Password Management
Devolutions Password Hub
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Devolutions Inc. · devolutions.net
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Devolutions Password Hub at a glance
- Vendor
- Devolutions Inc.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Devolutions Password Hub 2/5, the mean of 6 judges. Devolutions Password Hub, a password-management product from Devolutions Inc., scores highest on deployment and portability: self-hosting is documented in depth, with Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14 or later, high-availability or load-balancing deployment, and customer-supplied TLS certificates. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Devolutions Password Hub alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Devolutions Password Hub, a password-management product from Devolutions Inc., scores highest on deployment and portability: self-hosting is documented in depth, with Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14 or later, high-availability or load-balancing deployment, and customer-supplied TLS certificates. Sharing and access control follows at 4–6, built on vault-level roles that separate View sensitive from View password permissions; identity integration and audit and policy sit at 4–5. The weakest result is pricing transparency, scored 0, with no public information on per-user prices, tiers, seat minimums or terms anywhere captured. The bench genuinely splits on security architecture: low scores weigh the missing encryption detail — no algorithms, key derivation or independent audit are public — while higher scores credit a working disclosure programme, including a YesWeHack bounty paying up to $5,000.00 per issue (USD) for critical vulnerabilities and public advisories with CVEs across at least twelve pages. Sovereignty scores 2–3: self-hosting can remove the vendor from the data path, but residency, the contracting entity, any DPA and subprocessors are unknown, and the vendor states it was proudly founded in Québec, Canada.
Speaks for it
- Self-hosted deployment is documented in depth, with Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14 or later, high-availability or load-balancing deployment and customer-supplied TLS certificates.
- Permissions are granular at vault level, with system and vault roles bundling View sensitive, View password, Edit and Manage permissions, user-group assignment, approval workflows, and hidden fields and passwords stated to always respect permissions.
- Sign-in options are concrete — single sign-on with Microsoft Entra ID or Okta, plus physical security keys over USB, NFC on mobile and Windows Hello.
- The disclosure programme is real — a YesWeHack-hosted bounty paying up to $5,000.00 per issue (USD) for critical findings, and public advisories with IDs, CVEs, severities and fix versions across at least twelve pages.
- Administrator reporting is exportable — audit, logs and deleted-entry history, with Azure Log Analytics export, a REST API, webhooks and scheduled JSON or CSV output, plus import from Bitwarden, KeePass, LastPass, 1Password, Google Chrome and Remote Desktop Manager.
Held against it
- No public information names the encryption algorithms, key derivation or which fields are encrypted, and no independent audit or certification is claimed.
- No public information on pricing — no per-user price, tier, seat minimum, add-on or term appears on the captured pages, so no annual cost can be computed (pricing transparency scored 0).
- No public information on admin account recovery, emergency access, time-limited external sharing or what happens to a leaver's shared items.
- Sovereignty is unproven beyond self-hosting — data residency, the contracting entity's jurisdiction, any data-processing agreement and subprocessors are unknown, and the vendor states it was proudly founded in Québec, Canada.
Best for
- You run your own infrastructure and want the vault server self-hosted in Docker, on your own database, certificates and high-availability setup.
- Your team shares credentials where an entry must be usable without its password becoming visible, under approval workflows.
- You are migrating from Bitwarden, KeePass, LastPass, 1Password, Google Chrome or Remote Desktop Manager and need a documented import path with scheduled export.
- Your monitoring already centers on Azure Log Analytics and you need administrator-level audit and logs to flow into it.
Avoid if
- You must see per-user prices, tiers or seat minimums in writing before you can budget a rollout.
- Your security review requires named encryption algorithms, key-derivation details or an independent audit or certification.
- Your procurement process requires a documented contracting entity, data residency, a data-processing agreement or a subprocessor list before purchase.
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 1.5 of 5 |
| Sharing, roles & recovery | 3 of 5 |
| SSO, directory sync & provisioning | 2 of 5 |
| Audit logs, policies & reporting | 2 of 5 |
| Hosting choice, offline access & export | 3.5 of 5 |
| European sovereignty | 1.5 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Vault contents are readable by the vendor by its own description: server-side encryption with keys the vendor holds, or no encryption of stored credentials.
