# Netwrix Password Secure — Password Management

Netwrix Password Secure by MATESO GmbH holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU origin, foreign-owned; sovereignty: not determined.

- Vendor: MATESO GmbH (https://www.passwordsafe.com/de/)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): EU origin, foreign-owned
- Canonical page: https://whats-best.ai/software/password-management/netwrix-password-secure
- Alternatives: https://whats-best.ai/software/password-management/netwrix-password-secure/alternatives ([markdown](https://whats-best.ai/software/password-management/netwrix-password-secure/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: MATESO GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Netwrix Password Secure, made by MATESO GmbH of Munich and owned since 2022 by the US company Netwrix, earns its best marks for sharing and access control, scored 6-7: role-based access with machine-learning role mining, self-service access requests with approval workflows, ephemeral time-limited accounts and periodic recertification are stated on the vendor's pages. The weakest scores are 2, for security architecture and identity integration — the site carries pages on end-to-end encryption and a 2019 SySS penetration test, but we found no public information on algorithms, key derivation, which fields stay readable to the vendor, or test results; multi-factor authentication is the only confirmed identity claim, with no public information on single sign-on, directory sync or hardware keys. Deployment and portability spread widest, 4 to 6, between documented self-hosting and unevidenced export fidelity, offline behavior and status history. Sovereignty scores 4-5: a German contracting entity and DACH-region data centers for the managed service, beside a Texas headquarters. Pricing transparency scores 1-2 — no prices published, buying via demo booking and a 14-day full-access trial of Netwrix 1Secure.

**Speaks for it:**
- Self-hosting is documented in three forms — on-premises, private cloud and hybrid cloud — with a dedicated whitepaper.
- Role-based governance — approval workflows, ephemeral time-limited accounts, periodic recertification — is stated on the vendor's pages and scored 6-7.
- Password policy enforcement is concrete: per-account minimum length and complexity, blacklisted weak passwords, rule previews and compliance monitoring.
- The managed service states storage of data in secure data centers in the DACH region.
- Clients cover mobile apps, browser extensions and a LightClient across devices.

**Held against it:**
- Security architecture scored 2, with no public information on encryption algorithms, key derivation or which fields stay readable to the vendor.
- Identity integration scored 2: multi-factor authentication is the only confirmed claim, with no public information on single sign-on, directory sync or hardware keys.
- We found no public information on emergency access, administrator account recovery or key custody when an employee leaves.
- We found no public information on log export, SIEM integration or log retention for the audit logbook.
- We found no public information on a product subprocessor list, standard vault-data residency or certifications such as ISO 27001.

**Best for:**
- You need to self-host — on-premises, in a private cloud or a hybrid cloud — so the vendor sits outside your data path.
- You want governance-heavy sharing: approval workflows, ephemeral accounts and periodic recertification, the top-scoring capability in this verdict.
- You are a business customer buying under German terms and prefer a managed service with DACH-region data centers.
- You enforce granular password policies and want rule previews and compliance monitoring before rollout.

**Avoid if:**
- Your procurement excludes US-parented vendors; the maker has belonged to Netwrix of Frisco, Texas since 2022.
- Your access model runs on single sign-on and directory-driven provisioning; the captured pages confirm only multi-factor authentication.
- You need verified cryptography or recent audit results before trusting a vault; security architecture scored 2 on the evidence shown.
- You are a private consumer; the published terms apply only to businesses.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Sharing, roles & recovery | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 |
| SSO, directory sync & provisioning | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Audit logs, policies & reporting | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2/5 |
| Hosting choice, offline access & export | 2.5/5 | 2.5/5 | 2/5 | 3/5 | 2.5/5 | 2/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2.5/5** | **2/5** | **1.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Cookie consent tool: Cookiebot · Cybot A/S · Dänemark [S3]
- Ga DPA: yes [S3]
- Ga ip anonymization: yes [S3]
- GDPR: yes [S1]
- List: compliance topics covered: CMMC, ISO, HIPAA, NIST CSF, PCI DSS, TISAX [S9]
- Made in germany: yes [S1]
- Ssl tls: yes [S3]
- Standards listed: CMMC · ISO · HIPAA · NIST CSF · PCI DSS · TISAX [S2]
- Syss pentest 2019 download: PDF · 156 · yes [S6]
- Syss pentest 2019 quote: Managing Director of SySS GmbH · Sebastian Schreiber [S6]
- Syss pentest 2019 result: 2019 · Password Safe and Repository 8 · very high safety level, no weaknesses found in integrity and availability · SySS GmbH [S6]

**Data**
- Data portability: yes [S3]
- Ga opt out browser plugin: https://tools.google.com/dlpage/gaoptout?hl=de · yes [S3]
- Ga retention: 38 [S3]
- Log files: Server-Log-Dateien erfassen Browsertyp/-version, OS, Referrer URL, Hostname, Uhrzeit, IP-Adresse [S3]
- Opt out hotjar: https://www.hotjar.com/opt-out · yes [S3]
- Retention default: Daten bleiben bis zum Wegfall des Verarbeitungszwecks gespeichert; Löschung bei berechtigtem Löschenbegehren oder Widerruf, soweit keine gesetzlichen Aufbewahrungsfristen [S3]

