A Keeper Alternative for Teams with Nobody to Run It

Keeper is a zero-knowledge password manager from Keeper Security, sold in personal, business, and enterprise tiers. Zoho Vault is Zoho’s team password manager and sits inside the Zoho suite. Both store credentials encrypted. The practical gap is where each lives, and who configures it afterward. We manage Vault on a monthly plan.

Three tiers: Business Starter for 5 to 10 seats, Business from 5 seats, and Enterprise by quote, all billed annually (October 2026). Starter includes the encrypted vault, admin console, and sharing. Business adds delegated administration. We could not read a per-user price on Keeper’s own pricing page, so ask Keeper for a current quote.

Keeper’s feature list puts SCIM provisioning, command line provisioning, Active Directory and LDAP sync, Entra ID integration, advanced two factor with Duo and RSA, SSO with SAML 2.0, and developer APIs under Enterprise (October 2026). Business and Starter get the admin console, policy engine, and basic two factor. Check the tier before assuming a feature is included.

Keeper describes AES 256-bit encryption with elliptic curve cryptography, done on the user’s device, and master password key derivation using PBKDF2 at 1,000,000 iterations (October 2026). Its keys are also wrapped by non-exportable HSM keys. Vault likewise encrypts before data leaves the device, with a master password Zoho never stores.

A long list. Keeper reports SOC 2 Type 2, ISO 27001, 27017, and 27018, FedRAMP High on AWS GovCloud, and FIPS 140-3 validation under NIST certificate 4743 (October 2026). It also states HIPAA, GDPR, and PCI DSS Level 1 compliance. If a contract demands FedRAMP High specifically, Keeper is the product to price. We would tell you that on the first call.

Every business subscription gets a Recent Activity report covering the last 1,000 events across 200 or more event types, plus a security events report (October 2026). Custom reports, alerts by email or SMS, and exports to JSON, CSV, or Syslog need the separate ARAM subscription. SIEM streaming reaches platforms such as Splunk and Microsoft Sentinel.

Through Account Transfer. An administrator locks the departing user’s account, then moves its records, folders, and subfolders into one folder in a chosen colleague’s vault, named for the old owner’s email (October 2026). The user must have accepted the transfer policy within 7 days and logged in once. The original account is then deleted permanently.

Keeper’s documentation shows how easy it makes moving in: an automated LastPass import covers passwords, folders, TOTP codes, and attachments, and Commander handles shared folders for administrators (October 2026). Moving out is a different job. Plan to export, clean, and remap record types before importing, which is the work we take on.

Yes. Keeper is one of the sources we export from, along with other managers, browser stores, and spreadsheets. We clean the data first, so duplicates and credentials for retired systems stay behind, then import into a chamber structure we agree with you beforehand. Setup is usually two to three weeks, longer if you have many systems or strict compliance needs.

Keeper ships 20 default record types, among them Login, SSH Key, Software License, Database, and WiFi, and business customers can add custom ones (October 2026). Vault also supports custom secret types for API keys, SSH keys, licenses, certificates, payment cards, and Wi-Fi credentials. We set those up in onboarding, so neither tool is short on field types.

Roles attach to nodes in an organizational tree. Keeper groups enforcement into 13 categories, including Two-Factor Authentication, Allow IP List, and Import and Export, and when a user holds several roles the most restrictive setting applies (October 2026). Administrative roles cannot be mapped to teams. That is a good model, provided somebody tends it.

Keeper lists email, live chat, and phone support around the clock, and business plans get priority email and onboarding help (October 2026). Our replies come within two business days, so for a round the clock incident line Keeper is ahead. We work from the monthly review and the runbooks we leave behind.

Everything. The Zoho organization is registered to your company, the Vault subscription is in your name, and the secrets remain yours. Zoho bills the license directly and we do not mark it up. If you later move on, there is no contract or data to transfer back from us.

Our service is Managed Zoho Vault, so we do not administer Keeper accounts or certify your company against a standard. We also will not push Vault if it is wrong for you. If your contract needs something Keeper holds, such as FedRAMP High, or you already run Keeper well, we will say so and leave it there.