing employee's shared items
- The terms confirm third-party providers are used without naming them, and the group is headquartered in New York while Dashlane SAS in Paris contracts with Eurozone business clients
- We found no public information on which fields remain unencrypted, on incident history, or on log retention, and the captured pages give different figures for the bug bounty platform (HackerOne and Intigriti)
Best for
- You run Azure, Okta or Google Workspace and want employees unlocking the vault with their SSO credential, with SCIM-driven provisioning and deprovisioning
- Your security team works in Microsoft Sentinel, Splunk, Datadog, Panther or CrowdStrike and wants credential-risk telemetry with CLI and REST API pipelines inside them
- You select vendors primarily on documented cryptography and public security-testing disclosures before commercial detail
Avoid if
- You need a self-hosted or on-premises vault, or documented offline access during a vendor outage — the captured delivery path is the browser extension on the vendor's cloud service
- You must compute your annual invoice from public per-user prices before a sales conversation — the pricing page shows plan columns and a 14-day trial but no price figures, and the top package is tailored on contact
- Your procurement requires a named subprocessor list or documented data residency — the terms confirm third-party providers are used without naming them
- You need written sharing roles, admin recovery and emergency-access mechanics before moving team credentials in — the captured pages show secure credential sharing as a feature line with no detail
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 3 of 5 |
| Sharing, roles & recovery | 1.5 of 5 |
| SSO, directory sync & provisioning | 3.5 of 5 |
| Audit logs, policies & reporting | 3 of 5 |
| Hosting choice, offline access & export | 0.5 of 5 |
| European sovereignty | 1 of 5 |
| Pricing transparency | 1 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Security described in adjectives ("bank-grade", "military encryption") with no architecture, no audit and no statement of what the vendor can read.
3 — Encryption algorithms named and "zero knowledge" claimed, but no whitepaper, no statement of which fields stay unencrypted, and audits mentioned without dates, auditors or results.
5 — A published security whitepaper naming algorithms, key derivation and the client-side encryption model, a stated list of what is and is not encrypted (including URLs and metadata), and a named independent audit or certification (ISO 27001, SOC 2) with its date.
8 — Recurring independent penetration tests or code audits with reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
The security page names the algorithms, Argon2d with its parameters, a separate 40-byte device key and a public Intigriti bounty with rewards and a CISA-aligned disclosure policy, which is more than adjectives. But I found no public statement of which fields are and are not encrypted, no audit carrying a named firm and a date — only an assertion of annual independent penetration testing and a trust-center reference — and no written incident history; the captured pages also give different figures for the bug bounty platform (HackerOne in one place, Intigriti in another). On breach day I would be showing the board claims, not reports. 4 6 7
The Identity Engineer
Named algorithms and full key-derivation parameters (AES256-CBC-HMAC, Argon2d with iterations and memory cost) plus a separate 40-byte device key requiring explicit user verification are published, and annual independent penetration testing with results shared through a public Trust Center, alongside a rewarded bug bounty under a CISA-aligned disclosure policy, reaches well above the middle band. We found no public information on which fields stay unencrypted, any ISO 27001 or SOC 2 certification with its date, disclosed incident history, or reviewable open-source clients, and the captured pages give different names for the bug-bounty platform (HackerOne and Intigriti). 6 7 4
The Compliance Auditor
The security pages name concrete primitives — AES-256 in CBC-HMAC mode, Argon2d password stretching, a 40-byte device key separate from the vault key — and report annual independent penetration testing with results published through a public Trust Center, backed by an Intigriti bug bounty with a CISA-aligned disclosure policy. We found no public information on which fields such as URLs and metadata remain unencrypted, no dated ISO 27001 or SOC 2 certification, no documented incident history, and no open-source clients that could be independently reviewed. 6 7
The SME Owner
The security pages name real architecture — AES256-CBC-HMAC, Argon2d with iteration and memory parameters, and a separate 40-byte device key — plus annual independent penetration testing whose results are said to be shared publicly through a Trust Center and a paid bug bounty on Intigriti with a disclosure policy aligned to CISA practice. I found no public information naming the auditor with dates, listing which fields stay unencrypted, or documenting any past incidents, so I stop below the top band. 4 6 7
The DevOps Engineer
The security pages name concrete cryptography — AES-256 in CBC-HMAC mode, Argon2d stretching with parameters, a 40-byte device key kept separate from the vault key — alongside annual independent penetration testing with results shared publicly through a trust center and a public bug bounty with a CISA-aligned disclosure policy (the captured pages give different figures for the platform running the bounty). I found no public information on which fields stay unencrypted, on open-source clients I could read myself, or on disclosed incident history, which keeps this below the top band. 4 6 7
The Skeptic
The security page names real cryptography — AES256-CBC-HMAC, Argon2d with stated parameters, a separate 40-byte device key — which is more than adjectives. But we found no public information on which fields remain unencrypted, on a named auditor or dated report behind the claimed independent annual penetration testing, and on incident history; the captured pages also give different platforms for the bug bounty. 4 6 7
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — Personal vaults only, or sharing by sending a password to another user with no permissions and no record.
