Keeper Security review for MSPs and IT teams: vault, PAM, pricing

Updated: November 2026

Keeper Security makes a zero-knowledge password manager and a privileged access platform, KeeperPAM, sold to businesses directly and to MSPs through a multi-tenant console. MSPs weigh it as a credential service they run and bill across client tenants, while in-house IT teams weigh it as one vendor for employee vaults and admin access. This Keeper Security review covers both views, from plans and billing to the security record and who it fits.

TL;DR

• The call. Keeper is a zero-knowledge password manager and privileged access platform for MSPs and in-house IT teams, priced per user, with MSPs billed on daily license usage across managed clients.
• Security. Zero-knowledge, zero-trust encryption with SOC 2 Type II, ISO 27001 and FIPS 140-3, plus FedRAMP High and GovRAMP High for its government cloud. No breach of customer vault data is on record as of November 2026.
• MSP fit. A multi-tenant admin console plus KeeperPAM covers client vaults and privileged access in one place.
• IT team fit. Business at $4 and Enterprise at $6 per user per month (US list, billed annually), with KeeperPAM adding credential rotation, privileged sessions, and local admin removal.
• Watch for. Per-seat costs stack fast across a client base, KeeperPAM pricing is quote-only, and there is no native RMM or PSA credential integration.

What Keeper Security is

Keeper Security is a password manager and privileged access platform built around a zero-knowledge encryption model. It started as a consumer vault for storing logins and grew into an enterprise product line that covers business password management, secrets management, and remote access. For an MSP or an in-house IT team, the relevant part is the business and MSP line, not the personal app reviewed by PCMag or Wirecutter.

The business line in November 2026 has six parts:

• Business and Enterprise password management. The encrypted vault, admin console, sharing, and policy engine, priced per user.
• KeeperPAM. Relaunched in February 2025 as one platform for credential rotation, privileged sessions, remote browser isolation, and endpoint privilege control.
• Keeper Secrets Manager. API keys, certificates, and service account credentials for scripts, CI/CD pipelines, and AI agents.
• Keeper Connection Manager. An agentless remote desktop gateway built on Apache Guacamole, which came with Keeper's February 2022 purchase of Glyptodon.
• Keeper Endpoint Privilege Manager. An agent for Windows, macOS, and Linux that removes standing local admin rights and grants just-in-time elevation.
• Self-Managed Keeper. An on-premises deployment for air-gapped, federal, and OT networks that cannot use Keeper's cloud.

Keeper sells to MSPs through a partner program and a separate admin console designed for managing multiple client organizations. In February 2026, the company launched its 2026 MSP Partner Program, with four tiers (Authorized, Silver, Gold, Platinum) whose discounts rise with annual revenue and certifications, and it enrolled existing partners automatically. That signals Keeper is leaning harder into the managed services channel, which matters if you want a vendor that invests in partners rather than treating them as resellers.

In-house IT teams buy directly from Keeper or through resellers and run the same platform from the standard Admin Console.

Who owns Keeper Security?

Keeper Security was founded in 2011 by Darren Guccione, its CEO, and Craig Lurey, its CTO, and is headquartered in Chicago. It is privately held, backed by Insight Partners since 2020 and by Summit Partners, which made a minority growth investment in May 2023.

How Keeper's zero-knowledge security model works

Zero-knowledge is the core of the pitch, so it is worth being precise about what it means. Keeper encrypts and decrypts data at the device level. Your client's master password and the keys derived from it never reach Keeper's servers. The data sitting in Keeper's cloud is ciphertext that Keeper itself cannot read.

The practical effect for an MSP: if Keeper's infrastructure were breached, an attacker would pull encrypted blobs, not readable vaults. There is no master key on Keeper's side to steal. This is the same architectural model 1Password and Bitwarden use, and it is the baseline you should demand from any password manager touching client credentials.

Keeper backs the model with third-party attestation rather than marketing claims. The platform holds SOC 2 Type II, ISO 27001, 27017, and 27018 certifications and FIPS 140-3 validation (NIST certificate #4976). Keeper Security Government Cloud holds FedRAMP High authorization (December 2025, after FedRAMP Moderate in 2022) and GovRAMP High (February 2026; GovRAMP was formerly StateRAMP). For MSPs and IT teams serving regulated clients or government-adjacent work, note that those two authorizations cover the government cloud, a separate environment from Keeper's commercial cloud, so confirm which one a client needs before you quote.

Core features that matter for client work

Underneath the MSP packaging, Keeper still has to nail the daily basics, and it does. The encrypted vault stores logins, payment cards, documents, and secure notes, organized into shared folders your team can structure by client or by department. Autofill works across browsers and mobile, though reviewers note the extension occasionally fights certain sites, a common password-manager quirk worth flagging to clients.