3 — Client-side or end-to-end encryption described with the algorithms named; key derivation, audits and the scope of what is encrypted are basic or not described.
5 — A published security whitepaper or security page naming algorithms, key derivation and the client-side encryption model, and an independent audit, penetration test or certification (ISO 27001, SOC 2) named.
8 — A stated list of which fields are and are not encrypted (including URLs and metadata), recurring independent penetration tests or code audits with dates and reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
The disclosure side is genuinely documented: a bug bounty on YesWeHack — invitation-only, up to $5,000.00 per issue (USD) for a critical — scored with CVSS 3.1, and public advisories with IDs, CVEs, fix versions and dates running to twelve-plus pages. But we found no public information naming the encryption algorithms or key derivation, stating which fields are encrypted, or evidencing any independent audit, certification, or documented incident history with impact. 4 5 13
The Identity Engineer
The security pages document a genuine disclosure programme: a bug bounty hosted on YesWeHack with published scope and CVSS scoring, researcher credit, and a public advisory feed with identifiers, CVEs, fix versions and dates running back at least twelve pages. What I could not find is the cryptographic design of the vault itself — the captured pages name no algorithms or key derivation, no independent audit, penetration test or certification is named, and the only key detail shows the self-hosted server generating its encryption keys at installation. 4 5 13
The Compliance Auditor
The captured security pages document a working disclosure programme — a bug bounty hosted on YesWeHack with published scope, rewards up to $5,000 for critical issues, and public advisories with CVE identifiers, severities, fix versions and dates across many pages. But we found no public information on the encryption model itself: no named algorithms, no key derivation, no statement of which fields are encrypted, and no independent audit, penetration test or certification named. Server-side encryption keys are generated during Devolutions Server initialisation and physical security keys are supported for sign-in, which is the extent of what the captures show. 4 5 8 13
The SME Owner
There is a serious disclosure practice here — a bug bounty hosted on YesWeHack with published scope and rewards up to $5,000 for critical issues, CVSS 3.1 scoring, and public advisories with IDs, CVEs, severities, fix versions and dates across at least twelve pages. What I cannot find anywhere captured is the vault encryption itself: no algorithm is named, no key derivation is described, no independent audit or certification appears, and the closest fact is that server initialization generates encryption keys. 4 5 13
The DevOps Engineer
The security pages show a real vulnerability-disclosure programme — a bug bounty hosted on YesWeHack with published rewards up to $5,000 for critical issues, CVSS 3.1 scoring, researcher credit, and public advisories with CVEs and fix versions stretching back over at least twelve pages. The encryption story itself is thin, though: the self-hosted server generates encryption keys at initialization, and we found no public information naming the algorithms, the key derivation, which fields are encrypted, or any independent audit or certification. 4 5 13
The Skeptic
The disclosure pipeline is real — advisories with IDs, severities, CVEs and fix versions stretching across at least twelve pages, plus a YesWeHack-hosted bounty with invitation-only enrollment and up to $5,000.00 per critical issue — but we found no public information naming the cipher, the key derivation, or which fields are encrypted on the device, and no independent audit or certification is even claimed. The self-hosted server "generates the encryption keys" at initialization, and that is the entire encryption story in the captured pages; a bounty program is not an audit. 4 5 13
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — A personal password manager by the vendor's own description: no sharing between users is offered.
3 — Shared folders or vaults between users of one account; permission levels, admin recovery and offboarding are basic or not described.
5 — Shared vaults or collections with permission levels (for example read, edit, manage), groups and admin roles, and an admin account recovery or offboarding that keeps a leaver's shared items with the company.