3 — Shared folders with all-or-nothing access, no roles, and no stated process for recovering an account or reclaiming credentials from a departing employee.
5 — Shared vaults or collections with read, edit and manage permissions, groups and admin roles, an admin recovery mechanism documented with its key model, and offboarding that transfers a leaver's shared items.
8 — Granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Sharing is sold as a feature line — securely sharing workforce passwords and configurable admin vault policies — with nothing captured on permission granularity, view-only or time-limited access, or a documented recovery and emergency-access mechanism with its key model. Deprovisioning is automated through the identity provider, but I found no public information on what happens to a departing employee's shared items. Until that is written down, offboarding is a procedure the customer has to invent. 2 4 8
The Identity Engineer
Secure credential sharing and configurable admin vault policies are named as features and license reallocation between users is documented in the terms, but nothing shows permission granularity, groups or roles, admin account recovery, emergency access, or what happens to a departing employee's shared items. As the person who owns joiner-mover-leaver, I found no public information on the offboarding and recovery mechanics this criterion needs. 2 11 4
The Compliance Auditor
Secure credential sharing and configurable admin vault policies are shown as capabilities, but the pages give no detail on roles, read-only or time-limited grants, or approval workflows. We found no public information on an admin account recovery mechanism, emergency access, or what happens to a leaver's shared items — exactly the joiner-mover-leaver trail an auditor has to evidence. 2 11
The SME Owner
Secure credential sharing is advertised as a workforce feature and licenses can be re-allocated from one user to another, but I found no public information on permission levels, roles, admin account recovery, emergency access, or what happens to a leaver's shared items. Automated deprovisioning through the identity provider is documented, yet the reclaim-the-credentials-when-someone-walks process — the whole reason I'm leaving Excel — is not evidenced. 2 4 8
The DevOps Engineer
Secure credential sharing and configurable admin vault policies are confirmed, and the terms require every user to hold their own account. Beyond that I found no public information on shared collections with read, edit or manage permissions, on admin account recovery or emergency access, or on what happens to a leaver's shared items — only that directory-based deprovisioning is automated. 2 4 8 11
The Skeptic
Secure credential sharing and admin vault policies appear as feature names on the pricing page, and that is the substance of what is captured. We found no public information on roles, view-only or time-limited sharing, an admin recovery mechanism and its key model, or what happens to a leaver's shared items. 2 11
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — Each user creates an account by email; no SSO, no directory sync and no MFA beyond an app code.
3 — SSO available only to sign in to the admin console or on the top tier with no description of how the vault is then decrypted, and users provisioned by CSV invite.
