"Who has access to this system?"
Answerable — until you are asked to prove that the list is current and that someone reviewed it.
For enterprise & regulated organisations
Prove your access controls, don't just claim them
Recertification campaigns, immutable decisions and exportable evidence — the answers an auditor asks for, produced by the product instead of rebuilt in a spreadsheet every year.
The questions that are hard to answer honestly
"Who approved that access, and when?"
This is where most credential stores stop. An access list is not an approval record.
"When was this last rotated?"
Without tracking, the answer is whatever the last person to touch it remembers.
Evidence produced as a by-product of normal use
Access recertification campaigns
Launch a review, route each access to the person accountable for it, and record approve-or-revoke decisions that cannot be edited afterwards. The campaign itself is the evidence.
Compliance reports & evidence export
Access matrices and rotation evidence as timestamped CSV, ready to hand to an auditor rather than reconstructed the week before the audit.
Data classification & ownership
Four classification levels and a named owner per item, so the protection an item gets matches what it actually protects.
Leaver & offboarding risk
A report of what a departing account could reach — the scope of the rotation you owe, stated precisely instead of estimated.
Rotation policy & tracking
Per-folder rotation expectations with an overdue report, so drift is visible before an auditor finds it.
Security posture
Weak, reused, breached and overdue credentials scored continuously, with a personal score that makes hygiene an individual metric.
Identity, automation and sovereignty
Your directory stays the source of truth
LDAP and Active Directory with nested group resolution in both login modes, or OAuth2 against your identity provider. Group-to-role mapping means joiners and leavers are handled where you already handle them.
- Nested AD groups resolved correctly
- OAuth2 / Entra ID single sign-on
- Configurable RFC 6238 TOTP profiles where SSO is not in play
- Administrator control over authentication lockouts
Automation without scraping the UI
A REST API with item and folder CRUD and the full folder tree in one call, plus native Bash and PowerShell clients. Folder rights are enforced the same way through the API as through the browser — an important detail, and one that was explicitly aligned in 3.2.1.2.
- Bash and PowerShell clients shipped with the release
- Folder
PUTandDELETEendpoints - Server version returned in authentication responses
Sovereignty
Nothing leaves your perimeter
Teampass runs entirely on infrastructure you choose — your data centre, your cloud tenant, your jurisdiction. There is no vendor cloud in the path, no shared multi-tenant store, and no processor agreement to negotiate because there is no processor. For organisations answering to a regulator about where credentials physically reside, that is the whole argument.
The source is public under GPL-3.0. Your security team can read exactly how secrets are encrypted, how keys are distributed and what the API enforces — rather than taking a datasheet's word for it.
Straight answers
Can it run fully air-gapped?
Yes. Teampass is a PHP application against a MySQL database, with no outbound dependency required at runtime. Breach-check style features that need external data are optional and can stay off.
How does it fit our identity provider?
OAuth2 single sign-on, or LDAP and Active Directory with nested group resolution in both login modes. Directory groups map to Teampass roles, so joiners and leavers follow the directory.
Is there an API for our automation?
Yes — a REST API covering item and folder CRUD, the whole folder tree in a single call, and native Bash and PowerShell clients. Folder rights are enforced identically through the API and the web interface.
What about separation of duties for administrators?
Administrators manage the instance, but personal folders are decryptable only by their owner and the recovery account. Role assignment is scoped to the caller’s own roles, so an administrator cannot grant themselves rights they do not hold.
Do you offer commercial support?
Yes — priority handling on defects and messages, sponsored feature development and deployment assistance. See the support page.
Is Teampass certified against ISO 27001 or SOC 2?
No, and you should be sceptical of any self-hosted open-source project claiming otherwise — those certifications apply to an organisation’s operations, not to a piece of software you run yourself. What Teampass does is produce the access-control evidence your own audit needs.
Evaluate it against your own controls.
Install it, point it at a test directory, and run a recertification campaign. Nothing to sign, nobody to call.