8 — Recovery and offboarding documented with their key model, granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Vault and system roles bundle distinct permissions — View sensitive, View password, Edit, Manage permissions — assigned through user groups at system or vault level, with the vendor stating hidden fields and passwords always respect these permissions, and approval workflows are mentioned alongside. We found no public information on admin account recovery, emergency access, time-limited or one-time sharing with external parties, or offboarding when an employee leaves. 6 10 12
The Identity Engineer
Vault-level role-based access is documented properly: roles bundling View sensitive, View password, Edit and Manage permissions, assigned through user groups at system or vault level, with hidden fields and passwords always respecting permissions and approval workflows referenced. The captured pages give no account recovery, emergency access, or key model, and say nothing about what happens to a leaver's shared items when they walk out the door. 6 12
The Compliance Auditor
Role-based permissions are documented in real detail: system and vault roles bundle View sensitive, View password, Edit and Manage permissions, roles are assigned through user groups at system or vault level, and hidden fields and passwords are stated to always respect these permissions, with approval workflows mentioned alongside detailed reports. We found no public information on admin account recovery, emergency access, what happens to shared items when an employee leaves, or time-limited sharing with external parties. 6 7 12
The SME Owner
The permissions model is more granular than I expected — system and vault roles bundling "View sensitive, View password, Edit, or Manage permissions", assigned through user groups at system or vault level, with hidden fields and passwords always respecting permissions and approval workflows mentioned. But we found no public information on admin account recovery for a forgotten master password, emergency access, or what happens to a leaver's shared items, and those are exactly my daily worries with a forty-person team. 6
The DevOps Engineer
System and vault roles bundle permissions down to "View sensitive" and "View password", assigned through user groups at vault or system level, with hidden fields and passwords respecting those permissions and approval workflows mentioned alongside detailed reports. That granularity is genuinely fine-grained — an entry can be usable without its password being visible — but we found no public information on admin account recovery, offboarding of leavers, time-limited or one-time external sharing, or emergency access. 6 7
The Skeptic
Vault-level RBAC is documented and genuinely granular: system and vault roles bundling "View sensitive, View password, Edit, or Manage permissions", assigned through user groups at system or vault level, with "Hidden fields and passwords always respect these permissions", alongside approval workflows and detailed reports. We found no public information on admin account recovery, offboarding, emergency access, or time-limited and external sharing — and what happens to a leaver's shared items is the first question I ask of any vault. 6
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — A consumer product by the vendor's own description, with no business administration, SSO or directory connection offered.
3 — Users invited by email or CSV with two-factor authentication; SSO, directory sync and hardware keys are basic or not described.
5 — SSO with named identity providers (Entra ID, Okta, Google), SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — The SSO unlock documented with how the vault key is derived or released and designed so the vendor cannot derive it, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
Single sign-on with Microsoft Entra ID or Okta is documented as an alternative to the Devolutions Account, and physical security keys — USB, NFC on mobile, and Windows Hello — are documented as a password sign-in method. We found no public information on SCIM or directory sync for joiners and leavers, on how the vault key is derived or released behind an SSO unlock, or on automated suspension on deprovisioning. 8 9
The Identity Engineer
Single sign-on with Microsoft Entra ID or Okta is documented for Devolutions Cloud users, and the hardware-key support I insist on is real — physical security keys over USB and NFC, plus Windows Hello, as sign-in methods for the Devolutions Account. But the captured pages show nothing on SCIM or directory sync, nothing on automated suspension when someone leaves, and no description of how the vault key is derived or released behind a single sign-on unlock, which is the trust question I care about most. 9 8
The Compliance Auditor
Single sign-on with Microsoft Entra ID or Okta is documented as an alternative to Devolutions Account authentication, and a physical security key — USB, NFC on mobile, or Windows Hello — can be configured as the default passwordless sign-in method for the account. We found no public information on SCIM or directory sync, on how the vault key is derived or released behind an SSO unlock, or on automated suspension when someone is deprovisioned. 8 9
The SME Owner
Single sign-on with Microsoft Entra ID or Okta is documented for cloud users instead of the vendor's own account authentication, and a physical security key can be set as the default sign-in method (USB, NFC on mobile, Windows Hello). We found no public information on directory sync or provisioning for joiners and leavers, on the key model behind the single sign-on unlock, or on other identity providers. 8 9
The DevOps Engineer
Single sign-on with Microsoft Entra ID or Okta is documented as an alternative to the vendor's own Devolutions Account authentication, and hardware-key sign-in is described in real depth — physical security keys over USB and NFC, Windows Hello, and keys that can be managed and deleted from account settings. We found no public information on directory sync or SCIM for joiners and leavers, or on how the vault key is derived or released behind the single sign-on unlock, which is the part I need to read before trusting it in my pipeline. 8 9
The Skeptic
SSO with Microsoft Entra ID or Okta is documented as an alternative to Devolutions Account authentication, and hardware keys are first-class sign-in methods — USB, NFC on mobile, Windows Hello, deletable from account settings. We found no public information on the key model behind the SSO unlock (so I cannot tell who can derive the vault key), nor on SCIM, directory sync, or automated deprovisioning. 8 9
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No administration by the vendor's own description: a personal tool with no admin console, logs or policies.
