Password Management
heylogin
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by heylogin GmbH · www.heylogin.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
heylogin at a glance
- Vendor
- heylogin GmbH
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates heylogin 2.5/5, the mean of 6 judges. heylogin is a business password manager without a master password from heylogin GmbH, presented as developed in Germany and hosted by EU cloud providers. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
heylogin is a business password manager without a master password from heylogin GmbH, presented as developed in Germany and hosted by EU cloud providers. It is strongest on sharing and access control (5 to 6) and identity integration (5 to 6): teams with admin and custom roles, sending and receiving passwords externally, hidden passwords, cryptographic admin recovery, and Entra groups mirroring as heylogin teams with membership kept current, alongside Google Workspace sync. Security architecture and audit and policy both score 4: named cryptography (XSalsa20 with Poly1305, Curve25519) and a security whitepaper, but we found no public information on independent audits or certifications; the audit log records website logins, password copies and reveals for one year, yet sits in the Enterprise plan behind sales@heylogin.com. Sovereignty is the widest split (4 to 6): higher scores credit named German infrastructure — Hetzner in Nuremberg, a Falkenstein standby, IONOS backups — while the lowest notes contracting entity, ownership, residency and subprocessor exposure unconfirmed on the captured pages. Pricing transparency is weakest at 1 to 2: no price figure appears on the captured pages.
Speaks for it
- Team sharing scored 5 to 6, with teams, admin and custom roles, external password send and receive, hidden passwords and cryptographic admin recovery documented
- Entra groups mirror as heylogin teams with membership kept current and shared access driven by existing groups, with Google Workspace sync also available
- Cryptography is named (XSalsa20 with Poly1305, Curve25519), detailed in a security whitepaper, with a cloud stated to store data only and not decrypt vaults
- Breach detection notifies the administrator automatically when a password is compromised
- Importers cover ten named password managers plus CSV and Excel, with export through the settings where the data is selectable
Held against it
- No price figure appears on the captured pages, and the audit log and custom roles sit in the Enterprise plan behind sales@heylogin.com (pricing transparency scored 1 to 2)
- We found no public information on independent audits, certifications, penetration tests or a bug bounty
- The audit log is Enterprise-only with login and user changes announced as upcoming, and we found no public information on log export, SIEM integration or enforceable policies
- We found no public information on SSO sign-in, SCIM or automated suspension on deprovisioning, and the captured pages do not tie an identity login to vault decryption
- The on-premises option for organisations with more than 300 employees duplicates encrypted data rather than enabling self-hosting, and we found no public information on offline access or a Linux client
Best for
- You run Microsoft Entra ID and want directory groups to mirror as teams that automatically drive shared access
- You share logins across teams and need custom roles, hidden passwords and cryptographic admin recovery while admins stay locked out of personal vaults
- You want a no-master-password unlock using a smartphone, FIDO2 security key, Touch ID, Windows Hello or smartwatch
- You are migrating from another password manager and need importers plus a settings-based export with selectable data
Avoid if
- You need to compute an annual cost before talking to sales — ask the vendor: the public pages we read do not show it
- You must run the vault on your own servers — the captured pages show vendor cloud hosting, and the on-premises option for organisations with more than 300 employees duplicates encrypted data rather than enabling self-hosting
- You need audit logging without an Enterprise contract — the audit log is available only in the Enterprise plan, and events for login and user changes are still announced as upcoming
The scores
| Criterion | Panel median |
|---|---|
| Encryption model & independent audits | 2 of 5 |
| Sharing, roles & recovery | 3 of 5 |
| SSO, directory sync & provisioning | 3 of 5 |
| Audit logs, policies & reporting | 2 of 5 |
| Hosting choice, offline access & export | 2 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 0.5 of 5 |
Encryption model & independent audits
Show reasoningHide reasoning
How this is scored
What the vendor can prove about its security design: end-to-end encryption with named algorithms and key derivation, which fields are encrypted on the device and which are not, independent audits and penetration tests with published results, a bug bounty, and incident history disclosed.
0 — Security described in adjectives ("bank-grade", "military encryption") with no architecture, no audit and no statement of what the vendor can read.
3 — Encryption algorithms named and "zero knowledge" claimed, but no whitepaper, no statement of which fields stay unencrypted, and audits mentioned without dates, auditors or results.
