Keeper Encryption Model

Zero-Knowledge and Zero-Trust Architecture
Keeper is a Zero Knowledge security provider. Zero Knowledge is a system architecture that guarantees the highest levels of security and privacy. Encryption and decryption of data always occurs locally on the user's device. 
Our encryption model adheres to the following structure:
1.Each vault record is encrypted by a unique and client-side generated 256-bit AES encryption key in GCM mode.
2.Each record-level key is wrapped by a 256-bit AES Shared Folder key if it is contained within a Shared Folder.
3.For Vault users, the Record and Folder Keys are encrypted with another AES-256 key called the Data Key.
4.For Secrets Manager users, the Record and Folder Keys are encrypted with a 256-bit AES Application Key.
5.For users who login with a Master Password, the keys to decrypt and encrypt data are derived from the user’s master password.
6.For users who login with SSO or Passwordless technology, Elliptic Curve cryptography is used to encrypt and decrypt data at the device level.
7.All encrypted payloads sent to the Keeper servers are additionally wrapped by a 256-bit AES transmission key in addition to TLS, to protect against MITM attacks. The transmission key is generated on the client device and transferred to the server using ECIES encryption via the server's public EC key.
8.Sharing of secrets between users uses Elliptic Curve Cryptography for secure key distribution.
9.Multi-Layer encryption provides access control at the user, group and admin level.
Data is encrypted locally on the user’s device before it is transmitted and stored in Keeper’s Cloud Security Vault. When data is synchronized to another device, the data remains encrypted until it is decrypted on the other device.
Keeper is the most secure, certified, tested and audited password security platform in the world. We are the only SOC2 and ISO27001 certified password management solution in the industry and Privacy Shield Compliant with the U.S. Department of Commerce's EU-U.S. Privacy Shield program, meeting the European Commission's Directive on Data Protection. Not only do we implement the most secure levels of encryption, we also adhere to very strict internal practices that are continually audited by third parties to help ensure that we continue to develop secure software and provide the world’s most secure cybersecurity platform.
Data Privacy
Keeper is GDPR compliant and we are committed to ensuring our business processes and products continue to maintain compliance for our customers in the European Union.
Our Privacy Policy can be found here:
​https://www.keepersecurity.com/privacypolicy.html​
Keeper's desktop applications, web applications and mobile applications do not contain any trackers or 3rd party libraries which perform tracking. As an example, see this link for information on Keeper's Android app which shows that no trackers are installed.
FIPS 140-2 Validation
Keeper utilizes FIPS 140-2 validated encryption modules to address rigorous government and public sector security requirements. Keeper’s encryption has been certified by the NIST CMVP and validated to the FIPS 140 standard by accredited third party laboratories. 
Keeper has been issued certificate #3967 under the NIST CMVP:  https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3976​
Cryptographic Module Validation Program | CSRC | CSRC
CSRC | NIST
Record-Level Encryption
Keeper implements a multi-layered encryption system based on client-side generated keys.  Record-level keys and Folder-level keys are generated on the local device which encrypt each stored Vault record (e.g. Password).  For example, if you have 10,000 records in your vault, you also have 10,000 AES Record Keys protecting the data.
Keys are generated locally on the device to preserve Zero Knowledge and to support advanced features such as record and folder sharing.  Record and Folder Keys are wrapped by other keys, such as the Data Key and Client Key.
For users who login with a Master Password:
A Master Password Key is derived from the Master Password using PBKDF2 and used to unwrap the Data Key, which is then used to unwrap the Record Keys and Folder Keys.  Record Keys are then used to decrypt the stored record information in the vault.  All fields of the data in each record is encrypted, including file attachments.
For users who login with Keeper SSO Connect Cloud:
A locally stored Elliptic Curve (EC) key pair is generated locally to encrypt and decrypt the user's Data Key, which then unwraps the Record and Folder keys. 
Additional details about the key wrapping is described in the Encryption of Stored Data section below.
For users who login with Keeper SSO Connect (On-Prem):
Master Password Hashes and Master Password Keys are generated by the on-premise SSO Cloud application.
Enterprise Encryption Keys
Business and Enterprise customers can manage many different capabilities of the Keeper platform, such as role-based enforcement policies, provisioning, authentication and team management.
Administrative functions are protected in the Keeper platform by encryption, in addition to authorization.  Authorization allows an Admin to access certain capabilities of the platform, but Encryption is used in many ways to ensure that only designated users are able to physically perform functionality or view sensitive information.
Many features within the Administrative features require decryption of keys in order to function and to preserve Zero-Knowledge and Zero-Trust. For example:
Teams have a public and private encryption key pair.  
Role policies for Vault Transfer and Device Approvals utilize public and private encryption key pairs
Enterprise-level key pairs are used for sharing usage data from the individual user to the Admin
Auditing of Password Strength and other sensitive usage data is encrypted with Enterprise Public Keys that can only be decrypted by the Admin.
Keeper's platform as a whole can be thought of as a key management platform, where the keys are in full control of the users and the Keeper Administrators.  The underlying complexity of key management is abstracted from users by the friendly front-end interface.
Cloud Authentication
Keeper has created an advanced cloud authentication and network communications model that has been built for the highest levels of privacy, security and trust.  A few key features of the authentication model are:
Master Password is never transmitted over the network layer
Unlike most SaaS services, the login credentials never leave the device. PBKDF2 is utilized on the local device to derive a 256-bit AES key used for decryption. A second PBKDF2 key is generated locally and then hashed with HMAC_SHA256 to derive an authentication token. Keeper’s Cloud Security vault has zero knowledge of the user’s decryption key.

