Psono is an open-source password manager focused on teams, developed by esaqa GmbH, a small German limited company (Nuremberg register HRB 37978, managing director Sascha Pfeiffer) and offered both self-hosted (Community Edition under Apache 2.0, a separately licensed Enterprise Edition) and as SaaS from Google Cloud/AWS. Its security documentation describes a zero-knowledge design — vault items are encrypted in the browser with NaCl before upload and the datastore key is derived from the master password via scrypt — and its privacy policy states data is shared with no one except to comply with German law, protect its rights and develop the product, listing only infrastructure processors (GCP, AWS, Cloudflare, Brevo, Freshdesk). Caveats: the psono.com site runs Google Analytics (with server-side IP truncation), the iOS privacy label declares email, user/device IDs and diagnostics linked to identity, the default favicon service receives the domain of each vault entry, and self-hosted Enterprise Edition servers contact esaqa's license server on startup. Psono publishes annual third-party audits with named firms and full reports (Cure53 2025 and 2026, X41 D-Sec 2024, earlier Trovent and Linkspirit), each with published severity counts, but has no SOC 2 attestation and no funded bug bounty; no breach or regulatory action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
COLLECTION
The App Store listing for Psono Password Manager (seller esaqa GmbH) carries a developer-declared privacy label of "Data Linked to You" for Contact Info (email address), Identifiers (user ID, device ID) and Diagnostics (crash, performance and other diagnostic data), all under the App Functionality purpose; no "Data Used to Track You" category is declared.
Psono's security page describes a client-side (zero-knowledge) design: vault items such as passwords and notes are encrypted in the browser with NaCl authenticated encryption before being stored on the server, the datastore key is derived from the user's password with scrypt, and the server never receives plaintext secrets — so the operator's collection is limited to account metadata rather than vault contents.
Psono's privacy policy (last updated May 20, 2024) states the operator does not ask for information it does not really need, but enumerates what the psono.com website and SaaS collect: IP address, browser/OS, language, request metadata, referrer, contact information and email address, and a "data profile regarding your online behavior on our website"; account holders must additionally supply an email address, and name, address and payment information are collected on orders. The policy notes it applies only to psono.com, so a self-hosted Psono server is governed by whoever operates it.
The Psono server repository's LICENSE.md publishes the Community Edition server under the Apache License, Version 2.0, copyright 2017 Sascha Pfeiffer; the README notes the canonical source is hosted on GitLab.com under the esaqa group with GitHub as a mirror. The Enterprise Edition (LDAP/SAML/SCIM, audit logs, gateway) is a separately licensed commercial build.
Psono's legal notice identifies the operator as esaqa GmbH, Tiergartenstr. 13, 91247 Vorra, Germany, managing director Sascha Pfeiffer, registered with the Nuremberg Registry Court under HRB 37978 (VAT ID DE333156173) — a single small German limited company traceable through the commercial register.
Psono's enterprise page discloses the funding model: the product is free for up to 10 users, and paid enterprise licensing starts at EUR 2 per user for teams of at least 25 users, with SaaS or on-premises deployment — i.e., the company is funded by business licences rather than advertising or disclosed outside investment.
Psono's security page states that beyond client-side vault encryption, the application server encrypts private account data such as the email address before it is written to the database, that transport uses an additional Psono encryption tunnel inside TLS with forward secrecy, that the cloud service runs on AWS and GCP, and that nightly backups of the psono.pw service are restricted to a very limited number of people — an architecture in which the operator holds only ciphertext for vault contents.
Psono's admin FAQ documents that a self-hosted Enterprise Edition server contacts esaqa's license server (license01.psono.com, fronted by Cloudflare) on startup, sending the instance's PUBLIC_KEY to obtain a free 10-user license — a routine outbound connection from otherwise self-hosted deployments, avoidable only via an offline license code offered to paying customers.
Psono's privacy policy states that personal data is not given to third parties without a legal basis or explicit consent, and that information is shared with no one except to comply with German law, protect the company's rights and develop the product; it also reserves the right to use IP-based usage information for statistical analysis and to display or provide anonymized statistics to others, and notes that Google, as the Google Cloud Platform host, has access to all information the application itself has (IP, email, browser information).
Privacy Guides lists Psono among its recommended cloud-based password managers (alongside Bitwarden, Proton Pass and 1Password), noting it is free and open source, Germany-based, team-focused, self-hostable, and added passkey support for the browser extension in April 2024. Cited for the listing only.
Psono's admin FAQ states that Psono has not yet been audited under SOC 2 / SOC 3, relying instead on SOC-compliant infrastructure providers such as Google Cloud Platform, and points to its own ASVS self-audit (answered March 2018 against ASVS 3.0.1) as a supplementary artifact.
In a blog post dated July 22, 2024, Psono disclosed that X41 D-Sec GmbH conducted a source-code review and dynamic test in June 2024 focused on cryptography, finding four vulnerabilities (one High, three Medium) and one non-security issue, with the full report linked; the blog index also lists earlier annual audits by Trovent (2023) and Linkspirit (2022).
In a blog post dated March 29, 2025, Psono published a Cure53 white-box penetration test and source-code audit (report March 2025) of its Chrome, Firefox and Edge extensions and backend API: eight issues including one High and three Medium severity, all reported as fixed and verified by Cure53, with the public report PDF linked.
In a blog post dated March 25, 2026, Psono published the results of a Cure53 white-box penetration test and source-code audit (Cure53 report March 2026) covering the Psono Console UI, API and Admin components: twelve findings (3 vulnerabilities, 9 miscellaneous), highest severity Low, all addressed and validated by Cure53, described as the third Cure53 assessment, with the full PDF linked.
Psono's Enterprise Edition installation documentation ships a sample settings.yaml whose favicon-service option (default https://favicon.psono.com/v1/icon/, with Google's favicon endpoint offered as an alternative) warns that the first URL filter of each vault entry — a domain or IP — is sent to the configured service, meaning even a self-hosted server can leak which sites a user stores credentials for unless an operator hosts their own favicon server.
Psono's privacy policy discloses that the psono.com website uses Google Analytics with cookies to identify and track users and their behaviour, mitigated by a server-side tag manager that truncates IP addresses before processing; the same policy lists Brevo (email), Freshdesk (support tickets, including IP and email), Cloudflare (DDoS proxy) and Google Cloud Platform (hosting) as services that handle user data.