Dashlane

Dashlane is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Dashlane's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Dashlane hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Dashlane is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Dashlane hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@dashlane.com or via a /security page (Dashlane lists a security contact).

Dashlane's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Dashlane's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Dashlane's trust center is at https://trust.dashlane.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Data stored on Dashlane is only ever decrypted locally, after a user has provided valid credentials on a verified device. All client data sent to Dashlane's servers (used to synchronize data among user devices) is encrypted at all times when in transit and at rest on our servers.

By far the most important element of Dashlane's approach to protecting the data stored by users on our software (which is defined as "Secured Data in our consumer and business terms, but is often colloquially referred to as user "vaults") is our "Zero Knowledge" Architecture. What this means is that Dashlane (and our employees, subcontractors, etc.) cannot access information that users store on our software, even when that information is stored on our (AWS) servers. This is because each user's Secured Data is encrypted in transit and at rest with a unique key, which we do not have, that is derived either from their Master Password or SSO credentials. We do not have these encryption keys (or users' master passwords or SSO credentials), nor does our system include a "backdoor," master key, or any other technical means to expose user's vaults.

Yes, our Dashlane "Business" tier supports most major SSO providers. For SSO users, we automatically generate a random, 64 byte encryption key. To provide maximum security for user data, the key is split into two pieces, one of which is stored by Dashlane, and the other can either be stored in the Client environment or in a secure confidential computing enclave in AWS. In either case, any attacker hoping to gain access to the encryption key would have to hack multiple, fully isolated computing environments in order to obtain the complete encryption key.

Yes, please see this page for complete information: https://www.dashlane.com/privacy/subprocessors

Our servers are located in AWS' Dublin, Ireland region. We use multiple availability zones within the region in order to ensure maximum uptime and robust business continuity and disaster recovery protections.