Traffic between client device and Keeper Cloud cannot be intercepted or decrypted
Keeper utilizes Key Pinning and additional layers of network-level encryption (Transmission Keys) between the device and the Keeper servers, to ensure that MITM attacks are prevented.

New devices cannot login to an account without a device verification step
No login attempts can be made on an account without passing this step.  Keeper supports several types of device verification methods that depend on the authentication scheme being used.

2FA is performed after device verification, prior to Master Password entry
If a user has 2FA configured or enforced, this step must pass prior to the Master Password entry.

Master Password entry cannot be performed until the Device Verification and 2FA step succeeds
The user is unable to proceed to the Master Password entry step without first performing a device verification and 2FA authentication.  This advanced authentication flow provides protection against several attack vectors including brute force attack, password spraying, enumeration and MITM.
Authentication Methods
Keeper provides several methods of authenticating into the platform.
Master Password
SSO (On-Prem) with SAML 2.0
SSO (Cloud) with SAML 2.0
SSO Alternate Master Password
Biometrics
Device Verification
A user cannot attempt to login to an account without a device approval and verification step.  
For customers logging in with a Master Password, device verification can be performed using several new methods including:
Email verification code
2FA code entry from a TOTP or text message
Sending a Keeper Push™ message to recognized devices
For customers who authenticate with Keeper SSO Connect Cloud, device approval is made of up a key transfer, in which the user's encrypted data key is delivered to the device, which is then decrypted locally using their elliptic curve private key. Device approval methods include the following:
Keeper Push (using push notifications) to existing user devices
Admin Approval via the Keeper Admin Console
Automatic approval via Keeper Automator service
Automatic Admin Approval via Commander CLI​
Automatic Admin Approval via Azure Function​
Learn more about device approvals at this link.
2FA Verification
2FA can be added to any consumer or business account.  Business customers can enforce the use of 2FA with various levels of control and security options.
Starting with version 3 of the Keeper backend API (which corresponds to version 15+ of the Keeper client applications), the 2FA step comes before the Master Password entry.  Performing the device verification and 2FA step prior to the Master Password entry phase offers mitigation of several attack vectors including brute force attack, password testing and account enumeration.
Master Password
The default authentication method to Keeper is using a user-selected Master Password.  PBKDF2 with 100,000 rounds is used to derive a key ("Master Password Key") which decrypts the user's other keys such as the Data Key.  A second PBKDF2 key is generated locally and then hashed with HMAC_SHA256 to derive an authentication token. The ability to authenticate with a Master Password is restricted until the user's device passes verification, and 2FA is verified.
SSO (Cloud) with SAML 2.0
Keeper's SSO Cloud capability provides authentication against a SAML 2.0 identity provider, while retaining full Zero Knowledge encryption with the user's vault.  An Elliptic Curve (secp256r1) private key key pair is generated on the device.  The Data Key of the user is decrypted with the device private key, and the Encrypted Data Key is provided to the user upon successful authentication from their designated identity provider.
SSO (On-Prem) with SAML 2.0
For users who authenticate to Keeper with a SAML 2.0 identity provider, Keeper SSO Connect software is hosted in the customer's environment.  The SSO Connect software generates and manages the user's Master Password.  The Generated Master Password is then processed with PBKDF2 with 100,000 rounds to derive a key which decrypts the user's other keys such as the Data Key.
SSO Alternate Master Password
Customers who normally login to their Keeper Vault using Enterprise SSO Login (SAML 2.0) can also login to Keeper Web Vault, Browser Extension and Keeper Commander using an "Alternate Master Password". To make use of this capability, it must be enabled by the Keeper Administrator in the role policy and then configured by the user. Offline access can also be achieved with a Master Password for SSO-enabled users when this feature is activated.
This feature may be useful for users for several reasons including:
The requirement to login to the vault in offline mode
The ability to login to the vault if the SSO identity provider is unavailable
Authentication via Keeper Commander CLI (Command Line Interface)
PBKDF2 with 100,000 iterations is used to derive a key from the Alternate Master Password.  A hash of the key performs authentication, and the key decrypts the user's Data Key locally on the device.  More information is available on SSO Master Password at this link.
Biometrics
Keeper natively supports Windows Hello, Touch ID, Face ID and Android biometrics. Customers who normally login to their Keeper Vault using a Master Password or Enterprise SSO Login (SAML 2.0) can also login to their devices using a biometric. Biometrics must be enabled by the Keeper Administrator in the role policy. Offline access can also be achieved with a biometric for both Master Password and SSO-enabled users when this feature is activated.
When biometric login is enabled on a device, a key is randomly generated locally and stored in the secure enclave (e.g. Keychain) of the device.  The user's Data Key is encrypted with the biometric key.  Upon successful biometric authentication, the key is retrieved and the user is able to decrypt their vault. 
Keeper does NOT store or process biometric data of users.  Keeper integrates with the existing biometrics capabilities of the operating system to authenticate the user and retrieve the encryption key protected by the device secure enclave.
Encryption of Stored Data
New User Creation
For password-based authentication, when users create their account profile, they are required to select a “Master Password”. Users are also able to configure a second factor of authentication using FIDO2 WebAuthn, TOTP, Duo Security, RSA SecurID, SMS or SmartWatch.

