TeamPassword

The CISO

The passkey key model is documented to a standard I can actually question: private keys AES-encrypted, wrapped to the user's personal public key, decrypted only inside the extension, with the vendor stating the backend never sees a plaintext key. Beyond that, the captured pages claim an encrypted vault and SOC 2 certification without naming the vault cipher, the key derivation, an auditing firm, a bug bounty or any incident history, and the organization export is a plain-text CSV — so the scope of what is protected is never laid out field by field. 1 6 7

Report an error

The CISO

Roles are written down — read-only, member, admin and owner — with group-based sharing, role changes restricted to admins and owners, instant revocation when someone leaves, read-only users barred from revealing passwords, and one-time secret links valid for 24 hours behind a security setting. The vendor also states it cannot manually escalate a member's permissions, which removes silent vendor-side recovery as a bail-out. Emergency access, approval workflows and delegated administration are not documented on the captured pages. 1 3 4 5

Report an error

The CISO

Enterprise SSO with Microsoft Entra ID is documented in working detail — one-to-one email mapping, a FusionAuth callback, per-user enablement and support-assisted configuration — and passkeys can be saved, autofilled and removed with signing performed locally. Directory sync and provisioning automation are not documented, nor is the key model behind an SSO unlock, and the only account MFA evidence is a customer quote mentioning two-factor authentication. 1 5 6

Report an error

The CISO

Admins can review account activity, audit logs are claimed on the vendor page, and the one-time-link feature sits behind a security setting, but that is where the captured documentation stops. I found no public information on exportable or API-accessible logs, SIEM destinations, enforceable master-password or MFA policies, log retention, or password-health and breach reports inside the admin console — nothing an ISO 27001 auditor could be handed. 1 3 5

Report an error

The CISO

The product runs in the browser with a Chrome extension, imports and exports records as CSV — under the vendor's own warning that the export is plain text and anyone holding it controls all records — and a status link exists on the site. I found no public information on hosting regions, self-hosting, native desktop or mobile clients, or offline vault access; passkey use is explicitly documented as requiring TeamPassword to be reachable online. 1 6 7 8

Report an error

The CISO not rated — no public information

I found no public information on the contracting entity's jurisdiction, where vault data and metadata are hosted, the subprocessor chain or a data-processing agreement; the captured vendor and help pages state none of it, and the sovereignty dimensions came through unknown. I report this as unevidenced rather than drawing any conclusion about where the chain runs. 1 5

Report an error

The CISO

The captured pages place Enterprise SSO and the read-only role in the Enterprise plan and describe a self-service upgrade from Standard, but no price is published for any tier — no per-user rate, billing period or seat minimum appears anywhere. A buyer cannot begin to compute an annual cost from what is captured. 3 4 5

Report an error