**Hosting**
- DPA with hoster: yes [S3]
- Hq address: Frisco · TX · 6160 Warren Parkway, Suite 100, Frisco, TX, US 75034 · US [S8]
- Msp datacenter region: DACH [S1]
- Provider: Deutschland · RAIDBOXES GmbH [S3]
- Self hosted: on-premises · private cloud · hybrid cloud [S1]

**Integrations**
- Browser extensions: yes · yes [S12]
- Browser extensions: yes [S11]
- Browser extensions: yes [S4]
- Lightclient: Produkt umfasst einen LightClient [S13]
- Mobile apps: yes [S11]

**Legal**
- Acquisition: 2022-09-23 · MATESO · Netwrix [S12]
- Address: 81379 · München · Zielstattstr. 40 [S4]
- Agb version: November 2021 [S5]
- Brand trademark: MATESO · yes [S4]
- Contract language: de [S5]
- Controller: MATESO GmbH · Daimlerstraße 15, 86356 Neusäß, Germany [S3]
- Copyright holder: 2026 · Netwrix Corporation [S2]
- Editorially responsible: Steve Dickson · Jacob Yavil [S4]
- Entity: MATESO GmbH · Daimlerstr. 15, 86356 Neusäß [S5]
- Entity: Netwrix Corporation [S9]
- Entity: Netwrix Corporation [S8]
- Entity name: MATESO GmbH [S4]
- Governing law: deutsches Recht, UN-Kaufrecht ausgeschlossen [S5]
- Headquarters: Netwrix Corporation · 6160 Warren Parkway, Suite 100, Frisco, TX, US 75034 [S2]
- Headquarters: 6160 Warren Parkway, Suite 100, Frisco, TX, US 75034 [S9]
- Jurisdiction: Augsburg [S5]
- Netwrix acquisition: 2022-09-23 · MATESO · Netwrix [S13]
- Odr participation: no [S4]
- Register: Amtsgericht Augsburg · HRB 22302 [S4]
- VAT id: DE252782033 [S4]

**Pricing**
- Essentials edition scope: AD · Entra ID · Group Policy · SharePoint · Teams · File Servers · Windows Server · Netwrix Auditor Essentials Edition [S2]
- Essentials edition target: companies under 150 employees [S2]
- Free trial: 14 · Netwrix 1Secure · yes · yes [S2]
- Payment method: invoice · yes [S5]
- Quote based: quote_based [S2]
- Trial: 14 · Netwrix 1Secure · yes [S8]
- VAT treatment: no [S5]