If the user is authenticated via Keeper SSO Connect™ Cloud, a 256-bit Elliptic Curve (ECC secp256r1) private key is generated and stored locally on each device.  The ECC private key is used to decrypt the Data Key, and the Data Key decrypts the user's vault.  No Master Passwords are utilized in this encryption model.

If the user is authenticated via Keeper SSO Connect™ On-Prem (integration with SAML 2.0 identity provider), the Master Password is auto-generated by the SSO Connect software (hosted and operated by the Enterprise customer on-premise).

The Device Private Key is not directly utilized to encrypt or decrypt vault data.  Upon successful authentication from the Identity Provider, a separate key (that is not stored) is utilized for decryption of the vault data.  Offline extraction of the local Device Private Key cannot decrypt a user's vault.

The Master Password is used to derive an encryption key on the client device using a Password Based Key Derivation Function (PBKDF2) with minimum of 100,000 rounds.

On the client device, a 256-bit AES “Data Key” and “Client Key” are generated, as well as 2048-bit RSA Private/Public Key Pair, ECC Private/Public Key Pair. 
New User Registration Encryption Model
Data Storage
The “Data Key” is used to encrypt data that is synchronized to the Cloud Security Vault. For Master Password-based authentication, the “Data Key” is encrypted with the “Master Password Key” (derived from the Master Password) and this ciphertext is stored in the Cloud Security Vault.  For SSO Cloud-based authentication, the local ECC (secp256r1) private key is used to decrypt the Data Key.  The Data Key decrypts the user's vault.
 
The “Client Key” is used to encrypt data that is stored locally on the user’s device. The “Client Key” is encrypted with the “Data Key” and this ciphertext is stored in the Cloud Security Vault. For Master Password-based authentication, the “Client Key” is also encrypted with the “Master Password Key” and this ciphertext is stored locally on the device for offline use.  Offline mode can be controlled by the Enterprise administrator.

The vault data stored offline is AES-GCM encrypted with a 256-bit “Client Key” that is generated randomly and protected by PBKDF2-HMAC-SHA512 with up to 100,000 iterations and a random salt. The salt and iterations are stored locally. When the user enters their Master Password, a key is derived using the salt and iterations and an attempt is made to decrypt the Client Key. The Client Key is then used to decrypt the stored record cache.

The “RSA Public Key” and "EC Public Key" is stored directly to the Cloud Security Vault.

The “RSA Private Key” is encrypted with the “Data Key” and the ciphertext is stored in the Cloud Security Vault.

For each record (e.g. Website Password or File) that is created, a 256-bit AES “Record Key” is generated on the client device. The “Record Key” is used to encrypt and decrypt the record content. The “Record Key” is encrypted with the user’s “Data Key” and the ciphertext is stored in the Cloud Security Vault. The Record Key and record data is also encrypted with the “Client Key” and the ciphertext is stored locally on the device.
Logging In
When a user logs into a device (with their master password), they first decrypt their Client Key from the Master Password-derived key.

The Client Key is used to decrypt all locally stored data on the device.

The data key unwrapped locally or retrieved from the Cloud Security Vault upon successful authentication is decrypted with the user’s Master Password derived key.

Record Key ciphertext is synchronized from the Cloud Security Vault then decrypted locally with the user’s Data Key. Shared Folder keys are decrypted with the respective Shared Folder Key from each folder. Record content is decrypted with the respective Record Key from each record. Record Keys and content are then encrypted with the client key and stored locally.
Master Password Login Encryption Model
Sharing
To share a Keeper Record to another user, Keeper first requests the user’s RSA or Elliptic Curve Public Key from the Cloud Security Vault.

Keeper has transitioned from RSA to Elliptic Curve crypto and utilize both methods for various features.

The Record Key of each record is encrypted with the recipient’s RSA or Elliptic Curve Public Key and synchronized to the user’s Keeper vault via the Cloud Security Vault.

The recipient of the encrypted shared record decrypts the Record Key with their RSA or Elliptic Curve Private Key. For optimization, the Record Key will be re-encrypted with the user’s Data Key (since AES encryption is faster than RSA encryption) and the ciphertext is stored in the recipient’s Cloud Security Vault.

For subsequent record retrievals, the recipient decrypts the Record Key with their Data Key, and then decrypts the record content with the Record Key.

Sharing with RSA and Elliptic Curve Encryption
Encryption In Transit
The Keeper Cloud Security Vault is protected by APIs which are validated through authorization by the client device. The client retrieves a session token upon login and sends it with each API call. The session token is tracked on the server. Login is performed either by a Master Password, session resumption, or SAML 2.0 SSO authentication.
When using a Master Password, the client device derives a 256-bit "Authentication Key" using PBKDF2-HMAC-SHA256 and a random salt. An "Authentication Hash" is generated by hashing the Authentication Key using SHA-256. To login, the Authentication Hash is compared against a stored Authentication Hash on the Cloud Security Vault. After login, a session token is generated on the server and sent to the client to be used by the client device for subsequent API requests. The session must be active to allow continued use of client to server communications.
KSI supports 256-bit and 128-bit TLS to encrypt all data transport between the client application and KSI's cloud-based storage.