5 — A published security whitepaper naming algorithms, key derivation and the client-side encryption model, a stated list of what is and is not encrypted (including URLs and metadata), and a named independent audit or certification (ISO 27001, SOC 2) with its date.
8 — Recurring independent penetration tests or code audits with reports or summaries published, a public bug bounty or vulnerability disclosure policy, past security incidents documented with their impact, and open-source clients or cryptography that can be reviewed.
10 — The design is verifiable end to end: full source or cryptographic design public, every field encrypted client-side including metadata, audits by named firms repeated yearly with full reports, a threat model that states what a compromise of the vendor's servers would expose, and incident post-mortems published.
The CISO
Named algorithms (XSalsa20 with Poly1305, Curve25519), an advertised security whitepaper, and a privacy policy that separates end-to-end-encrypted stored data — usernames, passwords, website URLs — from account data are on the table. We found no public information on independent audits, certifications, penetration tests, a bug bounty, or any disclosed incident history, which is precisely the third-party verification I would have to defend to the board after a breach. 3 5 6
The Identity Engineer
The security architecture pages name the cipher suite (XSalsa20 with Poly1305 and Curve25519), describe encryption via the device security chips with a local second-factor unlock, state that the cloud is only a store it cannot decrypt, and offer a whitepaper — the privacy policy even names usernames, passwords and URLs as end-to-end encrypted. We found no public information on independent audits, certifications, a bug bounty or disclosed incidents, which is what separates a described architecture from a proven one. 5 6 3
The Compliance Auditor
The captured pages name XSalsa20 with Poly1305 and Curve25519, offer a security whitepaper, describe the device security-chip key model with a locally unlocked second factor, and state the cloud cannot decrypt vaults. What my ISO 27001 file needs is absent from the public record: we found no public information on any independent audit, certification, penetration test, bug bounty or disclosed incident history. 5 6 3
The SME Owner
The whitepaper and architecture pages name the algorithms — XSalsa20 plus Poly1305 and Curve25519 — state that the cloud stores data only and cannot decrypt vaults, and the privacy policy lists usernames, passwords and website URLs as end-to-end encrypted. That is a real design, but we found no public information on an independent audit, certification, penetration test or bug bounty, and no statement of which fields stay unencrypted. 3 5 6
The DevOps Engineer
The security pages name real cryptography (XSalsa20 with Poly1305, Curve25519), point to a whitepaper with the end-to-end design, and state plainly that usernames, passwords and website URLs are encrypted while the cloud can only store and never decrypt vaults. What I found no public information on is any independent audit, penetration test, certification, bug bounty, or source code I could review myself — and a whitepaper alone is not the same as a stranger kicking the tyres. 3 5 6
The Skeptic
Algorithms are named (XSalsa20 with Poly1305, Curve25519), a whitepaper is offered, the key model is spelled out on the security page — device security chips unlocked locally by a second factor, a cloud that serves as storage and cannot decrypt the vaults — and the privacy policy puts usernames, passwords and webpage URLs in the encrypted set while contract and account information is not. What decided the score is the silence around proof: we found no public information on any independent audit or certification with a date, a bug bounty, or incident history. 3 5 6
Sharing, roles & recovery
Show reasoningHide reasoning
How this is scored
How credentials are shared and governed across a company: shared vaults or collections, role-based permissions, view-only and time-limited access, admin account recovery, emergency access, and what happens to shared items when an employee leaves.
0 — Personal vaults only, or sharing by sending a password to another user with no permissions and no record.
3 — Shared folders with all-or-nothing access, no roles, and no stated process for recovering an account or reclaiming credentials from a departing employee.
5 — Shared vaults or collections with read, edit and manage permissions, groups and admin roles, an admin recovery mechanism documented with its key model, and offboarding that transfers a leaver's shared items.
8 — Granular permissions down to hiding the password while allowing autofill, time-limited and one-time sharing with external parties, emergency access with a waiting period, delegated administration per team or location, and approval workflows for sensitive items.
10 — Access is governed and provable: least-privilege defaults, recovery and emergency access designed so the vendor never holds a key and stated so, periodic access reviews supported in the product, and every grant, change and revocation attributable to a person.