Secure sharing is where Keeper earns its keep for team use. You can share a credential with a colleague without exposing the underlying password, set time limits, and revoke access the moment a tech leaves or a client offboards. One-time share links let you hand a credential to someone outside the vault without emailing it in plaintext, which kills one of the most common bad habits in IT support.

Two-factor authentication is enforced at the policy level, supporting TOTP apps, FIDO2 hardware keys, and biometrics. For MSPs, the ability to mandate 2FA across a client tenant rather than hoping users opt in is the difference between a policy and a wish. Reporting ties it together, showing weak or reused passwords per tenant so you can turn a security review into a billable remediation.

BreachWatch, Keeper's dark web monitoring add-on, scans for exposed credentials and flags compromised passwords so you can rotate them before they are used. It is an upsell, not included by default, but for clients who want proof you are watching for leaked credentials, it gives you something concrete to report. Secrets Manager and Connection Manager round out the set for teams handling infrastructure credentials and remote sessions, not just human logins.

Keeper Security pricing and plans

Keeper lists its Business Starter, Business and Enterprise plans on its pricing page, billed annually. KeeperPAM and KeeperMSP are sales-only. US list prices, read on November 3, 2026:

Add-ons are billed separately on the password plans: BreachWatch (dark web monitoring), Advanced Reporting and Alerts, Compliance Reporting, Secure File Storage, Secrets Manager, and Connection Manager each carry their own line item. KeeperPAM bundles several of them, including dark web monitoring, advanced reporting, and compliance reporting. That modularity is flexible, but it means the sticker price is rarely the final price. Plan for the upsell conversation.

For MSPs specifically, Keeper doesn't publish its MSP pricing, so confirm per-seat rates with Keeper's MSP team before you build client quotes. The billing model is public, and the next section covers it. If you want a wider look at how these tools price out, this breakdown of password managers for MSPs covers the field.

How KeeperMSP billing works

KeeperMSP bills on consumption. Keeper tracks each managed company's daily license usage and invoices the MSP monthly in arrears, with no long-term commitment on licenses, so you pay for licenses allocated to users rather than a prepaid block. MSPs that buy through a distributor still get the monthly usage invoices, without prices shown on them.

On the PSA side, Keeper connects to Gradient MSP, which syncs each client's Keeper usage into ConnectWise Manage, Autotask, BMS, Syncro, Pulseway, HaloPSA, and other PSAs for billing reconciliation. KeeperMSP also has a free trial for MSPs that want to test the console before signing.

Keeper for MSPs: the admin console and multi-tenant management

This is where Keeper separates from a consumer tool. The KeeperMSP admin console gives you a parent account that manages multiple "managed companies," each one a walled-off client tenant. You provision a new client, set role-based access policies, push enforcement rules, and monitor vault activity without logging into each client environment separately.

Each managed company keeps its own isolated encryption boundary. A technician with access to Client A's tenant does not see Client B's vaults. Role-based access control and team folders let you mirror a client's org chart, so the accounting team's shared logins stay separate from the field techs' credentials. For an MSP juggling 20 or 40 client tenants, that isolation plus central oversight is the whole point.

Provisioning scales through SCIM and Active Directory integration, so onboarding a client with 200 employees does not mean creating 200 accounts by hand. Enforcement policies (master password complexity, 2FA requirements, session timeouts, IP allowlisting) apply per tenant or across your whole book. The audit and reporting layer captures who accessed what and when, which is the evidence you need when a client asks for a security review or an auditor comes knocking.

In-house IT teams get the same controls in the standard Keeper Admin Console, where nodes split the organization by region, subsidiary, or department instead of by client, and delegated admins manage their own node.

Keeper's own four-minute overview of KeeperMSP shows the console in use:

KeeperPAM: privileged access for MSP work

KeeperPAM is Keeper's privileged access management product, and it is the feature that pushes Keeper past being "just a password manager." For MSPs, privileged access is the high-stakes problem: domain admin credentials, firewall logins, hypervisor consoles, and service accounts that, if leaked, hand an attacker the keys to a client's entire environment.

KeeperPAM rolls several capabilities into one cloud-native platform: enterprise password management, secrets management for API keys and certificates, connection management with session recording, zero-trust network access, and remote browser isolation. In February 2025, Keeper relaunched KeeperPAM with these in a single interface rather than bolted together, and Self-Managed Keeper now covers networks that cannot use the cloud.