KSI deploys TLS certificates signed by Digicert using the SHA2 algorithm, the most secure signature algorithm currently offered by commercial certificate authorities. SHA2 is significantly more secure than the more widely used SHA1, which could be exploited due to mathematical weakness identified in the algorithm. SHA2 helps protect against the issuance of counterfeit certificates that could be used by an attacker to impersonate a website.

KSI also supports Certificate Transparency (CT), a new initiative by Google to create a publicly auditable record of certificates signed by certificate authorities. CT helps guard against issuance of certificates by unauthorized entities. CT is currently supported in the latest versions of the Chrome web browser. More information about Certificate Transparency can be found at: http://www.certificate-transparency.org/. Keeper supports the following TLS cipher suites:
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384
Keeper client devices also implement Key Pinning, a security mechanism which prevents impersonation by attackers using fraudulent digital certificates.
Two-Factor Authentication
To protect against unauthorized access to a customer's account, Keeper also offers Two-Factor Authentication. Two-Factor authentication is an approach to authentication requiring two or more of the three authentication factors: a knowledge factor, a possession factor, and an inherence factor. For more information on Two-Factor Authentication see this link.

Keeper uses something you know (your password) and something you have (the phone in your possession) to provide users extra security in the case where your Master Password or device is compromised. To do this, we generate TOTPs (Time-based One-Time Passwords).

Keeper generates a 10-byte secret key using a cryptographically secure random number generator. This code is valid for about a minute, and is sent to the user by SMS, Duo Security, RSA SecurID, TOTP application, Google Authenticator or Keeper DNA-compatible wearable devices.

When using the Google Authenticator or TOTP application on your mobile device, the Keeper server internally generates a QR code containing your secret key, and it is never communicated to a third party. Each time a user deactivates, then reactivates Two-Factor Authentication, a new secret key is generated.