The CISO
Teams, custom roles with individually assignable permissions, hidden passwords when sharing, and sending and receiving passwords with external parties are documented, and admin recovery through security chips is described together with the explicit statement that admins cannot read passwords in personal vaults. We found no public information on emergency access, time-limited or one-time sharing, approval workflows, or how a leaver's shared items are reclaimed, so this sits between the anchored levels. 5 7 8
The Identity Engineer
Teams with permissions, assigning logins to individual employees, hidden passwords and sending or receiving passwords to external parties are documented, with admin and custom roles offering per-role permissions on the Enterprise tier. Cryptographic recovery through admins' security chips is documented together with the statement that admins cannot read personal vaults. We found no public information on emergency access, time-limited grants, approval workflows, or what happens to a leaver's shared items. 8 7 5
The Compliance Auditor
Team sharing with permissions, admin and user roles plus custom roles on the Enterprise plan, external send and receive of passwords, hidden passwords, and cryptographic recovery of organisation vaults via admin security chips are all documented. We found no public information on emergency access with a waiting period, time-limited or one-time sharing, approval workflows, or a documented transfer of a departing employee's shared items. 7 8 5 6
The SME Owner
Teams with permissions, admin and custom roles, hidden passwords when sharing, and sending or receiving passwords to and from external parties cover most of what my forty people need. Cryptographic recovery through the admins' security chips when a device is lost is documented with its key model and admins cannot read personal vaults, but we found no public information on transferring a leaver's shared items or emergency access with a waiting period. 5 7 8
The DevOps Engineer
Teams with their own permissions, admin and user roles plus unlimited custom roles, hidden passwords, sending and receiving passwords externally, and cryptographic admin recovery documented with its key model make this a genuine governance story. I found no public information on time-limited or one-time sharing, emergency access, approval workflows, or a documented offboarding that transfers a leaver's shared items. 1 5 7 8
The Skeptic
Teams with permissions, admin and custom roles, sending and receiving passwords with external parties, and hidden-password sharing are documented, and admin recovery is described down to the key model — organizational vaults encrypted with admins' security chips while personal vaults stay closed to admins. We found no public information on emergency access, time-limited or one-time shares, approval workflows, or a documented transfer of a leaver's shared items beyond admins being able to add and remove employees. 5 7 8
SSO, directory sync & provisioning
Show reasoningHide reasoning
How this is scored
How the vault fits into the company's identity stack: SSO with Entra ID, Okta or Google, and the key model behind an SSO unlock; SCIM or directory sync for joiners and leavers; MFA options including hardware keys; and passkey support for users and the vault itself.
0 — Each user creates an account by email; no SSO, no directory sync and no MFA beyond an app code.
3 — SSO available only to sign in to the admin console or on the top tier with no description of how the vault is then decrypted, and users provisioned by CSV invite.
5 — SSO with named identity providers (Entra ID, Okta, Google) documented with how the vault key is derived or released, SCIM or directory sync for provisioning and deprovisioning, and MFA including FIDO2 or hardware keys.
8 — SSO unlock designed so the vendor cannot derive the vault key and stated so, group sync driving vault permissions, automated suspension on deprovisioning, conditional access or device policies, and passkeys stored and used across platforms.
10 — Identity is integrated without trust shortcuts: the SSO key model published and independently reviewed, deprovisioning that revokes vault access and shared items immediately with a log entry, passwordless vault unlock with passkeys, and support for the customer's own key-management or trusted-device approval.