The MSP value is removing standing privileged access. Instead of a tech holding a permanent domain admin password, KeeperPAM can broker a time-bound session, record it, and rotate the credential after. Session recording and detailed logs give you an audit trail per privileged action. For MSPs moving toward zero-trust delivery or carrying cyber insurance requirements around privileged access, that capability is hard to assemble from a basic vault.

For in-house IT teams, the piece that changes daily work is Endpoint Privilege Manager, included in KeeperPAM: an agent on Windows, macOS, and Linux removes standing local admin rights and grants just-in-time elevation when a user needs to install or change something. Our guide to endpoint privilege management covers how that model works.

The catch: KeeperPAM is quote-only and sold through Keeper's sales team. Expect enterprise PAM pricing, not password manager pricing. You apply it to the handful of privileged accounts that warrant it, not your whole client headcount.

KeeperPAM vs CyberArk, BeyondTrust, Delinea, and StrongDM

KeeperPAM's difference is scope under one roof: the password vault, secrets, rotation, privileged sessions, and endpoint privilege control sit in one zero-knowledge platform behind one admin console, the same console MSPs use for client tenants. CyberArk (now Idira, relaunched by Palo Alto Networks in May 2026 after the acquisition closed in February), BeyondTrust, and Delinea are PAM-first vendors, and Delinea added StrongDM's just-in-time infrastructure access through an acquisition completed in March 2026.

StrongDM works as a proxy in front of databases, servers, and Kubernetes clusters rather than as a password vault, so that comparison turns on whether you want employee password management in the same product. For an MSP, the deciding question with any of them is multi-tenancy: check how each one separates clients before you compare features. Our privileged access management guide compares the wider field.

The per-seat cost math across a client base

Per-seat pricing looks cheap until you multiply it. Say you manage 30 clients averaging 25 seats each. That is 750 seats. As an illustration, at a blended $4 per user per month (the Business list price), you are at $3,000 monthly, or $36,000 a year, before add-ons like BreachWatch or any KeeperPAM licensing.

That math is not unique to Keeper. Every per-seat password manager scales the same way. The point is to model it against what you can bill back to clients. Passing the password manager cost through as a line item, or folding it into a security bundle, turns it from a margin drain into a margin source. Run the numbers per client tier before you commit, because a tool priced fairly at 10 seats can sting at 1,000.

KeeperMSP's consumption billing scales with your actual managed user count, so you are not pre-buying seats for clients you have not signed. Still, the deeper you go into add-ons and KeeperPAM, the more the per-client cost climbs, and that is the trade-off for the breadth.

For an in-house IT team, the math is simpler: 400 employees on Enterprise at $6 per user per month comes to $2,400 a month, or $28,800 a year, before add-ons or KeeperPAM.

Integrations: RMM, PSA, and SSO reality

Be clear-eyed about integration depth. Keeper integrates well with identity infrastructure: SAML 2.0 SSO, SCIM provisioning, Active Directory and Azure AD sync, and major identity providers like Okta and Entra ID. If your clients run an IdP, Keeper slots in cleanly for provisioning and authentication.

What Keeper does not do is plug natively into the RMM and PSA tools at the center of an MSP stack. There is no deep two-way integration with ConnectWise, Datto, NinjaOne, or SuperOps of the kind IT Glue offers by syncing client records with PSA and RMM tools, and the one PSA link Keeper has is billing reconciliation through Gradient MSP. Keeper exposes APIs and the Secrets Manager for automation, so a capable team can wire credential retrieval into scripts and pipelines, but that is build-it-yourself, not click-to-connect.

For MSPs, this is the main limitation. Keeper is excellent identity and privileged access security, but it sits beside your operational stack rather than inside it. If tight PSA-to-credential workflow is a hard requirement, test that integration path before signing.

Does Keeper support open-source integrations?

Yes, at the tooling layer. Keeper Commander, the command-line tool and Python SDK, and the Keeper Secrets Manager SDKs are open source under the MIT license on Keeper's GitHub, alongside a GitHub Action, a Terraform provider, a Kubernetes integration, and an MCP server for AI agents that need secrets. The vault apps and the zero-knowledge platform behind them are closed source.

Teams that want the vault itself open source and self-hosted can look at Bitwarden, covered in our Bitwarden review.

Passbolt is another open-source vault built for teams, and OpenMSP's Passbolt review covers it.

Is Keeper safe? The breach record

There is no public record of a breach that exposed Keeper customer vault data as of November 2026, and the zero-knowledge architecture is why a server-side breach would yield ciphertext rather than readable vaults. Keeper's record is a short list of client-side flaws, each fixed in a numbered release, plus one public dispute with an MSP in 2025.

Has Keeper ever been hacked?