3 — An admin console with an activity list and a password health or strength report; exportable logs and enforceable policies are basic or not described.
5 — Event logs covering logins, item access, sharing and admin changes, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Logs exportable or available through an API with native SIEM integration to named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
Administrators get a reports section covering audit, logs and deleted-entry history, with non-admins given limited access, and Devolutions Server logs can be sent to Azure Log Analytics, with webhooks and REST API also available. We found no public information on enforceable master password or MFA policies, password health or breach-monitoring reports, log retention, or compliance reporting aligned to ISO 27001 or NIS2. 10 13
The Identity Engineer
Administrators get a Reports section covering audit, logs and deleted-entry history, with non-admins limited, and Devolutions Server logs can be sent to Azure Log Analytics, pulled through a REST API or pushed out by webhook. The captured pages do not enumerate which events are actually logged, and I found no enforceable policies for passwords or sharing, no password-health or breach reporting, and no stated retention. 10 13
The Compliance Auditor
Administrators get a Reports section with audit, logs and deleted-entries history, non-admin users have limited access to it, and Devolutions Server logs can be sent to Azure Log Analytics, with webhooks and REST API access alongside — a real path into Microsoft's log platform. We found no public information on which events the audit actually covers, such as item views, password reveals or sharing, nor on enforceable policies, log retention, or reports aligned to ISO 27001 or NIS2. 10 11 13
The SME Owner
Administrators get a reports section with audit, logs and deleted-entry history, non-admins see limited access, and logs can leave through a REST API, scheduled JSON or CSV exports, or straight into Azure Log Analytics. We found no public information on which events are actually logged, enforceable master-password or MFA policies, breach-monitoring reports, retention periods, or other named SIEM targets. 10 12 13
The DevOps Engineer
Administrators get a Reports section with Audit, Logs and deleted-entries history, and Devolutions Server logs can be shipped to Azure Log Analytics, with webhooks for real-time notifications out of the self-hosted instance. We found no public information on enforceable policies such as master password rules or MFA, password-health or breach-monitoring reports, log retention, or SIEM targets beyond Azure Log Analytics, so I cannot give an auditor everything they would ask for on this evidence. 10 13
The Skeptic
Administrators get a Reports section with Audit, Logs and deleted-entries history (non-admins limited), and logs can be sent to Azure Log Analytics, pulled through a REST API in a user context, or scheduled out as JSON or CSV — one named log destination is a genuine plus. We found no public information on enforceable policies for master password, MFA, sharing or export, on log retention, or on password health and breach reports, and the event coverage of the audit tool is not enumerated, so an auditor cannot tell what they would receive. 10 12 13
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Vault data cannot leave the product: the vendor states that no export is offered.
3 — Apps for common platforms and browsers and an export of vault items (for example CSV); hosting region, offline access and export completeness are basic or not described.
5 — Clients for Windows, macOS, iOS, Android and the major browsers, offline access to the vault, an EU region or self-hosted option, and export and import of vault data including from named competitors.
