Bitwarden
Verified“US-incorporated, open-source — but US-controlled and US-cloud-hosted.”
- Founded
- 2016
- Funding
- $100M (2022)
- Users
- 15M+
- Cloud
- Microsoft Azure
24 = midpoint of Control 20 & Data 27
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 13 sourced facts across 9 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
22
Bitwarden, Inc. is incorporated in Delaware and headquartered in Santa Barbara, California — the controlling legal entity is fully US, with 8bit Solutions LLC (the original developer) wholly owned beneath it. EU law (GDPR) reaches it only via Standard Contractual Clauses and the EU-US Data Privacy Framework for transfers; there is no EU operating entity that anchors enforceability. EU users contract with a US company.
Why 22? 3 sourced facts · click to expand
Incorporated in Delaware; parent of 8bit Solutions LLC
Bitwarden Community Forum / corporate structure · as of 2026-06-12
EU data transfers rely on SCCs and the EU-US Data Privacy Framework
Bitwarden Privacy Policy · as of 2026-06-12
Control & Ownership
18
Privately held and US-controlled. A $100M growth investment in September 2022 was led by US private equity firm PSG (Boston) with participation from Battery Ventures (Boston) — Bitwarden's first disclosed outside funding. Founder/CTO Kyle Spearrin and US-based PE investors hold economic and voting weight; the new CEO (Feb 2026) was brought in from a private-equity background. No EU voting or economic majority; reporting is in USD.
Why 18? 3 sourced facts · click to expand
$100M growth investment led by PSG with Battery Ventures
PSG press release · as of 2022-09-06
Privately held; investors are US-based (PSG Boston, Battery Ventures Boston)
TechCrunch · as of 2022-09-06
New CEO Michael Sullivan (Feb 2026) from a private-equity / M&A background
Fast Company · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
30
The Bitwarden cloud runs on Microsoft Azure in both US and EU regions; AWS and Fastly (both US) also appear as subprocessors. An EU data region (bitwarden.eu, launched 2023) keeps vault data in EU Azure datacenters — genuine EU data residency — but the operator is a US hyperscaler reachable under the US CLOUD Act, so this is 'EU region on a US hyperscaler', not EU-owned infrastructure. Two mitigants lift the score above the typical 20-40 band: (1) zero-knowledge end-to-end encryption means neither Bitwarden nor its subprocessors can read vault contents, and (2) the software is open source and self-hostable on infrastructure of the user's choice, including EU-owned hosts.
Why 30? 4 sourced facts · click to expand
Cloud hosted on Microsoft Azure, US and EU regions
Bitwarden Security FAQs · as of 2026-06-12
Hosting subprocessors: Microsoft (US/EU), Amazon Web Services (US), Fastly (US)
Bitwarden Subprocessors · as of 2026-06-12
EU data region (bitwarden.eu) offers EU data residency
Bitwarden Server Geographies · as of 2026-06-12
No subprocessor or Bitwarden has access to unencrypted vault data (zero-knowledge)
Bitwarden Subprocessors · as of 2026-06-12
Operations & People
22
Operations are US-centered: headquartered in Santa Barbara, a US executive team (CEO Michael Sullivan, founder/CTO Kyle Spearrin, US-based CFO/CSO/CCO), and USD reporting. The workforce is global and remote (~200+ employees worldwide), which gives some EU presence, but the operational center of gravity, leadership, and currency are all in the US.
Why 22? 3 sourced facts · click to expand
Globally distributed remote workforce, ~200+ employees
Bitwarden About Us · as of 2026-06-12
Serves 15M+ users and 80,000+ businesses in 180+ countries
Bitwarden About Us · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Exact post-2022 cap table and voting control — what stake PSG/Battery hold versus founders/management.
Could shift the ownership score if EU LPs or founders hold more economic/voting weight than public reporting shows.
- ?
Whether any EU subsidiary or establishment exists for GDPR/contracting purposes, beyond the US entity using SCCs.
An EU establishment would modestly improve legal enforceability and the legal score.
- ?
Share of the user base and revenue actually hosted in the EU (bitwarden.eu) data region versus the US default.
Higher EU adoption would strengthen the practical data-residency picture, though infra ownership stays US.
- ?
Current total headcount and EU vs US workforce split (sources range ~200-300).
A large EU engineering presence would lift the operations score.
EU Cloud Sovereignty Framework lens
SEAL targets cloud service providers; this is an analogous sovereignty mapping for a password manager, not a certification.
Strategic
US-incorporated, US private-equity-backed; strategic control sits outside the EU.
Legal & jurisdictional
Delaware entity; GDPR reaches it only via SCCs / Data Privacy Framework, with no EU establishment confirmed.
Data & AI
Zero-knowledge E2E encryption and an optional EU Azure data region — but the cloud is a US hyperscaler under the CLOUD Act.
Operational
US HQ and leadership, USD reporting; workforce is global and remote with no EU operational center.
Supply chain
Core subprocessors (Microsoft, AWS, Fastly, Stripe, Twilio, HubSpot) are US-based.
Technological
Open source and fully self-hostable — a real EU exit path — but the managed product depends on US infrastructure.
Security & compliance
Independent audits, SOC 2 / ISO claims, zero-knowledge architecture; strong on security, weak on jurisdictional sovereignty.
Environmental sustainability
No EU-specific sustainability data reviewed; inherits Azure datacenter sustainability.
EU alternatives
Swiss-based, privacy-focused, E2E encrypted. Strong jurisdiction but Switzerland is not in the EU — adequacy-based, not EU law.
German open-source password manager, self-hostable and EU-hostable; EU-incorporated and EU-operated.
Lithuanian engineering roots but the Nord group's holding structure sits partly outside the EU (Panama/UK); jurisdiction is mixed.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology