In short: Keeper Security is a zero-knowledge password and privileged access management platform. Keeper Business and Enterprise give every user an encrypted vault with sharing and admin policies, Enterprise adding SSO and automated provisioning. Add-ons and KeeperPAM extend it to breach monitoring, secrets management, privileged sessions, remote browser isolation and endpoint privilege control.
How Keeper's zero-knowledge model works
Keeper encrypts vault data on the user's own device before it is sent to Keeper's cloud, using keys derived from the user's master password or SSO identity. Keeper does not hold those keys, so it cannot read what is stored, and neither could an attacker who breached its servers. Keeper also describes its platform as zero-trust: every user and device is verified, and access is limited to what each role needs.
For UK organisations this matters in two ways. It answers the obvious question, "what happens if the password manager itself is breached?", and it supports UK GDPR's security principle when vaults hold credentials to systems containing personal data. Keeper states that it is SOC 2 Type 2 and ISO 27001, 27017 and 27018 certified, and organisations can choose the primary region where their tenant is hosted, including the EU. Staff use desktop apps, mobile apps and browser extensions that autofill passwords and passkeys, while administrators work in a web-based admin console with policies, roles and reporting.
Keeper Business vs Keeper Enterprise
Keeper's business password manager comes in several editions. The main decision is whether you need single sign-on and automated provisioning, which point to Enterprise:
| Capability | Business Starter | Business | Enterprise |
|---|---|---|---|
| Encrypted vault on unlimited devices, password generator and sharing | Yes | Yes | Yes |
| Folders, subfolders and shared team folders | Yes | Yes | Yes |
| Admin console, policy engine and team management | Yes | Yes | Yes |
| Risk management dashboard and security audit | Yes | Yes | Yes |
| Free personal Family Plan for each user | Yes | Yes | Yes |
| Delegated administration | No | Yes | Yes |
| SSO (SAML 2.0) authentication | No | No | Yes |
| Automated provisioning (SCIM, AD/LDAP sync, Entra ID integration) | No | No | Yes |
| Advanced two-factor options (such as Duo and RSA) | No | No | Yes |
| Developer APIs | No | No | Yes |
Business Starter is a small-team edition with a fixed seat range, and Business and Starter both include basic two-factor authentication. Keeper describes Enterprise as everything in Business plus the identity and provisioning features above, and also offers customised bundles for larger organisations. Licensing is per user, and add-ons are licensed only for the people who need them. Detail is on Keeper Security licensing.
Keeper add-ons for the password manager
Several add-ons extend the core vault. These are the ones organisations most often ask about:
| Add-on | What it does |
|---|---|
| BreachWatch (dark web monitoring) | Checks vault passwords against known breach data without breaking zero-knowledge, then prompts users and alerts admins to change exposed credentials |
| Advanced Reporting & Alerts Module (ARAM) | Detailed event reporting, custom alerts and SIEM integration for the security team, plus ITSM links to tools such as ServiceNow and Jira |
| Compliance Reporting | Reports on who has access to which records and shared folders, for audits and access reviews |
| Secure File Storage | Encrypted storage for files and documents inside the vault |
| Secure Messaging (KeeperChat) | Encrypted messaging between users |
| Keeper Secrets Manager | Removes hard-coded secrets from scripts, applications and CI/CD pipelines, with a CLI, SDKs, developer tool plugins and automated rotation |
If two or more of the privileged access components below are needed, the KeeperPAM bundle is usually the simpler route.
KeeperPAM: privileged access management
Administrator and service account credentials are the ones attackers want most, and they need more control than a shared folder can give. KeeperPAM is Keeper's privileged access management platform, built on the same zero-knowledge model and managed from the same admin console. Its main components are:
- Privileged password and secrets management, including automated rotation of service account and admin passwords
- Privileged session management: RDP, SSH, VNC and database sessions launched from the vault, so admins reach servers without seeing the credentials or opening inbound ports
- Keeper Gateway: a lightweight service deployed in your cloud or on-premises network that brokers those sessions over an outbound connection
- Session recording for SSH, RDP, VNC, database and browser sessions, plus KeeperAI threat detection that watches sessions in real time and can end risky ones
- Remote browser isolation for reaching internal and SaaS web apps from unmanaged or contractor devices
- Keeper Discovery of privileged accounts, machines and databases across on-premises infrastructure and cloud platforms including Microsoft Azure, and just-in-time access without standing privileges
Keeper Connection Manager, the original browser-based remote connection product, remains a supported self-hosted component of KeeperPAM for air-gapped or fully self-hosted environments.
Keeper Endpoint Privilege Manager is the companion product for the devices themselves. It removes standing local admin rights on Windows, macOS and Linux and lets users request just-in-time elevation for approved tasks, with MFA, justification and approval workflows that can run in tools such as ServiceNow, Jira, Slack and Microsoft Teams. It is licensed per endpoint rather than per user.
Who Keeper suits
Keeper fits organisations from a handful of people to thousands:
- Small businesses usually start with Keeper Business Starter or Business for shared team folders and the free personal Family Plan for every member of staff, which helps adoption
- Microsoft 365 and Google Workspace organisations that want staff to unlock Keeper with their existing identity choose Enterprise for SSO and SCIM provisioning
- Schools, trusts and regulated businesses use Enterprise roles, policies and compliance reporting to evidence access control
- IT teams and managed estates add KeeperPAM and Endpoint Privilege Manager when admin credentials, remote access and local admin rights need the same control as everyone else's passwords
Comparing options? See business password managers for Keeper, 1Password and NordPass side by side, and 1Password Business for a closer look at the main alternative.
Deployment and how we help
A typical Keeper rollout through us:
- Scope who needs a vault, which identity provider you use and whether any admins need privileged access features.
- Connect SSO and provisioning with Microsoft Entra ID, Google Workspace or Okta on Enterprise, or invite users in batches on Business.
- Build shared folders for each team and set enforcement policies such as MFA, password strength and sharing restrictions.
- Migrate staff from browser-saved passwords using Keeper's import tools, then turn off browser password saving by policy.
- Extend with BreachWatch, reporting, KeeperPAM or Endpoint Privilege Manager as needed, and run joiners, leavers and renewals.
Keeper fits naturally alongside identity security controls such as conditional access and phishing-resistant MFA. Pricing depends on edition, user count and add-ons: ask us for a quote. Contact us to plan a Keeper deployment.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Keeper Security?
Keeper Security is a company that makes a zero-knowledge business password manager and KeeperPAM, a privileged access management platform. Vault data is encrypted on the user's device, so Keeper cannot read it, and administrators manage policies, sharing and reporting from a central console.
What is the difference between Keeper Business and Keeper Enterprise?
Both give every user an encrypted vault with shared team folders, an admin console, delegated administration and a free Family Plan. Keeper Enterprise adds SSO through SAML 2.0, automated provisioning with SCIM, AD/LDAP sync or Entra ID, advanced two-factor options such as Duo and RSA, and developer APIs, which suit organisations that manage users through Microsoft Entra ID, Google Workspace or Okta.
What is KeeperPAM?
KeeperPAM is Keeper's privileged access management platform. It combines privileged password and secrets management with credential rotation, privileged sessions brokered through Keeper Gateway, session recording with KeeperAI threat detection, remote browser isolation, discovery and just-in-time access, all on Keeper's zero-knowledge architecture.
What is Keeper BreachWatch?
BreachWatch is Keeper's dark web monitoring add-on for business. It checks the passwords stored in users' vaults against known breach data, using hashing so Keeper never sees the passwords, and prompts users and alerts administrators when a credential needs changing.
Is Keeper licensed per user?
Yes. Each person with a vault needs a licence on the base edition, and add-ons are licensed for the users who need them. Endpoint Privilege Manager is the main exception, counted by endpoint, and Secrets Manager can be added per user or comes as part of KeeperPAM.