The CISO
Microsoft Entra ID and Google Workspace are documented for user import, and synchronized Entra groups become teams that automatically drive shared access; FIDO2 security keys, Touch ID, Windows Hello and smartwatches are supported second factors with two-factor protection by default. We found no public information on single sign-on to the vault with a documented key release, SCIM, automated suspension on deprovisioning, conditional access, or passkeys, which keeps this short of the higher levels. 1 5 9 10
The Identity Engineer
The Entra ID integration is real: admin consent with User.Read.All and Group.Read.All, user import, and Entra groups mirrored as heylogin teams with membership kept in sync so directory groups drive shared access; Google Workspace sync and FIDO2 security keys, Touch ID and Windows Hello as unlock devices are also documented. We found no public information on SSO sign-in, SCIM, automated suspension when an Entra account is disabled, or passkey support — for a two-thousand-seat joiner-mover-leaver process, deprovisioning behaviour is the open question that matters most. 9 10 1 5
The Compliance Auditor
Microsoft Entra ID and Google Workspace are documented integrations with their required permissions stated, Entra groups sync as teams with membership kept current, and FIDO2 security keys, Touch ID and Windows Hello serve as authenticators. We found no public information on SSO sign-in with a description of how the vault key is then handled, SCIM, conditional access, automated suspension on deprovisioning, or passkey storage. 9 10 1
The SME Owner
Users come in via Entra ID or Google Workspace sync, Entra groups mirror as heylogin teams with membership kept current automatically including removals, and unlocking runs on the phone, a FIDO2 security key, Touch ID, Windows Hello or a smartwatch rather than a master password. We found no public information on single sign-on into the product as such, on SCIM, or on storing passkeys for other sites. 1 5 9 10
The DevOps Engineer
Directory sync is genuinely there: Entra groups mirror as heylogin teams with membership kept current, shared access driven by existing Entra groups, Google Workspace supported, and hardware security keys treated as first-class second factors. But I found no public information on a classical SSO sign-in for the vault, SCIM, passkey storage, or conditional access — and the captured pages never tie an identity login to vault decryption; the key model rests on device security chips, not the directory. 1 5 9 10
The Skeptic
Entra ID and Google Workspace sync is real and specific — Entra groups mirror as heylogin teams with membership kept current and driving shared access — and the no-master-password model unlocks the vault by smartphone, FIDO2 security keys, Touch ID or Windows Hello, with the cloud stated to be unable to decrypt anything. We found no public information on SSO sign-in itself, SCIM, automated suspension on deprovisioning, conditional access, or passkeys stored in the vault. 1 9 10 6
Audit logs, policies & reporting
Show reasoningHide reasoning
How this is scored
What an administrator and an auditor can see and enforce: event logs of access and changes, password health and breach reports, enforceable policies (master password, MFA, sharing, export), SIEM integration, and reports an ISO 27001 or NIS2 audit can use.
0 — No audit log and no admin policies; the administrator sees a user list.
3 — A basic activity list and a password-strength score, but no exportable log, no enforceable policies, and no record of who viewed or copied a shared credential.
5 — Event logs covering logins, item access, sharing and admin changes, exportable or available through an API, enforceable policies for master password and MFA, and password health and breach-monitoring reports.
8 — Native SIEM integration with named targets (Splunk, Microsoft Sentinel, Elastic or syslog), policies for sharing, export and browser-extension behaviour, log retention stated, and compliance reports aligned to ISO 27001, NIS2 or BSI IT-Grundschutz.
10 — Auditability is complete: every view, copy, autofill and permission change logged with user and device, logs tamper-evident and retained for a configurable period, alerting on anomalous access, and an auditor role that can read logs without access to secrets.
The CISO
The audit log records website logins, password copies, password reveals and hidden-field reveals, retains events for one year within the organization, and administrators are notified automatically when a password appears compromised — but changes to logins and user-related events are still listed as upcoming rather than live. We found no public information on exporting the log, enforceable policies for MFA, sharing or export, SIEM integration, or compliance reporting, and the whole audit capability is reserved for the Enterprise plan behind a sales contact. 1 3 11 12
The Identity Engineer
Item-level events are logged — website logins, password copies, password reveals and reveals of hidden fields — with a stated one-year retention, and breach detection notifies the admin through a domain-verified leak check. Login and user changes are listed as upcoming rather than available, and the log sits in the Enterprise tier behind a sales contact. We found no public information on log export or API access, SIEM integration, or enforceable admin policies. 11 12 1 3
The Compliance Auditor
The audit log has the right shape for an audit: it records website logins, password copies, password reveals and reveals of hidden fields, retains events for one year and covers the organisation, with breach detection notifying admins. It sits in the Enterprise plan only, events for modified logins and user-related changes are announced as upcoming rather than live, and we found no public information on export to a SIEM or enforceable policies for passwords, sharing or export. 11 12 1
The SME Owner
The audit log records exactly the events an insurer or auditor asks about — website logins with heylogin, copying a password, revealing a password or a hidden field — and keeps them for one year, but it sits in the Enterprise plan behind a sales contact. Modifications to logins and user-related changes are only announced as upcoming, and we found no public information on log export or an API, SIEM integration, enforceable policies, or password-health reporting beyond automatic breach notifications to the admin. 1 11 12
