Keeper Security
Zero-knowledge password, secrets and privileged access management platform for consumers, enterprises and MSPs.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001 | Not published | Information management system and cloud infrastructure. Version year, auditor and dates not published. | — | — | Current |
| ISO/IEC 27017 | Not published | Cloud security controls. | — | — | Current |
| ISO/IEC 27018 | Not published | Cloud PII protection. | — | — | Current |
| SOC 2 Type 2 | AICPA framework; auditor not published | Keeper states it has held SOC 2 certification for over ten years. | — | — | Current |
| SOC 3 | Not published | Announced 2025; listed among Keeper’s attestations. | — | — | Current |
| FedRAMP High | FedRAMP | Keeper ICAM & Identity Security Platform for Government, in AWS GovCloud. Marketplace ID FR2116544598A. Upgraded from Moderate. | — | — | Current |
| GovRAMP High Authorized | GovRAMP | Via reciprocity; TX-RAMP certified separately. | — | — | Current |
| FIPS 140-3 | NIST CMVP | CMVP certificate #4743. | — | — | Current |
| PCI DSS Level 1 | Not published | Listed on the Keeper security page; QSA and AoC not published. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Partial
Listed with ISO 27017 and 27018; version year, auditor and dates not published.
SOC 2 Type 2
Partial
Long-standing SOC 2 Type 2 plus SOC 3; auditor not published.
PCI DSS v4.0
Partial
PCI DSS Level 1 stated; QSA and AoC not published.
GDPR 2016/679
Partial
Explicit customer-selectable data residency and TrustArc Privacy Certified.
Data Handling
Data Residency Regions
US, US_GOV, EU, Australia, Japan, Canada — customer selects primary region
Encryption at Rest
No
Encryption in Transit
No
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| Dec. 14, 2017 | Google Project Zero found a privileged UI injection flaw in the Keeper browser extension that allowed a malicious site to steal stored credentials. | Affected the browser extension, which was at the time being bundled with some Windows 10 images. | Patched within roughly 24 hours in version 11.4. Keeper sued Ars Technica over its reporting and later dropped the suit — a reputational footnote rather than a technical one. | — |
Legal & Privacy
- Privacy Policy View ↗
Contact & Responsible Disclosure
- Bug Bounty Platform Bugcrowd (VDP and bug bounty)
Assurance position
The most extensive certification set in this part of the library, with **explicit, customer-selectable data residency** (US, US_GOV, EU, Australia, Japan, Canada) — unusually clear for this category. Quarterly penetration testing by NCC Group and CyberTest.
Dates and auditor firms are not published for the ISO and SOC items. **No public evidence** of a breach of Keeper’s vaults or its zero-knowledge architecture.
Copyright © 2026 SnapGRC