Team and company password management on your own servers with Vaultwarden, Passbolt or self-hosted Bitwarden, and how sharing, recovery, licensing and audit needs differ by sector and constraint.
Shared credentials for trading, payment and admin systems need access control, logs and recovery that satisfy examiners. This page compares Passbolt, Bitwarden and Vaultwarden on activity logs, sharing models and support, and where a password manager stops and PAM starts.
Shared clinical and vendor accounts, rotating staff and HIPAA password management rules: choosing between Passbolt, Bitwarden and Vaultwarden, onboarding and offboarding clinicians, and keeping vault data on hospital-controlled servers.
Agencies that cannot put credentials in a vendor cloud: OpenPGP end-to-end encryption in Passbolt, directory sync, export controls, procurement of support for open-source editions and running the vault on government infrastructure.
Engineering teams share API keys, admin logins and recovery codes. This page covers which credentials belong in a password manager versus a secrets manager such as OpenBao, API and CLI access in Passbolt and Bitwarden, and folder and group design.
Running a team vault with no internet: offline installation of Vaultwarden or Passbolt, HTTPS with an internal CA, client distribution without app stores, backup and the browser extension update problem.
Keeping credentials and their metadata in EU-controlled infrastructure: what is encrypted client-side and what the server sees in Passbolt and Bitwarden, hosting choices, and contract questions when buying support.
Emergency admin accounts, root passwords and recovery codes that must work when SSO is down: storing them in Passbolt or Vaultwarden, splitting access, alerting on use, rotation after each use and testing the procedure.
ISO 27001 Annex A 5.17 covers allocating and managing authentication information. This page maps it to vault policies, sharing rules and offboarding in a self-hosted password manager and the records auditors ask for.
What the HIPAA Security Rule addressable specification on password management means for covered entities, and how a self-hosted vault plus training and policies supports it.
For contractors protecting CUI: how a self-hosted vault supports SP 800-171 requirement 03.05.07 on password management and the related CMMC practices, and what still needs system-level enforcement.
CIS Safeguard 5.2 asks for unique passwords on all enterprise assets. This page shows how a self-hosted password manager makes that practical for shared and service accounts and how to measure coverage.
Requirements for a team password manager: encryption model, sharing and groups, directory sync and SSO, account recovery, audit logs, import from the current tool, browser and mobile clients, backup and which features need a paid edition.
Questions for password manager vendors and partners: what the server can see, recovery when a user loses their key, edition limits, import and export, SSO and SCIM, hosting and backup design, and support for the open-source edition.
Cost of a self-hosted password manager versus per-user SaaS: published Passbolt Pro pricing, free community editions, server and backup costs, rollout and training effort, and who supports the vault after go-live.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.