In short: Keeper Security makes a zero-knowledge business password manager and KeeperPAM, a privileged access platform covering secrets, remote sessions, endpoint privilege and browser isolation. Forever Systems supplies Keeper Business Starter, Business and Enterprise licences per user, adds only the modules you need and manages changes and renewals on one account.
What Keeper Security does
Keeper Security builds a password and privileged access platform on a zero-knowledge design: vault data is encrypted on the user's own device before it reaches Keeper's cloud, so Keeper cannot read it. The product started as a password manager and has grown into a wider access platform that also looks after administrator credentials, machine secrets and the endpoints people work on.
For UK organisations the attraction is usually twofold. Staff get one place to store and share passwords, passkeys and two-factor codes, and IT gets an admin console with policies, reporting and an audit trail that holds up when an insurer, auditor or Cyber Essentials assessor asks how credentials are controlled. Keeper publishes SOC 2 Type II and ISO 27001, 27017 and 27018 certification, FIPS 140-3 validation and FedRAMP High authorisation, and tenants can be hosted in its EU data centre region.
The Keeper products we supply
| Product | What it covers | Licensed by |
|---|---|---|
| Keeper Password Manager | Business Starter, Business and Enterprise vaults, with dark web monitoring (BreachWatch), reporting, compliance, chat and storage add-ons | User |
| KeeperPAM | Privileged access management: rotation, privileged sessions, tunnels, recording and discovery | User needing PAM features |
| Keeper Secrets Manager | Secrets for applications, CI/CD pipelines and infrastructure | Add-on per user, or included in KeeperPAM |
| Keeper Connection Manager | Self-hosted browser-based RDP, SSH, VNC and database sessions | Arranged through Keeper; included in KeeperPAM |
| Keeper Endpoint Privilege Manager | Removes local admin rights on Windows, macOS and Linux with just-in-time elevation | Endpoint seats |
| Keeper Remote Browser Isolation | Isolated access to internal and SaaS web apps | Included in KeeperPAM |
Most customers start with the password manager and add modules later. KeeperPAM already includes Secrets Manager, the self-hosted Connection Manager and Remote Browser Isolation, so if you need two or more of those it is often the simpler route.
How Keeper is licensed
Keeper is licensed per user. Every person with a vault needs a licence on the base plan (Business Starter, Business or Enterprise), and add-ons are then licensed for the people who need them rather than the whole organisation. Keeper's own documentation gives the example of an organisation with 100 Enterprise users, ten of whom need privileged access: it buys 100 Enterprise licences and ten PAM add-ons.
The exceptions are worth knowing before you budget:
- Endpoint Privilege Manager is counted by endpoint seats for the devices running the agent
- Secure file storage is a pooled storage add-on shared by the whole organisation, not an allowance per user
- Connection Manager, Remote Browser Isolation and Secrets Manager are arranged through Keeper rather than bought in the admin console, which we handle for you
Business Starter is designed for small teams; Keeper moves an account to Business automatically once it grows past ten users. Keeper's published business plans are billed annually. Through Forever Systems we confirm the term available for each product on your quote, and you can add users or move from Business to Enterprise during the term. For background, see per-user vs per-device licensing and monthly vs annual licences.
Buying Keeper through Forever Systems
When you license Keeper through us you get one account and one invoice alongside your other subscriptions, rather than another card payment to track.
- Scope it: we check how many people need a vault, whether you need single sign-on and directory provisioning (which points to Enterprise), and whether any admins need privileged access features.
- Quote it: you get a quote for the right plan and only the add-ons you will use. Ask us for a quote rather than relying on list prices, which do not reflect your term or quantity.
- Deploy it: we can connect Keeper to Microsoft Entra ID or Google Workspace, import existing passwords, set enforcement policies and roll out browser extensions.
- Run it: joiners, leavers, edition upgrades and renewals are handled by our UK team.
Already paying Keeper directly? Moving supply is usually straightforward at renewal; see switching licence supplier.
Who Keeper suits
Keeper fits organisations from a handful of staff to thousands. Very small teams can start on Business Starter; most small and mid-sized firms buy Keeper Business for shared team folders, delegated administration and a free personal Family Plan for every employee, which helps adoption. Larger organisations, schools, trusts and regulated businesses lean towards Enterprise for SSO, SCIM provisioning and role-based access control, and towards KeeperPAM when admin and service account credentials need the same control as everyone else's.
Comparing options? See all password managers we supply, pair Keeper with MFA from identity, MFA and privileged access, or browse every vendor on our vendors A to Z.
Explore Keeper Security
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Keeper licensed per user or per device?
Mostly per user. The password manager plans, KeeperPAM and the Secrets Manager add-on are licensed per user. Endpoint Privilege Manager is counted by endpoint seats, and secure file storage is a pooled add-on for the organisation. We set this out line by line on your quote.
What is the difference between Keeper Business and Keeper Enterprise?
Business gives every user a vault with shared team folders, delegated administration, organisational structure and integrations, and a free Family Plan per user. Enterprise adds advanced provisioning (SSO via SAML 2.0, SCIM and AD/LDAP), advanced two-factor authentication, role-based access control and developer APIs.
Can we buy only a few PAM licences?
Yes. Keeper licenses PAM for the users who need it. Everyone keeps their Business or Enterprise vault licence and only your administrators take the PAM add-on.
Where is Keeper data stored for UK customers?
Keeper hosts tenants in several regions, including the US, EU, Canada, Australia and Japan. It does not list a separate UK region, so UK organisations usually choose the EU region. Because Keeper is zero-knowledge, vault contents are encrypted before they leave the device wherever the tenant is hosted.
Do you sell Microsoft licences on this site?
No. Keeper integrates with Microsoft Entra ID for single sign-on, but Microsoft licensing is handled by Forever Group: see Microsoft licensing.