5 — SSO with named identity providers (Entra ID, Okta, Google) documented with how the vault key is derived or released, SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — SSO unlock designed so the vendor cannot derive the vault key and stated so, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
SSO is documented with named providers — Azure, Okta, Google Workspace — over SAML 2.0, with SCIM-driven provisioning and deprovisioning and a described unlock flow that forwards the identity proof to confidential SSO so employees need no master password; passkeys and passwordless login are on the feature list. I found no public information on FIDO2 or hardware-key MFA, on group sync driving vault permissions, or on an explicit statement that the vendor cannot derive the vault key under SSO — the confidential-computing claim is asserted rather than cryptographically evidenced. 2 6 8
The Identity Engineer
SSO with named identity providers (Azure, Okta, Google Workspace) over SAML 2.0 is documented, the vault-unlock path is described end to end (proof of identity forwarded to Confidential SSO, no master password required), and IdP-driven provisioning and deprovisioning automation plus passkeys and passwordless login are stated. We found no public information on group sync driving vault permissions, conditional access or device policies, or FIDO2 hardware-key MFA for the vault itself, and none of the pages state whether a disabled account suspends vault and shared-item access immediately. 8 6 2 4
The Compliance Auditor
SSO with named identity providers (Azure, Okta, Google Workspace) over SAML 2.0, SCIM-driven provisioning and deprovisioning, a described unlock flow forwarding the identity proof to Confidential SSO, and passkeys with passwordless login are all documented under zero-knowledge and confidential-computing claims. We found no public information on group sync driving vault permissions, conditional access or device policies, or independent review of the SSO key model. 6 8
The SME Owner
This is the strongest story for a company my size: named providers (Azure, Okta, Google Workspace), SAML 2.0, SCIM, automated provisioning and deprovisioning, and a documented flow where the identity provider's proof of identity unlocks the vault with no master password required, protected by confidential computing so Dashlane states it cannot access the data. I found no public information on group sync driving vault permissions, conditional access or device policies, or hardware-key MFA beyond an ambiguous Yubico row on the pricing page. 2 6 8
The DevOps Engineer
Single sign-on is documented with named providers (Azure, Okta, Google Workspace), a described unlock flow where the identity proof is forwarded to confidential single sign-on so no master password is needed, automated provisioning and deprovisioning, and passkeys with passwordless login listed. I found no public information on group sync driving vault permissions, on conditional access or device policies, or on the exact key derivation behind the single sign-on unlock beyond the confidential-computing wording, so this sits mid-band. 2 6 8 9
The Skeptic
SSO with named providers (Azure, Okta, Google Workspace), SAML 2.0, SCIM and automated provisioning and deprovisioning are documented, with passkeys and passwordless login listed. The SSO unlock rests on Confidential SSO and confidential computing, and we found no public information on how the vault key is derived or released under SSO beyond that phrase, or on MFA with hardware keys. 6 8
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No audit log and no admin policies; the administrator sees a user list.
3 — A basic activity list and a password-strength score, but no exportable log, no enforceable policies, and no record of who viewed or copied a shared credential.
5 — Event logs covering logins, item access, sharing and admin changes, exportable or available through an API, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Native SIEM integration with named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
Telemetry streams natively into five named SIEM platforms with CLI and REST API access behind them, admin activity logs are encrypted end to end, and dashboards cover risk, dark-web and credential health. But I found no public information on which events are actually recorded — item access, views, sharing — on log retention, or on compliance reporting an ISO 27001 or NIS2 auditor could use; policy enforcement is named, not described. 2 6 10 11
The Identity Engineer
Telemetry streaming into five named SIEM platforms including Microsoft Sentinel, CLI and REST API access for custom pipelines, configurable admin vault policies, password policies, dark web monitoring and a risk-and-remediation health score give an administrator and an auditor real material to work with. We found no public information on log retention periods, compliance-report alignment to ISO 27001 or NIS2, or exactly which events (item access, sharing, exports) are recorded — activity logs are described as end-to-end encrypted and zero-knowledge but their contents are not enumerated. 10 11 6 2
The Compliance Auditor
Admin activity logs exist and are stated to be end-to-end encrypted, telemetry covering weak and compromised credentials, credential behaviour and admin response actions streams natively into Sentinel, Splunk, Datadog, Panther and CrowdStrike with CLI and REST for custom pipelines, and password policies plus risk dashboards are shown. We found no public information on whether individual item views and copies are logged with user and device, on log retention periods, or on compliance reports mapped to ISO 27001 or NIS2 — so the question of who saw a given credential last March cannot be answered from the public record. 2 6 10 11
The SME Owner
Admin activity logs are encrypted end-to-end and zero-knowledge, telemetry covering weak and compromised credentials and admin response actions streams into five named SIEM platforms with CLI and REST API access, and there are admin vault policies plus health scores and dark web monitoring. I found no public information on log retention, ISO 27001- or NIS2-aligned compliance reports, or exactly which policies are enforceable, so I sit below the top of this band. 2 6 10 11
The DevOps Engineer
Telemetry streams natively into five named SIEM platforms with CLI and REST API access for custom pipelines — exactly the automation I want in my own stack — plus an admin insights dashboard with an organizational health score, dark web monitoring and configurable admin vault policies. The captured pages give no log retention period, no compliance-aligned reporting and no detail on which events are actually captured, so an ISO 27001 or NIS2 audit would still be guesswork. 2 6 10 11
The Skeptic
Telemetry streams natively into five named SIEM platforms with CLI and REST API export, an insights dashboard reports health and remediation, and dark web monitoring and credential risk detection are listed. The captured telemetry is credential-risk signals and admin response actions; we found no public information on item-level access logs, the enforceable policy set for master password or MFA, or log retention. 2 6 10 11
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Cloud only in an unstated region, no offline access, and no export or an export that drops attachments and shared items.
