Security at Passfolio
How we protect your clients' logins: AES-256-GCM encryption of every secret, per-client permissions, a log of who viewed what and the guarantee that you can take your data whenever you want.
The problem
You store other people's logins: your clients trust you. You need to know what's protected, how, and what you can do if something goes wrong.
How it works
- 1
Every secret is encrypted
Passwords, API keys, 2FA keys and card numbers and security codes are stored encrypted with AES-256-GCM, each with its own initialization vector.
- 2
Everyone sees just enough
Permissions are per client: nobody sees a client they weren't added to.
- 3
Every reveal is logged
Viewing a password, a 2FA code or a full card is recorded in the activity log.
- 4
Your data is yours
Export everything whenever you want, on any plan, and if the service ever shut down, we'd give 90 days' notice.
Details
- Encryption currently happens on our servers: the system decrypts a secret only when someone with permission asks for it.
- Service names, usernames, links and notes are not encrypted; don't keep secrets in notes.
- The 2FA code is computed on the server and the secret key never reaches the browser.
- Copied passwords are cleared from the clipboard after 45 seconds.
- Exporting or transferring asks you to confirm your identity.
- You can sign in with Google, Apple or email and password, and delete your account from the app.
Frequently asked questions
Who can see my passwords?
The people on your team with access to that client. Passwords are stored encrypted and decrypted only when someone with permission asks for them, and every time is logged.
What happens to my data if I stop paying?
Nothing is deleted. The account goes back to the Free plan and you can keep viewing and exporting everything.
What if Passfolio shuts down?
We'd give 90 days' notice so you can export everything.
Related
Team activity log
See who viewed, copied or changed each of your clients' logins in the last 90 days. Filter by client, by person or by type of action.
Export or transfer everything to the client
When you finish with a client, you hand everything back in order: export their logins to a file or transfer the whole client to their own Passfolio account.
Your team, with just the right permissions
Invite each person to the whole workspace or only to the clients they handle, as admin, editor or read-only. Everyone sees only what they need.
Get your clients' logins in order today
Create your free account in a minute. No card needed.
Start for free