8 — Both EU cloud and self-hosted or on-premises deployment documented, Linux clients, a status page with incident history, an encrypted full-fidelity export covering all item types including attachments, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
Self-hosting is documented in depth — a Linux Docker image with SQL Server or PostgreSQL, high-availability or load-balancing deployment, and custom TLS certificates — alongside clients for Windows, macOS, Linux, iOS, Android and the web, plus scheduled export to JSON or CSV and import from Bitwarden, KeePass, LastPass, 1Password, Google Chrome and Remote Desktop Manager. Two cautions for the board: the update mode does not back up the databases and the image omits the PostgreSQL backup tools; we also found no public information on an EU cloud region, a status page with incident history, or an encrypted full-fidelity export covering attachments. 2 12 13
The Identity Engineer
This is the strong suit: a self-hosted Devolutions Server documented for Docker on Linux with SQL Server or PostgreSQL, high availability and load balancing, and mountable TLS certificates, alongside clients on Windows, macOS, Linux, iOS, Android and the web. Scheduled export to JSON, CSV or a PowerShell script is documented for disaster recovery and migration, with import from Bitwarden, KeePass, LastPass, 1Password and Chrome; an EU cloud region, a status page with incident history, and whether exports are encrypted or carry attachments are not covered on the captured pages. 13 12 1
The Compliance Auditor
Self-hosting is the strong story: Devolutions Server runs on Windows, Linux and Docker with SQL Server or PostgreSQL, customer-supplied TLS certificates, and documented high-availability or load-balancing deployment, with clients covering Windows, macOS, Linux, iOS and Android. Export to JSON, CSV or a PowerShell script can be scheduled, and import is documented from Bitwarden, KeePass, LastPass, 1Password, Chrome and Remote Desktop Manager. We found no public information on an EU cloud region, a status page, offline vault access during a vendor outage, or whether exports are encrypted and full-fidelity including attachments. 1 2 12 13
The SME Owner
Clients cover Windows, macOS, Linux, iOS and Android, imports work from Bitwarden, KeePass, LastPass, 1Password, Chrome and Remote Desktop Manager, and — the part I like — self-hosting is genuinely documented: Docker deployment on your own SQL Server or PostgreSQL, high availability and load balancing supported, your own TLS certificates. Offline access during a vendor outage, an EU cloud region, a status page, and whether exports cover attachments and stay encrypted are not described in the captured pages. 1 2 12 13
The DevOps Engineer
This is the part I actually like: Devolutions Server runs self-hosted on Windows, Linux or Docker with a documented container lifecycle, a choice of SQL Server or PostgreSQL, deployment in a high-availability or load-balancing environment, and your own TLS certificates mounted in — plus a REST API and a PowerShell module for automation, scheduled export to JSON or CSV for disaster recovery, and imports from Bitwarden, KeePass, LastPass, 1Password and Chrome. 2 12 13
The Skeptic
Self-hosting is documented in real depth: Docker images for linux/amd64 and linux/arm64, SQL Server or PostgreSQL 14+ at the customer's choice, high-availability or load-balancing deployment, custom TLS certificates, and an initialization mode that creates the database, first administrator and encryption keys — with an honest warning to back up the database before updates. Clients cover Windows, macOS, Linux, iOS and Android, and import from Bitwarden, KeePass, LastPass, 1Password, Google Chrome and Remote Desktop Manager with scheduled JSON or CSV export for disaster recovery or migration. We found no public information on whether the export is encrypted or full-fidelity, on offline access during an outage, on a status page with incident history, or on any EU cloud region. 1 2 12 13
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Proven non-EU on every dimension the evidence covers: non-EU vendor and contracting entity and non-EU hosting, with no EU or self-hosted option stated.
3 — One European element proven: an EU data region, an EU contracting entity or EU representative, a self-hosted option, or a published DPA, with the rest of the chain unstated.