**Product**
- 1secure dspm edition upcoming: coming_soon · Netwrix 1Secure DSPM Edition [S2]
- Access certification: yes [S8]
- Access request delegation: yes [S8]
- Audit logbook: Logbuch zur Überprüfung und Verfolgung der Passwortaktivitäten [S10]
- Automation: yes [S1]
- Automation: Automation [S11]
- Automation: yes [S4]
- B2b only: yes [S5]
- Browser extensions: yes [S1]
- Browser extensions: yes · yes [S13]
- Categories limit: Set up to 4 different categories for creating passwords [S11]
- Chatbot use: yes [S3]
- Client: yes [S1]
- Company sizes: Large enterprises · SME [S11]
- Complexity per account: Komplexitätsanforderungen pro Konto erhöhen [S10]
- Compliance GDPR: yes [S11]
- Cross device access: yes [S1]
- Customer claims: yes [S1]
- Data ownership: Data ownership [S11]
- Data residency made in germany: Produkt wirbt mit Made in Germany und DSGVO-Ready [S13]
- Deployment flexibility: yes · yes · yes [S8]
- Entitlement management: yes [S8]
- Ephemeral accounts: yes [S8]
- Forbidden passwords: blacklist weak passwords [S11]
- Form field defaults: define policy rules as default options for form fields [S11]
- Free trial: Netwrix 1Secure · 14 · yes [S9]
- Gartner rating: 2025-09-02 · 4.7 · Gartner Peer Insights · 164 · File Analysis Software [S2]
- GDPR compliance: GDPR Compliance [S12]
- GDPR ready: yes [S4]
- Group lifecycle management: yes [S8]
- High availability: yes [S1]
- High availability: High availability [S11]
- High availability: yes [S13]
- High availability: yes [S4]
- Implementation speed: out-of-the-box automation reduces implementation effort and TCO [S8]
- Industries: IT · Finanzwesen · Bildungswesen · Industrie · Einzelhandel · Gesundheitswesen [S1]
- Industries: IT · Finance · Education · Manufacturing · Retail · Healthcare [S11]
- License scope: non-exclusive, non-sublicensable right of use [S5]
- Lifecycle automation: yes [S8]
- Lightclient: The LightClient [S12]
- Lightclient: The LightClient [S11]
- Lightclient: yes [S4]
- Logbook: logbook to review and track user interactions [S11]
- Made in germany: Made in Germany [S12]
- Made in germany: Made in Germany [S11]
- Made in germany: yes [S4]
- Managed service kmu: SMEs [S1]
- MFA: Multi-factor authentication [S12]
- MFA: yes [S11]
- MFA: yes [S4]
- Min password length configurable: Mindest-Passwortlänge pro Konto anpassbar [S10]
- Mobile apps: yes [S1]
- Mobile apps: yes [S4]
- Multi factor auth: yes [S1]
- Multi factor authentication: yes [S13]
- Nhi management: yes [S8]
- Password activity oversight: oversight into password activity like password resets [S11]
- Password blacklist: yes [S10]
- Password generator: Passwort-Generator erstellt Passwörter gemäß Richtlinien [S10]
- Password generator: password generator applies policy rules [S11]
- Password policies: yes [S1]
- Password policy enforcement: yes [S8]
- Password policy monitoring: Überwachung der Einhaltung von Passwort-Richtlinien [S10]
- Password strength customization: customise character limits for passwords for different accounts [S11]
- Policy categories: 4 [S10]
- Policy enforcement: only allow passwords meeting password guidelines [S11]
- Policy preview rules: Vorschau-Regeln zeigen Umsetzung der Richtlinien [S10]
- Preview rules: preview how new rules will apply before implementation [S11]
- Rating gartner: 2025-09-02 · 4.7 · Gartner Peer Insights · 164 [S8]
- Rbac ebook topics: eBook covers rights management models, defining roles using NIST recommendations, and RBAC implementation steps [S9]
- Rbac role mining: yes · yes [S8]
- Risk detection: yes [S8]
- Self hosting outsourcing topics: PDF · Unterschiede zwischen Self-Hosting und Outsourcing · Dateneigentum mit Password Safe · Datenkonformität als Mehrwert, nicht als Zusatz · Zuordnung von Geschäftsanforderungen und Lösungen · 470 [S13]
- Self hosting whitepaper: 464 kB · From Self-Hosting Up To Outsourcing · PDF · Differences between self-hosting and outsourcing · Data ownership with Password Safe · Data compliance as a value-add, not an add-on · Business requirements mapped with solutions · yes [S12]
- Solution catalog: DSPM · Directory Management · Endpoint Management · Identity Management · ITDR · Privileged Access Management [S2]
- Team sharing: yes [S1]
- Training available: yes [S5]
- Trial: yes [S1]
- Warranty period: months · 12 [S5]
- Whitepaper BSI: whitepaper on password guidelines referencing German Federal Office for Information Security [S11]
- Whitepaper hosting options: Whitepaper behandelt SaaS, Cloud, Managed Service und On-Premises Hosting-Optionen [S13]

**Support**
- Channels listed: Knowledge Center · submit_ticket · community · Customer Portal [S2]
- Demo booking: yes [S1]
- Scope: Telefon · E-Mail · Fernzugriff · no [S5]
- Ticket: yes [S9]
- Trial: Test now [S11]

## Questions

### Is Netwrix Password Secure European?

Partly. whats-best.ai classifies Netwrix Password Secure as EU origin, foreign-owned.

### Where does Netwrix Password Secure store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Netwrix Password Secure have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Netwrix Password Secure?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Netwrix Password Secure alternatives](https://whats-best.ai/software/password-management/netwrix-password-secure/alternatives).

## What this page leaves out

- 10 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.passwordsafe.com/de/ (checked 2026-10-13)
- [S2] Pricing page: https://netwrix.com/de/pricing/ (checked 2026-10-13)
- [S3] Privacy policy: https://www.passwordsafe.com/de/datenschutzerklaerung/ (checked 2026-10-13)
- [S4] Legal notice: https://www.passwordsafe.com/de/impressum/ (checked 2026-10-13)
- [S5] Terms of service: https://www.passwordsafe.com/de/agb/ (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.passwordsafe.com/en/portfolio-items-en/syss-pentest-2019-level/ (checked 2026-10-13)
- [S7] Encryption model & independent audits — found from sitemap: https://www.passwordsafe.com/de/portfolio-items/ende-zu-ende-verschluesselung-e2ee/ (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://www.passwordsafe.com/de/portfolio-items/rollen-im-focus-die-vorteile-von-role-base-access-control-rbac/ (checked 2026-10-13)
- [S9] Sharing, roles & recovery — found from sitemap: https://www.passwordsafe.com/en/portfolio-items-en/rights-over-roles-the-advantages-of-role-based-access-control-rbac/ (checked 2026-10-13)
- [S10] Audit logs, policies & reporting — found from sitemap: https://www.passwordsafe.com/de/wofuer-passwort-richtlinien/ (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://www.passwordsafe.com/en/what-for-password-policies/ (checked 2026-10-13)
- [S12] Hosting choice, offline access & export — found from sitemap: https://www.passwordsafe.com/en/portfolio-items-en/self-hosting-outsourcing/ (checked 2026-10-13)
- [S13] Hosting choice, offline access & export — found from sitemap: https://www.passwordsafe.com/de/portfolio-items/self-hosting-outsourcing/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Netwrix Password Secure — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/netwrix-password-secure

Corrections: https://whats-best.ai/correct/667?target=page