To activate Two-Factor Authentication, visit the Settings screen of the Keeper Web App, Desktop App or mobile application. Keeper Business customers can optionally enforce the use of Two-Factor Authentication and supported 2FA methods via the Keeper Admin Console's role enforcement functionality.
FIDO2 WebAuthn and U2F Security Keys
Keeper supports FIDO2-compatible WebAuthn and U2F hardware-based security key devices such as YubiKey and Google Titan keys as a second factor. Security keys provide a convenient and secure way to perform two-factor authentication without requiring the user to manually enter 6-digit codes. 
Multiple security keys can be configured for a user's vault. For platforms that do not support security key devices, users may fall back to other configured 2FA methods. 
To configure a security key and other two-factor authentication methods, visit the 'Settings' screen of the Keeper application.
BreachWatch
Keeper operates a self-contained managed service architecture on Amazon AWS called BreachWatch which is physically separate from the Keeper Backend API and stored user data.
On the BreachWatch servers, a physical Hardware Security Module (HSM) is used to process, hash and store billions of unique passwords from dark web data breaches.  Each of these billions of passwords is processed on Keeper's servers using HMAC_SHA512 hashing method, hashed with a Hardware Security Module using a non-exportable key.
On the Keeper end-user client device, when BreachWatch is activated, a HMAC_SHA512 hash is generated based on each stored password and sent to the server.  On the server, a second hash is created using HMAC_SHA512 via the Hardware Security Module (HSM) using a non-exportable key.  These Hashes-of-Hashes are compared to determine if a password has been breached.
BreachWatch backend architecture was built to prevent correlation of a breached password to an actual password in the user's vault, no matter the size of the data breach.  The hashing used in the breached password detection utilizes a physical Hardware Security Module to ensure that hashing can only be performed online - to prevent any threat of brute force attack on the BreachWatch data.
The below system diagram outlines the overall data flow, encryption and BreachWatch hash processing workflows.
BreachWatch System Diagram
In summary:
The passwords are hashed twice with HMAC_512 - once on the client device using a "pepper", and once in the Amazon AWS CloudHSM, using a hardware security module with a non-exportable key.
HMAC_512 is utilized because it takes advantage of a strong hashing function, plus a secret key (which is not exportable). Therefore, an offline attack against the hashes is not feasible.
 "Message authentication code" (MAC) with the result of a cryptographic hash function. It is a way to expand the use of hash functions. Its results depend not only on the message but on a second input that can be a secret key.
SAML 2.0 Authentication with SSO Connect Cloud
Keeper SSO Connect Cloud provides Keeper Enterprise customers with a method of authenticating a user and decrypting stored data in a zero-knowledge encrypted vault, with authentication provided through a 3rd party identity provider (IdP) utilizing standard SAML 2.0 protocols in a fully cloud environment.
In this implementation, a user can authenticate through their SSO identity provider and then decrypt the ciphertext of their vault locally on their device. Each device has its own EC (Elliptic Curve) public/private key pair and encrypted data key.  Each user has their own Data Key. To sign into a new device, the user must utilize existing devices to perform an approval or an administrator with the privilege can approve a new device.
The importance of this new capability is that the user can decrypt their vault using an encrypted key stored in the Keeper cloud.  Zero knowledge is preserved because the Keeper cloud is unable to decrypt the user's Data Key on their device. The Data Key ("DK") of the user is decrypted with the device private key ("DPRIV"), and the Encrypted Data Key ("EDK") is provided to the user upon successful authentication from their designated identity provider (e.g. Okta, Azure, AD FS).
SSO Connect Cloud Encryption Model
Security for SSO Connect Cloud
For SSO Connect Cloud users, an Elliptic Curve private key is generated and stored locally on each device. For Chromium-based web browsers, the Keeper Vault stores the local device EC private key ("DPRIV") as a non-exportable CryptoKey.  On iOS and Mac devices, the key is stored in the device KeyChain.  Where available, Keeper utilizes secure storage mechanisms.
The Device Private Key is not directly utilized to encrypt or decrypt vault data.  Upon successful authentication from the Identity Provider, a separate key (that is not stored) is utilized for decryption of the vault data.  Offline extraction of the local Device Private Key cannot decrypt a user's vault.
Device Approval
To sign into a new device, the user must utilize existing devices to perform an approval or an administrator with the privilege can approve a new device.  New devices generate a new set of public/private keys, and the approving device encrypts the user's data key with the public key of the new device.  The new device’s encrypted data key (EDK) is provided to the requesting user/device and then the user is able to decrypt their data key, which then decrypts the user's vault data.  Within the decrypted vault data the user can decrypt their other private encryption keys such as record keys, folder keys, team keys, etc.
The importance of this capability is that the user can decrypt their vault using an encrypted key stored by the Keeper cloud, and does not require any on-prem or user-hosted application services to manage the encryption keys.  Zero knowledge is preserved because the Keeper cloud is unable to decrypt the user's Data Key on their device. The Data Key of the user is decrypted with the device private key (DPRIV), and the EDK is only provided to the user upon successful authentication from their designated identity provider (e.g. Okta, Azure, AD FS).
From an administrator's perspective, the benefits are: easy setup and no required hosted software to manage encryption keys as described in Keeper's current SSO Connect encryption model.
The only workflow change in this model (compared to on-prem implementation of Keeper SSO Connect) is that the user must perform new device approval on an active device, or delegate the responsibility to a Keeper Administrator to perform device approval.
Device Approval Methods
Keeper SSO Connect Cloud supports several device approval methods:
(1) Keeper Push
(2) Admin Approval via the Keeper Admin Console
(3) Admin Approval via Commander automation tool
(4) Automatic Admin Approval via Azure Function
(5) Automatic Approval using Keeper Automator (** Recommended)
Learn more about SSO Cloud Device Approvals here:
https://docs.keeper.io/sso-connect-cloud/device-approvals​
SSO Architecture
The system architecture diagram for Keeper SSO Connect is shown below:
SSO Connect Security Architecture
Secrets Manager Encryption Model
Keeper Secrets Manager is a Zero Knowledge platform for DevOps, IT Security and software development teams to manage secrets throughout the software development and deployment lifecycle. 
Secrets Manager adheres to the following encryption model:
(1) Secrets are encrypted and decrypted on the device (not on the server)
(2) The device never stores plain text (human readable) data
(3) The server never receives data in plain text
(4) No Keeper employee, 3rd party or intermediary can decrypt secrets
(5) The keys to decrypt and encrypt secrets are managed by the customer on the Client Device.
(6) Each secret is encrypted by a unique and client-side generated 256-bit AES encryption key in GCM mode.
(7) Each record-level key is wrapped by a Shared Folder key if it is contained within a Shared Folder.
(8) A client-side generated 256-bit AES Application Key is used to decrypt the Shared Folder and Record Keys. The record key decrypts the individual secret.
(9) All encrypted payloads sent to the Keeper servers are additionally wrapped by a 256-bit AES transmission key in addition to TLS, to protect against MITM attacks. The transmission key is generated on the client device and transferred to the server using ECIES encryption via the server's public EC key.
(10) Sharing of secrets between users uses Elliptic Curve Cryptography for secure key distribution.
(11) Multi-Layer encryption provides access control at the user, group and admin level.
(12) Secrets that are managed within a User Vault are segmented and isolated to defined Secrets Manager devices that are granted access to the individual records and folders.
For more specific security details regarding Keeper Secrets Manager, see this page.
To learn more about Secrets Manager see the documentation.
One-Time Share Encryption Model
One-Time Sharing
Keeper "One-Time Share" provides time-limited secure sharing of a record (such as a password, secret, document or other confidential information) to a recipient without having to create a Keeper account. The encryption model implemented for one-time sharing uses the same technology as Keeper Secrets Manager, a zero-knowledge and zero-trust platform for protecting cloud infrastructure.
(1) In the vault, the sharer generates a one-time access token by clicking on "One-Time Share" in the record options screen. The 256-bit AES Record Key for the record being shared is encrypted with the one-time access token, and this encrypted value is stored in the Keeper Cloud.
(2) The sharer sends the One-Time Access Token to a recipient via a simple URL or QR code through their preferred channel. The URL portion that contains the access token is held within the "fragment identifier" section of the URL which is never sent over the network to Keeper's servers. Therefore, zero-knowledge is retained and Keeper has no ability to access or decrypt the information.
(3) The recipient opens the URL on their device browser, and a single-page Vault application is loaded on the device. The One-Time Access Token is handed off directly to the local vault application (not sent to the server).
(4) Upon loading the URL, the recipient's device generates a client-side public/private Elliptic Curve key pair, and the private key is stored locally on the Client Device in the browser's CryptoKey storage.
(5) Upon first use, the SDK library authenticates using the hash of the One Time Access Token and upon successful authentication, the server responds with the encrypted record ciphertext plus the Encrypted Record Key.
(6) The Client decrypts the Record Key with the One Time Access Token, and the record contents are decrypted using the Record Key. The Record Key is then stored locally on the client device in the browser's CryptoKey storage or other designated storage location.
(7) On the server, the encrypted record key for that given device is deleted so that the One Time Access Token cannot be used again. After that, the client's requests must be signed with the Client Private Key.
(8) Subsequent calls on the same device to the server are sent with an identifier which uniquely defines the device (hash of the one-time access token) and a request body that is signed with the Client Private Key. The server checks the ECDSA signature of the request for the given device identifier using the Client Public Key of the device. The Keeper Cloud processes the request for the record, and the server returns encrypted record ciphertext to the Client upon successful authentication.
(9) In addition to the record-level encryption, the Client Device creates a randomly generated AES-256 bit Transmission Key which is encrypted with the public key of the Keeper cloud API. The Client Device decrypts the response from the server with the Transmission Key and then decrypts the ciphertext response payload with the Record Key, which decrypts the contents of the record.
Account Transfer Policy Encryption
When Account Transfer Policy is activated for a role, a role enforcement policy public/private key pair is generated on the Admin Console locally. The end-user's data key (for users in a role to which the enforcement is applied) is encrypted with the role enforcement policy's Public Key when the user signs into the Vault. The role enforcement private key is encrypted with the Admin's Public Key.  Therefore, the Admin can decrypt the role enforcement private key when a vault transfer is required.
To perform a Vault Transfer, the Keeper Admin first must lock the user's account, then the transfer can occur which immediately is followed by deleting the user's account. This ensures the operation is not performed secretly. When performing the transfer, the user's Data Key is retrieved by first unwrapping the role enforcement Private Key and then unwrapping the user's Data Key. The Data Key is then used to unwrap the record keys, team keys, and folder keys.
All encryption is performed client side within the Admin Console, and at no time does Keeper have the ability to decrypt the information being shared or transferred. Additionally, at no time is a user's client Data Key shared. Therefore, the data cached on a user’s device cannot be decrypted without the user’s master password. A user who is removed from a team, shared folder, or direct share will not receive new data from the team, shared folder, or record. Although the record, folder and team keys are compromised to the admin during the transaction, the keys are not usable for gaining access to the underlying record or folder data.
