Where the service runs, who helps deliver it, how your vault is encrypted and what PineKey can and cannot see.
The vault’s home
Helsinki, Finland. European Union.
The PineKey application, primary vault database and routine server backups run on Hetzner infrastructure in Helsinki. A standby on our own server in Sweden receives every database change within seconds and the remaining service files every five minutes, and can take over if Helsinki fails. Encrypted backup copies are also kept on our own servers in Sweden. The provider behind PineKey is a Swedish company.
Cloudflare provides global network delivery. Service mail goes through our own PineMail service and Amazon SES in Stockholm; PineMail also receives our own mail, including support. Supporting processing can take place outside the EEA; “EU-hosted vault” does not mean every data flow stays in the EU.
Your vault contents are encrypted on your device before reaching our servers. Your master password unlocks protected encryption keys locally and is not sent to the application API.
Our servers can read account email, organisation membership, permissions, timestamps and other service metadata needed to operate the service. A compromised device or unsafe sharing can expose information after it is decrypted.
Separate organisation keys and collection permissions
Password-encrypted export and content history
Prearranged, read-only emergency access
You choose who receives shared or emergency access. PineKey cannot recover vault contents by resetting a forgotten master password. A team owner can replace a member’s password only after that member enrolls.
Current limits, stated plainly.
PineKey uses Vaultwarden as its storage and authentication backend, with PineKey web, browser and CLI clients. PineKey is independent of Bitwarden.
Our availability target is 99.5% per month, without financial SLA credits.
Backups are encrypted and kept nightly on the hosting server and on our own servers in Sweden. Keep your own encrypted exports, especially for information you cannot replace.
An optional offline copy covers personal items only and must be refreshed within seven days. A disconnected device cannot receive an immediate revocation; already-copied secrets cannot be recalled.
Service levels you can inspect.
See measured availability, coverage and interruptions on our public status page. Planned permanent closure requires at least three calendar months’ notice, never less than 90 days.
Our DPA is available to organisations on every plan. Written confirmation identifies the customer, covered processing and provider arrangements before it takes effect.
Start with a private report to [email protected]. Describe the affected page and a minimal reproduction using your own test account. Ask for a suitable channel before sending sensitive evidence.
Do not access another person’s vault, copy their data, disrupt the service or publish live credentials. Stop testing if unexpected third-party data appears. No paid bug-bounty programme is currently offered.
Our vulnerability disclosure policy sets out what we promise in return: an acknowledgement within three business days, an assessment within ten, a fix within 90 days, and safe harbour for good-faith research.