A password manager becomes shared business infrastructure: it keeps credentials available, distributes them to authorised people and must still work when a device is lost or someone leaves. These tasks determine whether a cloud service or self-hosting is suitable.
Clarify responsibility before choosing a product
Imagine a business with ten employees: accounting, assistance and management need different supplier and administration accounts. A second person must be able to cover an absence. Individual user accounts, traceable sharing permissions and a working recovery route are essential. One private vault with a master password known to everyone does not meet these needs.
A company with, for example, 60 employees often adds directory integration, groups, multiple administrator roles and defined onboarding and offboarding. These sizes are hypothetical examples, not product limits. Even a small business can need complex permissions. The solution should follow the organisation.
Cloud or self-hosting: who handles what?
With a cloud service, the provider operates the central platform. The business still manages accounts, devices, roles, sharing permissions and emergency procedures. A self-hosted server additionally brings installation, updates, monitoring and recovery into your own area of responsibility. Internal IT or an agreed external service can handle this.
Self-hosting gives flexibility over server location and network connectivity. It does not automatically improve security: an unmaintained server or an unusable backup gains nothing from being on your own premises. Likewise, a professionally operated cloud platform does not replace sound permissions management. Both models need a responsible person and a substitute.
Assess four providers objectively
The following selection is not a ranking. Recovery, SSO, automated user management and reporting must be checked for the specific plan offered. Features of different tiers are not presented as universally included.
| Solution | Operating model compared | Functional approach | Check in the actual offer |
|---|---|---|---|
| Bitwarden | Cloud or official self-hosting | Organisations and collections for shared access. | Appropriate Enterprise licence for business self-hosting; policies, SSO and recovery. |
| 1Password | Managed cloud service | Shared organisation vaults; choice of data region. | Permissions in the chosen plan, recovery process and identity integration where relevant. |
| Keeper | Managed cloud vault | Central user, role and team management. | Required add-ons, account transfer, roles and actual data region; assess local supporting components separately. |
| LastPass | Managed cloud service | Business administration with groups and shared folders. | Plan differences in policies, reporting and directory integration; test recovery beforehand. |
Licensing needs separate attention for official Bitwarden self-hosting. The current guide lists Families and Enterprise organisations for import onto a self-hosted server; business planning requires checking the appropriate Enterprise contract. A Teams cloud licence therefore does not automatically authorise an equivalent self-hosted organisation. Licence maintenance and any required cloud communication remain separate operational tasks. Bitwarden: self-hosted organisations (external link), Bitwarden: licensing (external link).
A community implementation with a similar protocol is a separate project. It does not establish official manufacturer support or identical Enterprise features. Anyone considering that route must assess maintenance, compatibility and responsibility separately.
Total costs extend beyond the pricing page
Compare the same requirements over a common period. Include user licences, necessary add-ons, implementation, device deployment, training and ongoing administration. Self-hosting additionally involves server resources, updates, backups, monitoring, recovery tests and cover arrangements. Existing hardware does not make this work free.
A sound comparison also records who responds to an incident and what recovery time is agreed. Provider prices, billing cycles, minimum quantities and support scope must be checked in the actual offer. This article therefore gives neither supposedly permanent list prices nor a blanket winner.
Include roles, MFA and recovery in the pilot
A small pilot should include a normal workplace, an authorised substitute and an administrative role. Test shared access, a permission change, device loss and a test user’s departure. Choose appropriate multifactor methods for everyday work and particularly powerful administrative access.
Recovery is not one uniform product feature: who can restore access to which account or company data? Must the feature be enabled beforehand? Which independent means of access are needed? The emergency route must not exist solely inside the vault it is meant to reopen. Own servers also need a tested recovery route from backup.
Revoking vault permissions does not erase copied passwords from memory or other files. Shared target accounts may therefore require a password change at the actual service. Where a service supports personal accounts, individual identities provide a more traceable foundation.
Also assess server location, contracts and provider changes
A selectable European storage location is a technical selection criterion. It does not replace scrutiny of contracts, subprocessors, support access and actual data flows. A self-hosted server may still need external services for licences, notifications or identities. Neither “cloud” nor “local” supports a blanket data-protection promise.
An exit scenario includes a suitable export, protection against unencrypted copies and a documented migration of shared vaults. Also check attachments, sharing permissions and devices. Export files can contain highly sensitive information and require a restricted, protected procedure.
A practical next step with DAXS
DAXS helps inventory existing access, define a manageable role model, compare suitable operating models and run a pilot with handover. The outcome is a reasoned choice and clear responsibility for implementation and operation. The scope of services is agreed for your environment.
Introduce secure password management · Plan workplaces and collaboration · Ongoing IT support · Include permissions when using AI
Frequently asked questions
Is your own server inherently more secure?
That depends on architecture, protection, maintenance and recovery. Self-hosting expands your responsibilities. Verifiable operational evidence is more meaningful than location alone.
Can administrators automatically read every password?
That depends on the product, vault type, permissions and prepared recovery features. User administration, shared-data access and account recovery require separate assessment.
Does SSO replace a password manager?
SSO simplifies sign-in to connected services. Other portals and shared credentials may still require a properly managed vault.
Sources: 1Password: shared organisation vaults (external link) · 1Password: data regions (external link) · Keeper: administration, roles and teams (external link) · LastPass: Business features (external link).