Several different administrative privileges may be assigned to portions of a hierarchical tree that allows the members of the privileged role to perform operations in our Keeper Admin Console.
​Learn more about the account transfer policy.
Emergency Access (Digital Legacy)
Keeper's consumer product supports the ability to add up to 5 emergency contacts to grant vault access in the event of an emergency or death. Once a specified wait time has elapsed, the emergency contact will gain access to the user's vault. The process of sharing a vault is Zero-Knowledge, and the user's Master Password is never directly shared. 2048-bit RSA encryption is utilized to share a 256-bit AES key with the emergency contact, at the expiration of the wait time set by the originating user. Therefore, the emergency contact must have a Keeper account (and a public/private key pair) to accept the invitation.
Digital Legacy is only supported on consumer-level accounts
Cross-Site Scripting (XSS) Attack Protection
The Keeper Web Vault implements a strict Content Security Policy that restricts the origin of outbound requests and prevents all scripts from being executed, except those explicitly sourced from Keeper, including inline scripts and event-handling HTML attributes, reducing or eliminating most vectors for cross-site scripting attacks.
Access to the keeper domain names is restricted to HTTPS with TLS v1.2 and is enforced by HTTP Strict Transport Security. This prevents a wide array of packet sniffing, data modification, and man-in-the-middle attacks.
Within the Keeper Browser Extension, Keeper will not prompt users to login to their vault from within the page frame area. Login to the extension occurs within the Browser Extension toolbar area of the browser. Login to the vault on the web browser will always occur either on the keepersecurity.com, keepersecurity.eu, keepersecurity.com.au or govcloud.keepersecurity.us domain, or from the Keeper browser extension toolbar which exists outside of the content page.
The Keeper Browser extension on Chrome, Firefox, Edge and Opera utilize iFrames for injection of record data on the login screens of websites to ensure that no malicious website has access to injected content. Record content injected into iFrames is also limited to the vault records stored in the user's vault which match the domain of the target website. Keeper will not offer Autofill of login or password data unless the website domain matches the website domain field of the Keeper vault record.
The Internet Explorer Extension uses a separate native application window for logging in and accessing records. These separate windows are not subject to XSS attacks because they are not accessible from the browser. This allows the Extension in Internet Explorer to provide a login window from inside the page. The extension will not show records unless the records match the website address root domain.
3rd party browser extensions may have elevated permissions in web browsers and can access information within the page. Therefore, it is recommended that Keeper administrators prevent users from installing   3rd party browser extensions from the browser's respective app store.
Autofill Security
The Keeper Browser Extension (KeeperFill) provides customers with the ability to fill and save credentials from their vault into a target website login page.
The Autofill feature protects against XSS attacks using many techniques and advanced functionality including but not limited to the following:
iFrames are utilized when injecting login credentials into web pages to ensure that no malicious website has access to the content.
Domain matching is.performed to ensure that only matching records are available for Autofill. Keeper will not offer to fill passwords unless there is a root domain match.
Customers may also enforce strict subdomain matching in role enforcement policies to restrict available logins based on exact subdomain match.
Keeper will not autofill passwords on any non-secure (http://) website, without explicit forced consent by the user.
Keeper regularly performs 3rd party Autofill-specific penetration testing with Cybersecurity firms including NCC Group and Cybertest.
Compliance Reports
Keeper Compliance Reports adheres to Keeper's Zero-Knowledge encryption model. From an encryption standpoint, here's how it works. When the Enterprise end-user logs into their vault, the Type, Title and URL fields are encrypted with the Elliptic Curve Enterprise Public Key. This data, we call the "Audit Data", is encrypted locally on the user's device and stored in the Keeper cloud. The Audit Data is continuously updated by the end-user devices over time.
The Keeper Administrator logs into the Admin Console using either a Master Password or Single Sign On. After a successful login, the Admin decrypts what we call the AES 256 Enterprise Tree Key and then decrypts the Elliptic Curve Enterprise Private Key. If the Administrator has permissions to run Compliance Reports, they can run a report over any user within the node that they have been granted permissions.
The encrypted audit data is delivered to the Admin Console and the Admin is able to decrypt audit data locally on their device using the Elliptic Curve Enterprise Private Key. The report contents are then displayed locally on the user interface and available for export into CSV, JSON or PDF format.  Only the designated Keeper administrator can retrieve and decrypt the compliance report data for the nodes that they have been granted admin rights over.
​Learn More about Compliance Reports.
Issued US Patents
Patent No
Abstract
​11,363,009​
System and method for providing secure cloud based single sign-on connections using a
security service provider having zero-knowledge architecture.
​10,356,079​
System and method for a single sign on connection in a zero-knowledge vault architecture.
​11,218,304​
A method of detecting the existence of a
breached password in a zero-knowledge vault without disclosing any identifiable information about the password to the service provider or any outside party.
​10,708,237​
System and method for chat messaging in a
zero-knowledge vault architecture.
​8,656,504 , 8,738,934​
Method and apparatus for protecting account numbers and passwords.
​8,868,932​
Apparatus for selecting and displaying a file
associated with a current geographic location.
​9,465,786​
Method for facilitating quick logins from a
mobile computing device for autofilling login
credentials into websites and applications.
​9,294,476​
User-defined identity verification system.
Vulnerability Reporting and Bug Bounty Program
Keeper Security is committed to the industry best practice of responsible disclosure of potential security issues. We take your security and privacy seriously are committed to protecting our customers’ privacy and personal data. KSI’s mission is to build world’s most secure and innovative security apps, and we believe that bug reports from the worldwide community of security researchers is a valuable component to ensuring the security of KSI’s products and services.
Keeping our users secure is core to our values as an organization. We value the input of good-faith researchers and believe that an ongoing relationship with the cybersecurity community helps us ensure their security and privacy, and makes the Internet a more secure place. This includes encouraging responsible security testing and disclosure of security vulnerabilities.
Guidelines
Keeper's Vulnerability Disclosure Policy sets out expectations when working with good-faith researchers, as well as what you can expect from us.
If security testing and reporting is done within the guidelines of this policy, we:
Consider it to be authorized in accordance with Computer Fraud and Abuse Act,
Consider it exempt from DMCA, and will not bring a claim against you for bypassing any security or technology controls,
Consider it legal, and will not pursue or support any legal action related to this program against you,
Will work with you to understand and resolve the issue quickly, and
Will recognize your contributions publicly if you are the first to report the issue and we make a code or configuration change based on the issue.
If at any time you are concerned or uncertain about testing in a way that is consistent with the Guidelines and Scope of this policy, please contact us at [email protected] before proceeding.
To encourage good-faith security testing and disclosure of discovered vulnerabilities, we ask that you:
Avoid violating privacy, harming user experience, disrupting production or corporate systems, and/or destroying data,
Perform research only within the scope set out below, and respect systems and activities which are out-of-scope,
Contact us immediately at [email protected] if you encounter any user data during testing, and
You give us reasonable time to analyze, confirm and resolve the reported issue before publicly disclosing any vulnerability finding.
Submitting a Report
Keeper has partnered with Bugcrowd to manage our vulnerability disclosure program.
bugcrowd
Please submit reports through [https://bugcrowd.com/keepersecurity].
Penetration Testing
Keeper performs 3rd party penetration and vulnerability testing with experts including NCC Group, Cybertest and independent security researchers against all of our products and systems.  Report summaries are provided to Enterprise customers on request.
Security FAQs
Q: Can Keeper's employees see our stored data?
A: NO.  We are Zero Knowledge and cannot decrypt customer data.
Q: Where are master passwords and encryption keys stored?
A: The Master Password is not stored and the encryption keys derived from the master password are not stored.  When the user types in their Master Password, a key is derived in real time using a password derivation function known as PBKDF2 with 100,000 rounds. This key then unwraps the ciphertext to extract the Data Key which then unwraps the folder keys, record keys and record data.
Q: How does biometric login work?
If biometrics are activated and allowed by the Admin, a AES-256 "biometric key" is generated locally on the device and then stored in the iOS Keychain. When the user successfully authenticates with the operating system using Face ID or Touch ID authentication, the key is provided to the Keeper application and used to unwrap the stored ciphertext to retrieve the Data Key.
Keeper natively supports Windows Hello, Touch ID, Face ID and Android biometrics. Customers who normally login to their Keeper Vault using a Master Password or Enterprise SSO Login (SAML 2.0) can also login to their devices using a biometric. Biometrics must be enabled by the Keeper Administrator in the role policy. Offline access can also be achieved with a biometric for both Master Password and SSO-enabled users when this feature is activated.
Q: How do you protect against brute force password attack?
A: Keeper has implemented multiple layers of protection against password stuffing and password brute force attack. We do not permit login on any device that has not been approved. Once approved, the first step is 2FA. One 2FA passes, only then can a user attempt a password test. After 10 failed password attempts, the account will become exponentially locked with each attempt. Keeper's self-destruct mechanism can also be enabled on the local device to delete locally stored data on 5 failed attempts. Read more about our Login API at this link.
Q: How do you protect against 2FA attack?
A. Keeper does not permit login on any device that has not been approved. Once a device is approved (either through email verification, Keeper Push or 2FA code entry), the user will be prompted with 2FA. Keeper will lock an account after 10 failed 2FA attempts on an exponential basis for each failed attempt.
Q: How do you protect against enumeration attack?
The Login API V3 makes major strides in the prevention of user enumeration against the Keeper cloud infrastructure. This means that the server will not disclose the existence or non-existence of a user's account. Enumeration is denied unless the user is logging in from a trusted/known device or IP.
Since Keeper operates several isolated data centers and enumeration between data centers is denied, there are some cases when a user must perform round trips and email verifications if they attempt to login from the wrong data center.  Since disclosures cannot be made through the web interface, emails are utilized to communicate login and redirection.
Q: How do you enforce policies without having access to the data?
A: When the user logs into their device, all of the Enterprise policies are downloaded from the Keeper Cloud and processed locally on the device for policies that require record-level filtering, URL filtering or password-specific rules and processing.
Q: Why does Keeper have a Security Question and Answer as account recovery?
Account recovery can be disabled by the customer in the role policy section of the Admin Console. This may be desired if you are using SSO Cloud which utilizes a 3rd party identity provider.