3 — Cloud with a region named, apps for common platforms, and an export in CSV only that leaves out attachments, folders, TOTP seeds or custom fields.
5 — An EU region or self-hosted option, offline read access on desktop and mobile, clients for Windows, macOS, Linux, iOS, Android and the major browsers, and an export that covers all item types including attachments.
8 — Both EU cloud and self-hosted or on-premises deployment documented, a status page with incident history, encrypted full-fidelity export and import from named competitors, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
Everything captured is a cloud service deployed through a browser extension with a 99.9 percent monthly availability target that the terms themselves call a performance target rather than a warranty. I found no public information on cloud region choice, a self-hosted option, offline access during a vendor outage, full client coverage across operating systems, or a documented export and import path — for a vault, the exit door is not in the drawings. 2 4
The Identity Engineer
Deployment through the browser extension with admin console setup is the only delivery path evidenced, and a download page exists on the site. We found no public information on hosting region choice, a self-hosted option, offline access during a vendor outage, client coverage across operating systems and browsers, or any documented export and import path. 2 12
The Compliance Auditor
Deployment is documented as a browser extension with an admin console, and the terms describe local encryption within apps on authenticated devices. We found no public information on hosting regions, self-hosting, offline access during a vendor outage, a status page with incident history, or a documented export and import path — nothing here evidences portability or an exit route. 2 4
The SME Owner
Deployment runs through the browser extension and the cloud service carries a 99.9 percent monthly uptime target described as a performance target rather than a warranty. I found no public information on hosting region choice, a self-hosted option, offline access, client coverage beyond the browser, or any export and import path — for a buyer planning how to leave someday, that silence is the whole story. 2 4
The DevOps Engineer
What the captured pages show is a cloud service deployed through a browser extension with a 99.9 percent monthly availability target that the terms call a performance target, not a warranty. I found no public information on a self-hosted or on-premises option, on documented high availability and backup, on offline access during a vendor outage, or on a documented export — for an operator who wants the vault in his own data centre and a lossless way out, that is very little to go on. 2 4
The Skeptic
Deployment is documented as a browser extension, and the terms state a 99.9% monthly availability target while calling it a performance target and not a warranty. We found no public information on cloud region choice, self-hosting, offline access during a vendor outage, client coverage beyond the extension, or any export and import path. 2 4
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Non-EU vendor and contracting entity, hosting unstated, and subprocessors unnamed.
3 — An EU data region offered while the contracting entity and parent are non-EU without a stated safeguard, or the subprocessor list is absent.
5 — EU hosting as standard or selectable and an EU contracting entity, but the parent company or parts of the chain (support, analytics, email, client distribution) are non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
Dashlane SAS in Paris signs with Eurozone clients while the group answers to New York, and the terms confirm unnamed third-party providers with Dashlane remaining responsible for them. I found no public information on where vault data and metadata are hosted or on a subprocessor list with locations; end-to-end encryption narrows what a foreign authority could compel, but the logs, metadata and the client update channel stay in the vendor's hands and nothing captured evidences them. 4 5
The Identity Engineer
The terms confirm only that third-party providers are used with Dashlane remaining responsible for them — no named subprocessors — and we found no public information on where vault data and metadata are hosted or on the ownership chain, which keeps the whole chain dark despite a Paris contracting entity for Eurozone business clients per the legal notice. The group's New York headquarters decide the foreign-ownership badge in the provenance data. 4 5
The Compliance Auditor
Dashlane SAS in Paris contracts with Eurozone clients while the group is headquartered in New York and Dashlane USA, Inc. serves everyone else, and the terms acknowledge third-party providers while leaving Dashlane responsible for them, unnamed. We found no public information on where vault data and metadata are hosted, a published subprocessor list with locations, or a data-processing agreement covering logs and metadata. 4 5
The SME Owner
The independently sourced ownership data shows a group headquartered in New York while a Paris entity contracts with Eurozone business clients, and the terms confirm subcontractors are used without naming them or their locations. I found no public information on where vault data and metadata are hosted, any data-processing agreement covering them, or a published subprocessor list. 3 4
The DevOps Engineer
Eurozone clients contract with the Paris entity while the group is headquartered in New York, and the terms confirm unnamed third-party providers with Dashlane remaining responsible for them. I found no public information on where vault data and metadata are hosted, on a published subprocessor list, on a data processing agreement covering metadata and logs, or on any self-hosted route that removes the vendor from the data path. 4 5
The Skeptic
A Paris entity contracts with Eurozone business clients while the group is headquartered in New York, and the terms confirm subcontractors are used while leaving them unnamed. We found no public information on data residency, ownership, or a subprocessor list with locations. 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but which business features (SSO, SCIM, audit logs) sit in which tier is unclear — the invoice is unknowable.
