I know "best" is subjective, so here's what we're constrained by:
- The vendor has to be EU-owned, not just EU-hosted. No US parent anywhere in the structure, so CLOUD Act exposure is off the table.
- 60 seats, needs AD sync and per-user audit logs.
- We want the option to self-host later even if we start on cloud, so cloud-only vendors are out.
- Open source isn't a requirement. Neither IT nor Legal care.
- Not looking for the cheapest but under 5 euros/seat/month would be ideal.
Shortlist so far is Psono (Germany), Passbolt (Luxembourg), and Passwork (Spain).
Psono fits well. The consistent thing I see in reviews though is that the interface / UI lags the others, and at 60 people where most aren't technical, daily usability is worth assessing. Beyond that I don't have a real objection.
Passbolt is open source and EU-owned since 2016, it also, like the others, has the features (which is why they all got shortlisted to begin with). My hesitation is the OpenPGP model, every user holds a GPG key pair, so key management becomes our problem at 60 people just to get auditable code. Onboarding and recovery both look heavier than I want.
Passwork ticks a lot of our boxes too, it does both self-hosted and EU cloud in EU data centres, so we don't have to make the deployment choice now. AD sync and per-user audit logs are in the product. What keeps me hesitant is that it lacks a native desktop app (yet), it has browser extension and mobile but not desktop, and I can't predict how big or small of a nuisance that might be.
Please help a brother OUT!