The DevOps Engineer
The audit log records website logins, password copies, reveals of passwords and of hidden fields, retains events for a year, and admin breach notification exists — but sharing and admin-change events are only announced as upcoming, and the log lives behind the Enterprise plan with a sales contact. I found no public information on log export, an API or SIEM path, or enforceable admin policies; this is a watcher's log, not an auditor's. 1 11 12
The Skeptic
The audit log records what I actually want to see — website logins with the product, password copies, reveals of passwords and of fields configured as hidden — retained for one year, and breach detection notifies the administrator. But it sits in the Enterprise plan behind a sales contact, change events are announced as upcoming rather than present, and we found no public information on exporting the log, SIEM integration, password health reporting, or any enforceable policy for MFA, sharing or export. 1 11 12
Hosting choice, offline access & export
Show reasoningHide reasoning
How this is scored
Where and how the vault runs and how the data leaves it: cloud region choice, a self-hosted or on-premises option, offline access during a vendor outage, client coverage across operating systems and browsers, and a complete, documented export and import path.
0 — Cloud only in an unstated region, no offline access, and no export or an export that drops attachments and shared items.
3 — Cloud with a region named, apps for common platforms, and an export in CSV only that leaves out attachments, folders, TOTP seeds or custom fields.
5 — An EU region or self-hosted option, offline read access on desktop and mobile, clients for Windows, macOS, Linux, iOS, Android and the major browsers, and an export that covers all item types including attachments.
8 — Both EU cloud and self-hosted or on-premises deployment documented, a status page with incident history, encrypted full-fidelity export and import from named competitors, and vault access continuing during an outage of the vendor's service.
10 — The customer can run and leave the vault on their own terms: self-hosting with documented high availability and backup, an open or documented export format that preserves structure, permissions and history, and a stated procedure for continued access if the vendor ends the service.
The CISO
Hosting is documented on named German infrastructure — Hetzner in Nuremberg with a Falkenstein standby and independent backups at IONOS — with clients for Windows and macOS pairing, iOS, Android and four major browsers, importers for ten named password managers plus CSV and Excel, an export through the settings with selectable data, and an on-premises copy of the encrypted data for organisations above 300 employees. We found no public information on offline access during a vendor outage, a Linux client, what the export preserves beyond selectable data, or a status page with incident history, and the on-premises option duplicates ciphertext rather than letting the customer run the vault. 1 2 5 13 14
The Identity Engineer
Hosting is documented on named German infrastructure — Hetzner in Nuremberg with Falkenstein standby and independent backups at IONOS — alongside browser extensions for four major browsers, iOS and Android apps, PC/Mac pairing, import from ten password managers plus CSV and Excel, and an export area with selectable data; organisations above 300 employees can duplicate the encrypted data to their own servers. We found no public information on offline access during an outage, a Linux client, or export fidelity for attachments and TOTP seeds. 5 6 1 13 14 2
The Compliance Auditor
Hosting is named to the city — Hetzner production in Nuremberg with a Falkenstein standby and independent IONOS backups — with clients for iOS, Android, PC/Mac and the four major browsers, plus step-by-step import from named competitors and a settings-based export with selectable data. We found no public information on a self-hosted option (only an on-premises backup duplicate above 300 employees), offline access during an outage, or whether the export preserves attachments, folders and TOTP seeds. 5 6 13 14 1 2
The SME Owner
Hosting runs on named German infrastructure — Hetzner in Nuremberg with a Falkenstein standby and independent IONOS backups — with extensions for Chrome, Firefox, Safari and Edge plus iOS and Android apps, and a machine-readable export in the settings where you select the data. We found no public information on offline access during a vendor outage, a Linux client, or whether the export covers attachments, and the on-premises duplication of encrypted data is an add-on for organizations with more than 300 employees. 2 3 5 14
The DevOps Engineer
The captured pages show only vendor cloud hosting — Hetzner in Nuremberg with a Falkenstein standby and IONOS backups, which is their resilience, not mine — and the on-premises offering for organisations above 300 employees duplicates encrypted data on my servers rather than letting me run the vault. Export sits in the settings with selectable data and importers cover the usual competitors and CSV/Excel, but I found no public information on offline access, a Linux client, or whether the export preserves attachments and TOTP seeds. 1 2 5 13 14
The Skeptic
Hetzner in Nuremberg with a Falkenstein standby and independent IONOS backups is named-infrastructure EU hosting, and clients cover Chrome, Firefox, Safari, Edge, iOS, Android and PC/Mac, with importers for a long list of password managers plus CSV and Excel and a settings-based export where the data is selectable. We found no public information on offline access during an outage, a Linux client, or what the export preserves, and the on-premises option is a duplicate of the encrypted data for organisations above 300 employees rather than a self-hosted deployment. 2 5 6 13 14
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where vault data and metadata are hosted, and who the subprocessors are. Independently sourced by the sovereignty pipeline; end-to-end encryption narrows what a foreign authority could compel, but metadata, logs and the update channel for the client software remain in the vendor's hands, so the chain still counts.
