# Keeper privacy rating

Closed source password manager from Keeper Security with apps for desktop, mobile and browsers. Records are encrypted on the device with per-record keys, and the company also sells secrets and privileged access management for businesses.

## Summary

Keeper scores 45 out of 100 (grade D) on the password managers criteria. It meets 5 of 11 criteria: no ads or data sales, TLS configuration, security headers, end-to-end encrypted vault and full export. It partly meets local or self-hosted option. It does not meet open source, no trackers or telemetry, independent audit, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://www.keepersecurity.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Windows, macOS, Linux, Android, iOS, Web
- Home page trackers: Google Fonts (not scored), Google Tag Manager, HubSpot
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: D (45/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The apps have no known trackers, but the website loads Google Analytics, Google Tag Manager, Facebook, Bing and LinkedIn tracking. | https://www.keepersecurity.com/legal/terms-of-use/?s=privacy |
| No ads or data sales | Yes | Funded by subscriptions, and the privacy policy says Keeper does not sell or share personal information. | https://www.keepersecurity.com/pricing/personal-and-family.html |
| Independent audit | No | Third-party penetration tests are described, but no audit report is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=keepersecurity.com&hideResults=on |
| Security headers | Yes | Grade A+ (120/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=keepersecurity.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Records are encrypted on the device with AES-256 keys that Keeper does not hold. | https://docs.keeper.io/enterprise-guide/keeper-encryption-model |
| Local or self-hosted option | Partial | Vaults are stored only in the Keeper cloud. Data can be exported. | https://docs.keeper.io/user-guides/export-and-reports/vault-export |
| Full export | Yes | Exports to CSV, JSON, PDF and encrypted KeePass files. | https://docs.keeper.io/user-guides/export-and-reports/vault-export |

Source: https://privacyratings.com/password-managers/keeper/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/keeper.md