No breach of customer vault data is on record. The security issues that are on record, by date:

• December 2017. Google Project Zero researcher Tavis Ormandy reported a flaw in the Keeper browser extension (version 11.3) that could let a malicious website steal saved passwords. Keeper shipped the fix in version 11.4 in under 24 hours. Ormandy noted a near-identical issue he had reported in August 2016.
• July 2023. CVE-2023-36266 (CVSS 5.5) described the desktop app (16.10.2) and the browser extension (16.5.4) holding passwords in memory in plaintext after login, readable by an attacker with local access. Both were fixed in version 17.2, and Keeper disputes the finding.
• April to October 2025. A researcher reported a clickjacking technique against password manager extensions, later presented at DEF CON in August 2025. Keeper rated it low severity, released a fix in extension 17.1.2 on May 26, 2025, and added a Verify Fill Mode setting in 17.3.0 in October 2025.
• November 2025. An MSP partner posted on r/msp that records, including a passkey, were showing up for teammates they had never been shared with, and that support had pointed to a bug in the version 16 desktop app. Keeper's CTO and co-founder replied the next day that vault records decrypt only for users granted access through ownership, sharing, or transfer, and that the version 16 bug concerned syncing rather than sharing. The CTO added that the full vault sync introduced in version 17 clears out-of-sync records and offered to review the case.

For vendor due diligence, weigh fix speed and disclosure: each flaw above was fixed in a numbered release, and Keeper lists its findings on its security advisories page. Keep clients on current desktop and extension versions, since those fixes and the version 17 sync reach users only through updates.

The November 2025 r/msp thread, with the CTO's replies in the comments:

Keeper Security reviews and ratings

Third-party ratings, read on November 3, 2026, tell a split story worth understanding before you buy:

The gap between G2/Capterra and Trustpilot is the signal. Business reviewers on G2 and Capterra rate Keeper highly for security, central management, and support. Trustpilot skews lower because it collects consumer complaints, many about auto-renewal billing and subscription friction on the personal product. For MSPs and IT teams, the business-platform scores are the relevant ones, but the billing complaints are a reminder to read the renewal terms closely.

Pros and cons for MSPs

What works in Keeper's favor:

• Zero-knowledge encryption with SOC 2, ISO 27001, and FIPS 140-3, plus FedRAMP High and GovRAMP High for the government cloud
• A genuine multi-tenant MSP console with isolated client tenants and central policy control
• KeeperPAM brings privileged access, secrets, and session management into one platform
• A 2026 MSP partner program with four discount tiers, and consumption billing with no long-term license commitment
• Endpoint Privilege Manager, included in KeeperPAM, removes standing local admin rights on Windows, macOS, and Linux

Where it falls short:

• KeeperPAM pricing is quote-only, and add-ons inflate the real cost
• No native deep integration with the major RMM and PSA tools MSPs run daily (PSA billing sync runs through Gradient MSP)
• The vault apps are closed source; only Commander and the Secrets Manager SDKs are open source
• Per-seat costs stack quickly across a large client base

Who Keeper fits and who should look elsewhere

Keeper fits MSPs that treat credential and privileged access security as a billable service, especially those serving compliance-driven or government-adjacent clients where FedRAMP and FIPS matter. If you want one vendor covering both everyday password management and serious PAM, and you have clients who will pay for that depth, Keeper earns the look. The multi-tenant console and KeeperPAM are built for exactly this work. It also fits in-house IT teams that want employee vaults, admin credential rotation, and local admin removal from one vendor with one audit trail.

Look elsewhere if you need a credential tool that lives inside your PSA workflow or an open-source vault you can self-host, or if you are a smaller shop where quote-only PAM pricing and stacking add-ons make budgeting painful. A simpler per-seat manager may cover you for less friction. Tools like 1Password Teams, Bitwarden, or an MSP-focused option such as Passportal cover similar ground with different trade-offs, lighter on PAM but often easier to deploy and budget. Weigh them on the same axes: encryption model, multi-tenant management, integration depth, and the real per-seat cost once add-ons are in.

It is also worth separating the password manager question from the platform question. A password manager secures credentials; monitoring, patching, and ticket work still need their own tooling. OpenFrame, which Flamingo builds, covers that side as open, AI-native infrastructure for IT and security with agents working inline (Fae resolves support requests and Mingo runs IT operations), and it leaves credentials to a dedicated vault such as Keeper.

For the credential and privileged access layer specifically, Keeper brings a certification set (SOC 2, ISO 27001, FIPS 140-3, and FedRAMP High for its government cloud) that answers the auditor questions MSPs and IT teams face. Price the whole picture, test the integration path, and it holds up to the scrutiny.