5 — EU hosting as standard or selectable, or a self-hosted option, and an EU contracting entity or EU representative, with a DPA offered; the parent company or parts of the chain (support, analytics, email, client distribution) are unstated or non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
The vendor states it was proudly founded in Québec, Canada, and the one European element the captured pages prove is the self-hosted deployment path that runs on the customer's own infrastructure and database. We found no public information on where cloud vault data and metadata are hosted, the contracting entity's jurisdiction, a DPA, or the subprocessor list with locations. 5 13 2
The Identity Engineer
Devolutions states it was proudly founded in Québec, Canada, and the captured pages prove nothing about where cloud vault data and metadata sit, the contracting entity, subprocessors, or a data processing agreement. The one proven element is the self-hosted server, which can take the vendor out of the data path entirely; the rest of the chain is unstated. 5 2 13
The Compliance Auditor
Self-hosted deployment on the customer's own infrastructure is documented in the Docker deployment guide, and that is the one chain element the captures prove that removes the vendor from the data path. The vendor's own page states it was proudly founded in Québec, Canada. We found no public information on the contracting entity, where cloud vault data and metadata are hosted, a data processing agreement, or any subprocessor list. 2 5 13
The SME Owner
A self-hosted option is proven — the server runs in Docker on infrastructure I would choose, with my own database and certificates — and the vendor states it was proudly founded in Québec, Canada. Beyond that we found no public information on where vault data is hosted, the contracting entity, a data processing agreement, or the subprocessors. 2 5 13
The DevOps Engineer
The vendor describes itself as proudly founded in Québec, Canada, and the captured pages leave the contracting entity, data residency, subprocessors, and any data-processing agreement unstated. The documented self-hosted deployment — Docker on your own infrastructure with your own database — is the one element that takes the vendor out of the data path, which is exactly what I would build on while the rest of the chain stays unproven. 2 5 13
The Skeptic
The contracting entity's jurisdiction, data residency, subprocessors and any DPA are unknown in the captured pages, and the vendor presents itself as "Proudly founded in Québec, Canada" — not European. The one lever that is proven is removing the vendor from the data path: a documented self-hosted Devolutions Server on the customer's own Docker host and database. That earns the minimum score, and only that. 2 5 13
Pricing transparency
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A public "from" price or one priced tier, per user or flat.
5 — Per-user prices public for the business tiers with the billing period stated and the main features per tier listed.
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO not rated — no public information
We found no public information on pricing transparency: no per-user price, tier structure, seat minimum, add-on or term appears on any captured page, so a buyer cannot compute an annual cost from what we read. The only dollar figure published is the bug bounty maximum, which is not a product price. 1 2 5
The Identity Engineer not rated — no public information
We found no public information on prices, tiers, seat minimums, add-ons or contract terms on any of the pages captured, so a buyer cannot compute an annual cost from them. 1 2 5
The Compliance Auditor not rated — no public information
We found no public information on pricing in the captured pages: no per-user prices, tier feature lists, seat minimums, add-ons or contract terms appear on the vendor homepage or the download-centre capture I read. 1 2
The SME Owner not rated — no public information
We found no public information on pricing in the captured pages — no per-user price, no tiers, no seat minimums, no minimum term, and nothing on where single sign-on sits. As someone who needs to budget a forty-person rollout, that is the first number I look for, and it was not there. 1 2
The DevOps Engineer not rated — no public information
We found no public information on pricing transparency: no per-user prices, tier features, seat minimums, add-ons, or licensing terms for the self-hosted server appear on the vendor homepage or the download-centre pages we captured. 1 2
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Devolutions Password Hub
Is Devolutions Password Hub European?
Not determined: the vendor’s pages as captured do not say where Devolutions Password Hub is based.
Where does Devolutions Password Hub store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Devolutions Password Hub have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Devolutions Password Hub?
As of 3 Nov 2026, the panel rates Password Depot (3.5/5), Bitwarden (3.5/5) and Proton Pass (3.5/5) highest among the other 23 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Devolutions Password Hub alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 23 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page devolutions.net Checked 3 Nov 2026 Details →
- 2 Self-hosting / on-premises installation docs — found from the homepage devolutions.net Checked 3 Nov 2026 Details →
- 3 Open-source licence page — found from the homepage devolutions.net Checked 3 Nov 2026 Details →
- 4 Encryption model & independent audits — found from sitemap devolutions.net Checked 3 Nov 2026 Details →
- 5 Encryption model & independent audits — found from sitemap devolutions.net Checked 3 Nov 2026 Details →
- 6 Sharing, roles & recovery — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 7 Sharing, roles & recovery — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 8 SSO, directory sync & provisioning — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 9 SSO, directory sync & provisioning — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 10 Audit logs, policies & reporting — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 11 Audit logs, policies & reporting — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 12 Hosting choice, offline access & export — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →
- 13 Hosting choice, offline access & export — found from sitemap docs.devolutions.net Checked 3 Nov 2026 Details →