Keeper Security password manager for business

Keeper Security: the company and its apps

Keeper is made by Keeper Security, Inc. Its about page (opens in a new tab) lists its global headquarters in Chicago, product development in El Dorado Hills, California, and business sales for Europe, the Middle East and Africa in Cork, Ireland. Keeper started as a password manager and now also sells privileged access, secrets management and endpoint privilege products.

Staff use Keeper wherever they work. Keeper's plan comparison lists a browser extension, native desktop apps for Mac, Windows and Linux, and iOS and Android apps, with autofill for "passwords, passkeys, payment cards and 2FA codes across apps and browsers". The vault holds more than passwords: Keeper describes it as storage for "passwords, passkeys, files, photos, infrastructure secrets and resources with zero-knowledge encryption".

Every Keeper business plan also includes a password and passphrase generator.

Keeper's security model and where your data is held

Keeper describes itself as "a zero-knowledge security provider", and its security page (opens in a new tab) explains what that means in practice: "Encryption and decryption of data always occur locally on the user's device", and stored information is not accessible "by anyone else, not even Keeper employees". These are the controls and assurances Keeper publishes:

Data regions. Keeper says "Organisations may host their Keeper tenant in their preferred primary region", and lists United States, United States Government Cloud, Europe (EU), Australia, Japan and Canada; customer data and access to the platform are "isolated to that specific region". UK organisations can choose Europe (EU); Keeper lists no separate UK region. For transfers, Keeper states that it complies with the EU-U.S. Data Privacy Framework and "the UK Extension to the EU-U.S. DPF". Choose the primary region when the tenant is set up.

The NCSC's advice on choosing a password manager is to "pick a reputable company with a strong security track record" and to turn on two-step verification for the account (NCSC: Trusting the tech (opens in a new tab)). Our guide are password managers safe? sets out what zero knowledge does and does not protect against.

Keeper Business Starter vs Business vs Enterprise

Keeper's business page (opens in a new tab) sets out three plans. The main decision is whether you need users created and signed in from your identity provider, which points to Enterprise:

Keeper's separate pricing comparison groups a few of these differently (it lists shared team folders and the Family Plan under Business rather than Business Starter), so we confirm exactly what your plan includes at quote. Across the business plans, Keeper also lists one-time sharing with people who have no Keeper account, time-limited access and self-destructing records, vault transfer when an employee leaves, instant switching between personal and business vaults, and apps for Slack, Jira, ServiceNow and Teams.

How to choose:

• Business Starter suits a small team that wants shared folders and an admin console without directory integration
• Business suits most small and mid-sized organisations: delegated administration lets you hand parts of the console to team leads
• Enterprise suits organisations that manage users in Microsoft Entra ID, Okta, Ping or Active Directory and want accounts created, signed in and removed from there

For a side-by-side view with the other three managers, see compare password managers, or Keeper vs 1Password, LastPass vs Keeper and Keeper vs Bitwarden.

Keeper add-ons and the wider Keeper platform

Keeper sells extra modules on top of the business plans. These are the add-ons it names, with Keeper's own description of each:

Which add-ons suit your plan is confirmed at quote.

KeeperMSP. For IT providers, KeeperMSP (opens in a new tab) manages passwords and security policies for many client companies from one console, "with full isolation between each managed company". Each managed company gets its own enforcement rules, and users can be onboarded "through Active Directory, Azure AD/Entra ID, SCIM or Single Sign-On (SSO)".

Beyond password management. Keeper's other products share the same vault and console. KeeperPAM (opens in a new tab) "combines enterprise password management, secrets management, connection management, zero-trust network access and remote browser isolation"; we cover it on cloud-security.cloud's privileged access management (opens in a new tab) page. Keeper Secrets Manager (opens in a new tab) protects credentials in CI/CD pipelines, containers and scripts. Keeper Connection Manager (opens in a new tab) gives browser-based access to remote desktops, servers and databases, which sits with secure remote access (opens in a new tab). Keeper Endpoint Privilege Manager removes local admin rights on Windows, macOS and Linux, covered under endpoint privilege management (opens in a new tab).

Personal vaults for staff on Keeper Business

Keeper's business page (opens in a new tab) says Keeper Business "Includes a Free Family Plan for each team member", and Keeper's plan comparison adds: "All users can create a free, Keeper Family Plan for up to 5 family members with unlimited devices". With instant account switching, staff move between their personal and business vaults in the same app.

This helps security: personal logins stay out of the work vault, so a leaver's personal accounts stay separate from the business vault the organisation keeps. Keeper's two pages group the Family Plan differently for Business Starter, so we confirm it for your plan at quote.

Keeper set-up best practices

A Keeper rollout goes more smoothly when a few decisions are made before the first user logs in:

1. Choose the primary data region when the tenant is set up: UK organisations can choose Europe (EU), as Keeper lists no separate UK region
2. Decide how people sign in: on Enterprise, connect Microsoft Entra ID, Okta or another identity provider for SAML 2.0 single sign-on and SCIM provisioning; on Business, invite users in batches by team
3. Turn on Account Transfer early. Keeper's documentation says it "should be configured by the Keeper Administrator during the initial deployment phase", because a vault can only be transferred if the user has logged in at least once after the policy was set (Keeper docs (opens in a new tab))
4. Build shared team folders for each department, so finance, marketing and IT see only their own shared logins
5. Set enforcement policies by role or team: two-factor authentication, password strength and sharing restrictions
6. Import passwords from browsers, spreadsheets or another password manager, then ask staff to stop saving passwords in the browser
7. Review the Security Audit and Risk Management Dashboard after the first few weeks to find weak and reused passwords

Our business password policy guide covers the policy side, and switch password manager covers importing from another tool.

How we help with Keeper

Forever Systems can quote and supply Keeper for your business. The plan and add-ons are confirmed at quote. We can:

• Help you choose between Business Starter, Business and Enterprise, based on your team size and your identity platform
• Set up single sign-on and SCIM provisioning with Microsoft Entra ID, Okta or Google Workspace on Enterprise
• Configure policies, roles and shared team folders, and the Account Transfer policy for leavers
• Import passwords from browsers, spreadsheets or another password manager
• Add BreachWatch, reporting or compliance modules if you need them
• Keep licensing in one place: Keeper can be billed monthly, with terms confirmed at quote

Licence options are listed on Keeper Security licensing (opens in a new tab). Contact us for free advice on which Keeper plan fits, or a quote.