0 — Non-EU vendor and contracting entity, hosting unstated, and subprocessors unnamed.
3 — An EU data region offered while the contracting entity and parent are non-EU without a stated safeguard, or the subprocessor list is absent.
5 — EU hosting as standard or selectable and an EU contracting entity, but the parent company or parts of the chain (support, analytics, email, client distribution) are non-EU.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessor list published with locations, a DPA covering vault metadata and logs, and a self-hosted option that removes the vendor from the data path.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, certifications published (ISO 27001, BSI C5 or equivalent), and source code or builds verifiable so the client update channel is not a blind trust in the vendor.
The CISO
The security pages themselves name the hosting concretely — Hetzner in Nuremberg with a Falkenstein standby and backups at IONOS — and the vendor presents itself as developed in Germany, hosted at EU cloud providers, with a breach-check subprocessor in Australia that is stated to receive no data transfer. The independent sovereignty review marks the contracting entity, ownership and residency as unconfirmed on the captured pages, and we found no public information on a published subprocessor list with locations, a data-processing agreement covering metadata and logs, or certifications, so I cannot place full weight on the European story. 1 3 5 6
The Identity Engineer
The vendor presents itself as a Braunschweig-based German company with German business angels and Mozilla Ventures as investors, production on Hetzner in Nuremberg with backups at IONOS, and only technically necessary cookies; one subprocessor is named with location and the statement that no data is transferred to it. We found no public information on a published subprocessor list with locations, certifications, or DPA coverage of metadata and logs, and the captured pages do not confirm the contracting entity's jurisdiction. 5 6 1 3 2
The Compliance Auditor
Hosting on named German infrastructure with EU cloud providers, development in Germany and a Made in Europe claim are on the captured pages, and one subprocessor is published with location and purpose (Have I Been Pwned, Australia, with no data transfer claimed). The independently computed attributes could not confirm the contracting entity, ownership or subprocessor exposure from the captured pages, and we found no public information on a full subprocessor list with locations, a data processing agreement covering metadata and logs, or a self-hosted deployment. 5 6 1 3 2
The SME Owner
The product is developed in Germany, hosted by EU cloud providers on named German infrastructure, presents itself as made in Europe with German business angels among its investors, and the privacy policy names third parties including an Australian breach-check service that the policy describes as involving no data transfer. We found no public information on the captured pages confirming the contracting entity and its ownership, or a full subprocessor list with locations and a data-processing agreement covering logs. 1 3 5
The DevOps Engineer
Developed in Germany, running on named German infrastructure with a German security officer to contact, and the one subprocessor in view is the Australian Have I Been Pwned check with no data transfer — a decent European chain. Still, there is no published subprocessor list with locations, no certifications, no verifiable source or builds, and the captured pages did not confirm ownership details; without self-hosting the vendor remains in the data path. 1 3 5
The Skeptic
Hosting, development and the entity are European and named — Hetzner in Nuremberg and Falkenstein, backups at IONOS, a German company in Braunschweig with German business angels and Mozilla Ventures as investors — and the privacy policy names at least one subprocessor (Have I Been Pwned in Australia, described as involving no data transfer) alongside technically necessary cookies only. Ownership and the full subprocessor picture remain unconfirmed on the vendor's own pages, and we found no published data processing agreement, certifications, or verifiable source or builds, so the chain beyond the vault servers rests on the vendor's word. 1 2 3 5 6
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, which features (SSO, SCIM, SIEM, self-hosting) sit in which tier, minimum seats, add-ons, and the minimum term.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but which business features (SSO, SCIM, audit logs) sit in which tier is unclear — the invoice is unknowable.