The way account recovery works (with the Security Question method) is by storing a second copy of the user's data key that is encrypted with the selected Security Answer. To complete a vault recovery, the user is required to (1) enter an email verification code, (2) pass the Two-Factor Authentication step (if enabled on the account) and (3) answer the exact security question locally on the device to decrypt the data key, which then allows the user to reset the Master Password. We recommend creating a strong security question and answer, as well as turning on Keeper's Two-Factor Authentication feature from the 'Settings' screen.

From a security perspective, Keeper finds that a strong security answer paired with email and 2FA verification provides the balance between convenience and security.  Enterprise customers who wish to disable account recovery and rely on the "Vault Transfer" admin feature are able to set this policy. Note that if account recovery is disabled, Vault Transfer is the only way that a user can be recovered if they forget their Master Password or if they lose access to the SSO IdP.
Consumer users who do not wish to enable account recovery can simply enter random/long content into the Security Question and Answer fields.
Q: How do I offboard an employee and gain access to their vault?
Business and Enterprise customers are provided a zero-knowledge method of account recovery for their users using Keeper's Account Transfer policy.  This is described in detail at this link.
Additional References
Full Security Disclosure
https://keepersecurity.com/security.html​
GDPR Compliance
https://keepersecurity.com/GDPR.html​
White Papers, Data sheets and Case Studies
https://keepersecurity.com/resources.html​
SSO Connect Cloud Security Model
https://docs.keeper.io/sso-connect-cloud/security-and-user-flow

