Password Manager for Google Workspace
Your Data, Your Google Workspace, Your Rules
Most password managers ask you to trust their servers with your credentials. Enpass keeps encrypted vaults in your organization's Google Workspace, so data sovereignty comes from the setup you already run, not from self-hosting.
More than sign-in integration
Most password managers connect to Google Workspace for sign-in and user provisioning, then stop. Enpass covers both and goes further: encrypted user vaults live in your Workspace, too. This means your organization's sensitive data never leaves the trusted environment you own and control.
| Vendor-hosted password managers | Enpass | |
|---|---|---|
| Sign-in | SSO through Google Workspace or another identity provider. | SSO through Google Workspace, or any SAML 2.0 identity provider. |
| User onboarding and offboarding | SCIM from your identity provider. | SCIM from your identity provider. |
| Setup and maintenance | Minimal, but you're trusting a third party with everything. | Minimal. Google Workspace is already running, so there's no server to stand up and no extra vendor cloud to vet. |
| Where encrypted vaults are stored | On the vendor's own servers. | In your Google Workspace: user vaults in their Google Drive, shared vaults in shared drives or folders users choose. |
| Where data residency is decided | Wherever the vendor's servers are. | By your Google Workspace data location settings, also inheriting the access controls you’ve set for each geography. |
| What a vendor breach exposes | Potentially every customer's and user's encrypted vault at once. | No vault data, because Enpass never held it. |
Why security and compliance teams like Enpass
- Google Workspace settings carry over: The sharing rules and access policies you manage in Google Admin already apply to vaults, because each vault is an encrypted file in Google Drive or a shared drive. No need to re-create these settings in Enpass.
- No self-hosting hassle: Google already keeps Drive patched, monitored, and available. Choosing Enpass doesn't hand your team a server to run or a self-hosted instance to keep current.
- Residency follows your Workspace data: Operating in several jurisdictions? Vault data is wherever your Google Workspace data is stored, under the data location choices you've already made. Auditors get the same residency answer for credential data as for the rest of your Workspace.
- Enterprise admin controls, connected to your stack: SSO through Google Workspace or any SAML 2.0 identity provider; automatic provisioning and deprovisioning through SCIM integration; event streaming to Splunk, IBM QRadar, Sumo Logic, Graylog, or any webhook-based SIEM; and app rollout through your UEM/MDM platform, all managed from the Enpass Admin Console.
Easy setup for admins and users
Admin
Start in Google Admin by marking Enpass as a trusted app for the whole organization or chosen organizational units. From the Enpass Admin Console, link your Google Workspace, and then switch on SSO, SCIM, and SIEM integration. Users will be automatically provisioned, and audit and event logs will start appearing in your SIEM.
Integrates with tools you already use
Enpass plugs into the identity, logging, and device management tools you already run alongside Google Workspace, so password management doesn't become another silo.
SSO
Set up as a custom SAML app in Google Admin or use any SAML 2.0 provider.
SCIM
Adds new starters and removes leavers automatically.
SIEM
Credential events stream in through native connectors or a JSON webhook, so existing detection rules can flag unusual activity.
UEM/MDM
Push Enpass to managed devices and keep it updated using managed app configurations.
Trusted by teams running Google Workspace
"We didn't want to send our passwords to unknown servers. With Enpass, we don't have to. All the credentials stay within our company's Google Workspace account."
CTO
Legal Consulting Firm
Independently audited and certified
Enpass is the password manager of choice for organizations in regulated industries including financial services, healthcare, government, and manufacturing.
ISO 27001:2022
SOC 2 Type II Audited
GDPR Compliant
Frequently asked questions
No. Enpass is neither self-hosted nor vendor-hosted. The only infrastructure involved is the Google Workspace you already run: vaults are encrypted files in Google Drive and shared drives. There's no server for your team to stand up, patch, or monitor, and nothing to install inside Google Workspace.
Enpass uses delegated OAuth scopes, so it only ever acts as the signed-in user. If someone can't open a file in Google Drive, Enpass can't open it for them either. It never scans Drive and works only in its own private folder or in folders a user selects for shared vaults.
They'd find encrypted files, not usable passwords. Each vault is still locked by the user's master password and any keyfile you've added, and protected by AES-256 with 320,000 PBKDF2 rounds. And because every vault needs its own user's master password, breaking into one doesn't open the rest: an attack on one is not an attack on many.
They'd find encrypted files, not usable passwords. Each vault is still locked by the user's master password and any keyfile you've added, and protected by AES-256 with 320,000 PBKDF2 rounds. And because every vault needs its own user's master password, breaking into one doesn't open the rest: an attack on one is not an attack on many.
Any provider that supports SAML 2.0, including Google Workspace. In Google Workspace, you set Enpass up as a custom SAML app in Google Admin. SCIM handles joiners and leavers automatically: removing a user, or revoking their Enpass license, ends their access and deletes their Enpass data.
Enpass has native connectors for Splunk, IBM QRadar, Sumo Logic, Graylog, plus a JSON webhook for anything else. Your security team gets events like new device registrations, permission changes, vault exports and imports, sharing activity, and access recovery requests. Existing detection rules can then flag anything unusual, like a spike in recovery requests.
Most teams use the UEM/MDM platform they already manage. Enpass supports managed app configurations, so you can preconfigure settings, push the apps to devices, and handle updates alongside the rest of your software. Users who aren't on managed devices can download Enpass themselves and connect with their Google account.
Users can share a vault by individually selecting required members with management, write, read-only, or autofill-only access. Each shared vault lives in a shared drive or chosen folder, under your Drive sharing permissions, and opening it requires the vault key that is stored on Enpass Hub; secured with public key cryptography. Admins see every shared vault in the Enpass Admin Console.
Insight for IT and security leaders
Get password management without the vendor risk
Bring password management into the Google Workspace you already run.
