Bitwarden stores data within the EU, but the vendor is based outside the EU and may be covered by third-country legislation (for US companies: the CLOUD Act) regardless of server location. For non-sensitive data this is rarely a problem, but for customer data you should weigh the risk.
EU/EEAPasswords & securityFreemiumEU data storage ✓ISO 27001
Simple and affordable password manager from Nord Security with ISO 27001, SOC 2 Type 2 and EU data storage in AWS data centers for business customers. At the same time, the source code is closed and the holding-company ownership structure is hard to see through, so the sovereignty picture is less clear than the marketing suggests.
EU company with EU data storage via AWS data centers
ISO 27001 certified and SOC 2 Type 2 audited, code audited by Cure53 (2020)
Not open source
Best for: Small businesses that want an easy-to-use EU-based password manager without having to dig into the technology
Yes, Bitwarden offers data storage within the EU/EEA.
Is Bitwarden covered by the CLOUD Act?
The vendor is based outside the EU. US companies are covered by the CLOUD Act regardless of server location; see the tool page for details.
What is needed to use Bitwarden in a GDPR-safe way?
Sign a data processing agreement (DPA) if the tool processes personal data on your behalf, minimise the personal data you feed in, and check the vendor's sub-processors. See our DPA guide for the steps.
Our assessment is based on verified data about vendor, storage and certifications (2026). GDPR compliance also depends on how you use the tool. This is guidance, not legal advice. See How we review.