5 — Per-user tier prices public with the main features per tier, but at least one commonly needed piece (SSO, SIEM integration, self-hosting, minimum seats) is unpriced or "on request".
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO
A pricing page exists with plan-comparison columns and a public 14-day trial, but no per-user price figure is captured anywhere, and the business offer is a tailored credential security package with dedicated account management on contact. I found no public information on seat minimums, add-on prices, or which tier carries SSO, SCIM and SIEM; the terms at least state a one-year initial term with automatic renewal and 30 days' notice. 2 4 11
The Identity Engineer
A tiered plan comparison and a 14-day free trial appear on the pricing page, but no per-user price figures appear anywhere in the captured facts, and the enterprise package is described as tailored with dedicated account management — a sales conversation. The terms give a one-year auto-renewing term with 30 days' non-renewal notice, but the real annual invoice is not computable from these pages, and we found no public information on seat minimums, add-on prices or VAT treatment. 2 4
The Compliance Auditor
A pricing page exists with a 14-day trial, package structure, support tiers and a plan comparison, and the published terms give a one-year automatically renewing term with 30 days' non-renewal notice. We found no public information on per-user prices, seat minimums or add-on prices, and the top package is a tailored conversation with dedicated account management, so an annual invoice cannot be computed in advance. 2 4
The SME Owner
The pricing page shows plan comparison columns, a 14-day free trial with immediate setup, and an enterprise package described as tailored with dedicated account management. I found no public price figures on the captured pages — no per-user price and no tier prices — so for my forty users I cannot begin to compute an annual invoice, and whether SSO sits in which tier is invisible to me. 2
The DevOps Engineer
A pricing page exists with a 14-day free trial and a plan comparison, but no per-user or tier price appears anywhere in the captured pages. The enterprise package is described as tailored with dedicated account management, and buyers are told to reach out for more information, so the real annual invoice remains a sales conversation. 2 8 11
The Skeptic
A pricing page exists with a 14-day trial and plan columns, but we found no public price of any kind — per user or per tier — while the enterprise package is described as tailored with dedicated account management and an invitation to reach out for more information. The terms do state a one-year initial term with automatic renewal and 30 days' nonrenewal notice, the only computable element of the invoice we found. 2 4 8
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Dashlane
Is Dashlane European?
Partly. whats-best.ai classifies Dashlane as EU origin, foreign-owned.
Where does Dashlane store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Dashlane have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Dashlane?
As of 21 Oct 2026, the panel rates Password Depot (3.5/5), Keeper (3/5) and Passbolt (3/5) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Dashlane alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 39 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.dashlane.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 2 Pricing page www.dashlane.com Checked 13 Oct 2026 Details →
- 3 Privacy policy www.dashlane.com Checked 13 Oct 2026 Details →
- 4 Terms of service www.dashlane.com Checked 13 Oct 2026 Details →
- 5 Legal notice www.dashlane.com Checked 13 Oct 2026 Details →
- 6 Encryption model & independent audits — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 7 Encryption model & independent audits — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 8 SSO, directory sync & provisioning — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 9 SSO, directory sync & provisioning — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 10 Audit logs, policies & reporting — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 11 Audit logs, policies & reporting — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →
- 12 Hosting choice, offline access & export — found from sitemap www.dashlane.com Checked 13 Oct 2026 Details →