Credential management for government and public sector

Bitwarden has committed to achieving FedRAMP Class D (High) Certification, and more details are available in the announcement.

Agencies subject to FedRAMP or GovRAMP requirements are able to deploy a self-hosted version of Bitwarden on their own compliant servers. This deployment works in offline and air-gapped environments as well.

Vault health reports (available on all paid plans) can be used to evaluate the security of your Bitwarden individual or organisation vault and include exposed, reused and weak passwords, insecure websites, inactive two-step login, and data breach reports.

• https://bitwarden.com/help/reports/

Bitwarden uses AES-CBC 256-bit encryption for your Vault data, and PBKDF2 SHA-256 to derive your encryption key. For more information, see the Bitwarden Security Whitepaper.

• https://bitwarden.com/help/what-encryption-is-used

• https://bitwarden.com/help/bitwarden-security-white-paper/

Yes, logging in with SSO allows Enterprise organisations to use their existing Identity Provider to authenticate users with Bitwarden using the SAML 2.0 or Open ID Connect (OIDC) protocols.

• https://bitwarden.com/help/about-sso/

• https://bitwarden.com/help/configure-sso-saml/

• https://bitwarden.com/help/configure-sso-oidc/

Event logs are timestamped records of events that occur within your Teams or Enterprise organisation. Event logs are exportable, accessible from the /events endpoint of the Bitwarden Public API, and are retained indefinitely. Event logs record more than 50 different types of events and capture a Timestamp for the event, client app information including application type and IP (accessed by hovering over the globe icon), the User connected to the event, and an Event description.

• https://bitwarden.com/help/event-logs/

• https://bitwarden.com/help/public-api/

Bitwarden supports a comprehensive set of integrations to enhance security and streamline operations, including:

• Single sign-on integrations: Connect Bitwarden with leading identity providers for seamless authentication.

• Directory integrations: Synchronise users and groups effortlessly from your directory services.

• Event monitoring integrations: Link Bitwarden with your preferred SIEM tools for enhanced monitoring and analysis.

• Multi-factor authentication (MFA) integrations: Add an extra layer of security with various MFA options.

• Email alias integrations: Simplify privacy with integrated email alias providers.

• Bitwarden Secrets Manager integrations: Securely integrate your CI/CD pipelines and infrastructure with Bitwarden Secrets Manager.

For information on Bitwarden's approach to security and underlying architecture (including data flow diagrams), see:

• Bitwarden Architecture presentation in Google Slides

• Bitwarden Security White Paper

Bitwarden Secrets Manager is built for developer teams to centrally store, manage, and deploy privileged secrets. Secrets Manager is tailored for infrastructure secrets and is supported only by the web app and the CLI clients. If you are looking to help your employees manage their personal credentials, check out Bitwarden Password Manager.

Bitwarden Secrets Manager enables teams to securely provision AI agent access to predetermined development secrets for use in scripts and CI/CD pipelines. By replacing plaintext API keys and other secrets with Bitwarden-generated secret ID strings, you can help prevent AI agents from gaining unauthorised access to credentials and ecosystems.

Learn more about how to use Bitwarden Secrets Manager to protect environment variables from agent access.

Bitwarden Access Intelligence is a comprehensive offering built to protect the whole organisation from credential-related risks. With Bitwarden Access Intelligence, proactively identify credential risks, prioritise critical applications, guide employees to update passwords, and measure security improvements.

Bitwarden protects your business credentials through several key features:

1. End-to-End Encryption: Bitwarden provides a secure, end-to-end encrypted vault for storing and sharing credentials such as usernames, passwords, and other sensitive data. This ensures that only authorised users can decrypt and access the information using their master password.

2. Password Management: Bitwarden helps businesses manage passwords by allowing employees to generate, store, and share strong and unique passwords. This is crucial for protecting against data breaches, especially when combined with two-factor authentication (2FA).

3. Security Features: Bitwarden offers vault health reports to detect at-risk credentials, such as exposed, reused, or weak passwords. This enables IT admins to notify employees and replace weak credentials with strong, unique ones using the built-in password generator.

4. Single Sign-On (SSO) and Multi-Factor Authentication (MFA): Bitwarden integrates with SSO providers like Duo, enhancing security by reducing the number of passwords employees need to manage and providing additional authentication layers.

5. Administrative Controls: Bitwarden allows for comprehensive administrative controls, enabling organisations to manage credentials centrally while allowing user-centric usage. This includes monitoring and reporting features to track credential usage and security.

6. Credential Lifecycle Management: Bitwarden provides tools for managing the entire lifecycle of credentials, from creation to deletion, ensuring that credentials are securely managed and that access is revoked when no longer needed. 

These features collectively help businesses maintain a strong security posture by protecting sensitive credentials from unauthorised access and potential cyber threats.

Yes, Bitwarden is compliant with several regulatory standards. It adheres to industry security standards and holds certifications such as ISO 27001, SOC 2 Type II and SOC 3. Bitwarden is also compliant with privacy regulations such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and the Health Insurance Portability and Accountability Act (HIPAA). Additionally, Bitwarden complies with the Data Privacy Framework (DPF), which was previously known as Privacy Shield, ensuring the safe transfer of personal data.

Yes, you can self-host Bitwarden to have complete control over your data. Self-hosting allows you to manage business credentials and custom security policies on your own server. This setup provides true data sovereignty, enabling you to apply your own security model, control backups, and ensure availability according to your specific needs. You can place your Bitwarden installation behind a proxy, firewall, and other safeguards for enhanced data security.

Self-hosting Bitwarden is particularly beneficial for organisations with strict data compliance requirements, as it allows you to meet specific compliance and internal data residency policies. It also offers the flexibility to integrate with your existing IT infrastructure, including directory services and identity providers. However, it requires technical resources and expertise to manage server maintenance, security, and updates.

Directory Connector (downloadable application available for all business plans) will query the source directory and provision and deprovision users, groups, and associations. SCIM (available in the web vault for business plans) will automatically push updates to Bitwarden, to provision or revoke users.

• https://bitwarden.com/help/directory-sync/

• https://bitwarden.com/help/about-scim/

Bitwarden administrators can enforce enterprise policies, including master password complexity requirements, two-factor authentication mandates, personal vault usage restrictions, password generator settings, single organisation limitations, vault export controls, SSO authentication requirements, account recovery options, and passwordless login enforcement. Policies are configured before user onboarding and apply organisation-wide to maintain security standards.

Bitwarden regularly conducts comprehensive third-party security audits with notable security firms. These annual audits include source code assessments and penetration testing across Bitwarden IPs, servers and web applications.

Learn more >