Additional technical documentation is available under NDA.
Vulnerability Disclosure Program
Keeper Security is committed to the industry best practice of responsible disclosure of potential security issues. We take your security and privacy seriously are committed to protecting our customers’ privacy and personal data. KSI’s mission is to build world’s most secure and innovative security apps, and we believe that bug reports from the worldwide community of security researchers is a valuable component to ensuring the security of KSI’s products and services.

Keeping our users secure is core to our values as an organization. We value the input of good-faith cybercriminals and believe that an ongoing relationship with the researcher community helps us ensure their security and privacy, and makes the Internet a more secure place. This includes encouraging responsible security testing and disclosure of security vulnerabilities.
Guidelines
Keeper's Vulnerability Disclosure Policy sets out expectations when working with researchers, as well as what you can expect from us.
If security testing and reporting is done within the guidelines of this policy, we:
Consider it to be authorized in accordance with Computer Fraud and Abuse Act,
Consider it exempt from DMCA, and will not bring a claim against you for bypassing any security or technology controls,
Consider it legal, and will not pursue or support any legal action related to this program against you,
Will work with you to understand and resolve the issue quickly, and
Will recognize your contributions publicly if you are the first to report the issue and we make a code or configuration change based on the issue.
If at any time you are concerned or uncertain about testing in a way that is consistent with the Guidelines and Scope of this policy, please contact us at [email protected] before proceeding.
To encourage good-faith security testing and disclosure of discovered vulnerabilities, we ask that you:
Avoid violating privacy, harming user experience, disrupting production or corporate systems, and/or destroying data,
Perform research only within the scope set out below, and respect systems and activities which are out-of-scope,
Contact us immediately at [email protected] if you encounter any user data during testing, and
You give us reasonable time to analyze, confirm and resolve the reported issue before publicly disclosing any vulnerability finding.
Submitting a Report
Keeper has partnered with Bugcrowd to manage our vulnerability disclosure program. Please submit reports through [https://bugcrowd.com/keepersecurity].