Bitwarden Enterprise Vendor Report

Bitwarden brings security to tens of thousands of businesses globally, providing them with a world-class product, enterprise-level service, and a trusted partnership. Companies considering Bitwarden may have questions about how Bitwarden operates, for their own department or for procurement requirements. This vendor report helps as an evaluation tool for those looking to bring valuable Bitwarden password security to their business.

Organizational structure

The Bitwarden organization is headed by CEO Michael Crandell, supported by Founder and CTO Kyle Spearrin, CFO Stephen Morrison, and CCO Gary Orenstein. Mr. Spearrin leads the engineering organization, inclusive of QA and DevOps, and the product team. Mr. Orenstein heads sales, marketing, and customer success. Bitwarden is a growing organization and is actively adding top talent to the company.

Financial viability

Bitwarden has millions of users, tens of thousands of business customers, and recently received a $100M growth investment to further develop the strong and growing business.

Experience with many types of businesses

Bitwarden works with customers of all sizes, including some of the world’s largest businesses and organizations, across many industries. Public customer materials are posted on the reviews and success stories page.

Partnership experience

Bitwarden supports partnerships and integrations with channel and technology solutions. Bitwarden most recently partnered with DuckDuckGo to provide a password management solution for their new browser.

Zero knowledge architecture

Bitwarden delivers an end-to-end, zero-knowledge encryption architecture. This means that nobody at Bitwarden or anyone else can view any sensitive data in your vault, and all vault data is encrypted.

Encryption at rest

Two additional rounds of encryption execute on stored data, securely hosted on Microsoft Azure servers.

High-trust encryption standards

Bitwarden employs AES-256 CBC for vault data and encryption key.

High level of entropy for encryption

User-input master passwords are hashed and cryptographically stretched to a 256 bit master key.

High level of KDF iterations

By default, Bitwarden utilizes PBKDF2 for key-derivation with 600,000 iterations which may be set higher by end-users.

Code auditing and penetration testing

Bitwarden code is open source and third party audited, with report results published online.

Compliance

The Bitwarden Security and Compliance Program is based on the ISO 27001 Information Security Management System (ISMS). The Bitwarden Security Whitepaper provides an in-depth view of Bitwarden compliance and security.

Bitwarden also completes a wide range of compliance certifications including SOC 2, GDPR, CCPA, HIPAA as well as penetration testing, code testing, and other third party audits.

Administrative capabilities

Users with administrative roles have a wide range of management tools available, showcased in the Proof-of-Concept checklist, and include account creation, system-wide policy creation, Login with SSO, Admin Password Reset, group and user sync, event logs and vault health reporting.

Export logging for SIEM functionality

Bitwarden allows for the exporting of audit logs and the use of multiple APIs to pull data into SIEM tools, such as Splunk for automated monitoring.

Detailed information on data security

The Bitwarden Security Whitepaper provides in-depth details of the security behind Bitwarden, including encryption, dataflows, cloud security, and more.

Backup longevity

Bitwarden maintains point-in-time restore (PITR) policies for disaster recovery. Data storage on Bitwarden servers is configured for a strict 7-day retention policy for PITR with no long-term retention.

Stored PII data and maintenance

Administrative data allows for account maintenance and service.

Ease of use and autofill

Autofill functions in browser extensions and mobile apps. In browser extensions, a hotkey, context window, or interaction with the extension triggers autofill. These methods are non-intrusive to the coding of the web page being viewed.

On mobile, Bitwarden acts as an autofill service provider, and integrates into the mobile device operating system.

Custom fields for autofill may also be created as part of a vault item.

Administrator policies

Enterprise policies allow Enterprise organizations to enforce security rules for all users. Additional policies can be utilized through Login with SSO, taking advantage of your existing IdP authentication functionality.

Control and audit data sharing

Share within an organization via groups and collections. Bitwarden Send offers a way to transmit data securely to anyone and maintains zero-knowledge encryption. If desired, Send can be disabled via an organization-wide Enterprise policy.

Permissions determine what actions a user can take with the items in a particular collection. User roles are set at an individual-member level, and permissions can either be set for an individual member or for a group as a whole.

Event logs record over 50 different types of events. The event logs screen captures a timestamp for the event, client app information including application type and IP, the user connected to the event, and an event description.

Dark web and breach reports

Reports detail data breaches and more for individual user vaults and to admins for organization vaults.

Ability to use 1 credential for multiple URLs

Credentials may have multiple URIs assigned for use on multiple sites.

Ability to use multiple credentials for 1 URL

The user interface for Bitwarden clients lists the available logins for a website. The autofill hotkey can also be used to cycle through credentials quickly.

Re-authentication timers

Turning on the Vault timeout policy will implement a maximum vault timeout duration and timeout action.

Random password generation

Bitwarden clients include a built-in password generator to easily create strong, unique passwords and save them to the vault. The web-based Bitwarden generator offers the same generation logic as a free utility for anyone.

Timebound sharing capability

Bitwarden Send can be used to distribute one-off and time-bound files or attachments. Bitwarden Secrets Manager enables advanced lifecycle credential management.

Bitwarden has composed a proof-of-concept checklist to help evaluation teams get started. Including resources on:

• Policies

• SSO

• Migration

• Managed Devices