Keeper Security

GDPR overview

Keeper publishes a dedicated page stating that it is GDPR compliant and describing the compliance work carried out with TrustArc, whose seal it displays. It is certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. DPF for the web client, the mobile apps and the browser extensions, and is audited annually for SOC 2 Type 2 and ISO 27001. A Data Processing Agreement is incorporated into the terms, downloadable as a PDF and available on request. The Data Protection Officer answers at privacy@keepersecurity.com; deletion runs through deleteme@keepersecurity.com and export through exportme@keepersecurity.com. Access, rectification, erasure, portability, objection, restriction and third-party disclosure opt-out are covered, with the Irish Data Protection Commission and the UK ICO named as supervisory authorities. No Article 27 representative is named, although Keeper Security EMEA Limited operates from Cork under Irish law.

Who owns the data?

Vault content stays the customer's. Encryption and decryption happen only on the user's device: the data key is derived from the master password through PBKDF2 with 1,000,000 iterations, or from an elliptic-curve private key under SSO, and every record is sealed with its own randomly generated 256-bit AES key. Keeper states that no employee can ever reach vault data. Legally, Keeper is the controller when it sells directly to consumers and the processor when it sells to organizations, where the employer controls the account and its administrator can access it. Users can export their own data from the Web Vault in CSV or PDF; Keeper cannot decrypt it on their behalf.

Reuse rights

Keeper states it never mines vault data, by policy and because its architecture makes reading that data impossible, and that collection is limited to what is needed to run the account and provide support. The terms do allow Keeper to collect and analyze aggregated, anonymized usage, telemetry and operational data, provided it contains no Customer Data and cannot identify the customer. Confidential information may only be submitted to AI tools inside a secure, access-controlled environment that does not train models on it. Keeper says it does not sell or share personal information under US state privacy laws, and carries out no automated decision-making or profiling with legal or similarly significant effects. Cookie consent can be withdrawn and marketing opt-out is available at any time. Within those limits customers reuse, share and export their own vault data freely, without asking permission.

Data retention & training

Hosting summary

Hosting is entirely on AWS, on hardened infrastructure spread over several regions. A business customer selects a primary region at the outset, among the United States, US GovCloud, Europe, Australia, Canada and Japan; consumers pick their data center on the account creation screen. Each primary region replicates across multiple availability zones and regions: the US commercial region uses East and West sites, as does US GovCloud, Europe uses Ireland and Frankfurt, Australia falls back to Canada, Canada replicates internally, and Japan is primary in Tokyo with replication to Osaka. Data and access are isolated in the selected region, which Keeper sums up as EU data stays in the EU. Everything is encrypted in transit with TLS and at rest with AES-256, on top of the zero-knowledge model in which keys never leave the user's device. Jurisdiction follows the contracting entity rather than the hosting region: Keeper Security, Inc. in the United States, Keeper Security EMEA Limited in Ireland and Keeper Security APAC KK in Japan.