5 — Per-user tier prices public with the main features per tier, but at least one commonly needed piece (SSO, SIEM integration, self-hosting, minimum seats) is unpriced or "on request".
8 — Every tier priced publicly with its feature set and seat minimum, add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: annual invoice derivable for a given number of users, with every add-on, self-hosting licence, support level and renewal condition published.
The CISO
The captured pricing page shows a trial for the Business plan and describes Enterprise add-ons for organisations above 300 employees — a customer success manager, onboarding, ISMS integration and an on-premises backup — but not a single price figure appears anywhere, and the audit log and custom roles are tied to an Enterprise plan reachable only through a sales email. A buyer cannot compute any annual cost from what is public; every real number is a sales conversation. 2 7 11
The Identity Engineer
The pricing page shows a Business tier with a trial and an Enterprise tier, and some feature placement is visible — custom roles and the audit log are Enterprise-only behind a sales contact, and the 300-plus-employee bundle adds a success manager and on-premises backup. We found no public information on per-user prices for any tier, seat minimums, term lengths or VAT treatment, so an annual invoice cannot be computed from what was captured. 2 11 7
The Compliance Auditor
The captured pricing page shows a Business-plan trial and enterprise add-ons above 300 employees, and some feature placement is visible with the audit log and custom roles in the Enterprise plan. No price figure appears on the captured pages and the audit log itself directs buyers to the sales team, so an annual cost cannot be computed from public information. 2 11 7
The SME Owner
The pricing page shows a Business trial and an add-on bundle for organizations with more than 300 employees, but we found no public price per user or per tier on the captured pages. With the audit log and custom roles sitting in the Enterprise plan behind a sales contact, I cannot compute what a year for forty users would cost. 2 7 11
The DevOps Engineer
We found no public information on per-user or tier prices: the captured pages name Business and Enterprise tiers with a Business trial, but the audit log is only via the sales team's email and enterprise extras start above 300 employees. No seat minimum, add-on price, minimum term or VAT treatment appears anywhere I can see, so the annual invoice is not computable from these pages. 2 11
The Skeptic
No price figure appears on any captured page: a Business trial and an Enterprise tier are named, and the audit log, personal customer success manager, onboarding and the on-premises backup all route to sales@heylogin.com. A buyer cannot compute an annual cost from the public pages; the invoice is a conversation. 2 11
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about heylogin
Is heylogin European?
Yes. whats-best.ai classifies heylogin as EU-Made.
Where does heylogin store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does heylogin have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to heylogin?
As of 21 Oct 2026, the panel rates Password Depot (3.5/5), Keeper (3/5) and Passbolt (3/5) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Password Depot (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: heylogin alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.heylogin.com Checked 13 Oct 2026 Details →
- 2 Pricing page www.heylogin.com Checked 13 Oct 2026 Details →
- 3 Privacy policy www.heylogin.com Checked 13 Oct 2026 Details →
- 4 Legal notice www.heylogin.com Checked 13 Oct 2026 Details →
- 5 Encryption model & independent audits — found from sitemap www.heylogin.com Checked 13 Oct 2026 Details →
- 6 Encryption model & independent audits — found from sitemap www.heylogin.com Checked 13 Oct 2026 Details →
- 7 Sharing, roles & recovery — found from sitemap www.heylogin.com Checked 13 Oct 2026 Details →
- 8 Sharing, roles & recovery — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 9 SSO, directory sync & provisioning — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 10 SSO, directory sync & provisioning — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 11 Audit logs, policies & reporting — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 12 Audit logs, policies & reporting — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 13 Hosting choice, offline access & export — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →
- 14 Hosting choice, offline access & export — found from sitemap help.heylogin.com Checked 13 Oct 2026 Details →