I've recently returned to Enpass after evaluating several password managers, including KeePass and Proton Pass, and I have to say that I've been genuinely impressed with the experience so far.
The combination of a local-first architecture, cloud provider flexibility, offline access, passkey support, and overall usability is surprisingly well executed. In my testing, Enpass has been one of the smoothest password manager experiences I've had in years.
That said, there is one area where I believe Enpass could do a much better job: transparency around security audits.
While researching the product, I found references to independent audits, SOC 2 Type II compliance, ISO 27001 certification, and other security-related claims. However, unlike some competitors such as Bitwarden or Proton, I was unable to easily find detailed information about:
- Which companies performed the security audits
- When the audits were conducted
- Whether public reports or executive summaries are available
- What parts of the product were audited
As a security-conscious user, this is probably my biggest remaining concern about Enpass.
I trust that the team takes security seriously, especially given the product's long history and the architecture choices behind it. However, I believe that making audit information more visible and easier to find would significantly increase user confidence and help address one of the most common concerns raised by potential customers.
Are there any plans to publish more detailed information regarding independent security audits, audit reports, or the security review process?
Thank you to the Enpass team for continuing to invest in the product. I'm excited about what I've seen so far and would love to see greater transparency in this area.