Privacy Policy
Effective date: July 27, 2026
rePASS is a self-hosted enterprise password manager developed by RELabs. This policy explains what data is processed by the rePASS product (server, web app, browser extension and other clients) and by this website, repass.one.
The short version: rePASS is built on a zero-knowledge architecture. Your secrets are encrypted on your device before they are stored, the software runs on your organization’s own infrastructure, and we — the developers — have no access to your data.
1. The rePASS product (self-hosted)
rePASS is installed and operated on infrastructure chosen and controlled by your organization. We do not host your data, we do not operate your server, and no vault data is ever transmitted to RELabs.
Within your installation, the following applies:
- All vault contents (passwords, notes, passkeys, TOTP secrets and other items) are encrypted client-side with AES-256-GCM before being sent to your server. Encryption keys are derived from your vault password using PBKDF2-SHA256 and never leave your device.
- The server stores only ciphertext. Neither your server administrator nor RELabs can read your vault contents without your vault password.
- Account data processed by your server (e.g. name, email address, Azure AD identifiers, audit logs) is controlled by your organization, which acts as the data controller for its installation.
2. The browser extension
The rePASS browser extension connects exclusively to the server address configured by you or your administrator. It does not communicate with RELabs or any third party.
- The extension processes authentication information (login form data, credentials, TOTP codes, passkeys) solely to provide autofill and credential management on the sites you visit.
- Session state and server configuration are kept in local browser storage and are removed when you sign out or remove the extension.
- The extension contains no analytics, no trackers and no advertising. It does not sell or share any data with third parties.
- Broad host permissions (access to the sites you visit) are required only to detect and fill login forms locally in your browser. Page content is not collected or transmitted anywhere.
3. This website (repass.one)
The repass.one marketing website uses Google Analytics to understand aggregate visitor traffic (pages viewed, approximate region, browser type). This involves cookies set by Google. The data is aggregated and is not used to identify individual visitors.
If you contact us by email, we use your address only to respond to your inquiry.
4. Data retention and your rights
For self-hosted installations, retention is governed by your organization’s policies — contact your administrator to exercise access or deletion rights.
For website analytics data, standard Google Analytics retention periods apply. You can block analytics cookies in your browser without affecting the website.
5. Changes and contact
We may update this policy as the product evolves; the effective date above always reflects the latest revision.
Questions about this policy or about rePASS: [email protected]