MacSouverain

FREN
privacy

Passwork, « Made in EU » outside, FSB-certified inside

A tool sold as Made in EU, with code pushed from Russia. The label has no legal weight. Here's the checklist to vet your software supply chain.

Passwork, « Made in EU » outside, FSB-certified inside

Introduction

A software company based in Barcelona. A password manager sold to European public bodies. On the website, until recently, two reassuring lines: “Made in EU 2017” and “no affiliations with any US, Russian, or other non-European entities”.

Small problem. The software is in fact affiliated with Russia. And its source code is certified by the FSB, which had access to it. Barely worth mentioning.

On 17 July 2026, a consortium led by OCCRP and VSquare, with a dozen newsrooms including Le Monde, NU.nl, De Groene Amsterdammer, Investico and De Tijd, published an investigation. The code of this European tool is developed in Russia, in Arkhangelsk, and its updates travel through an entity in the Emirates. The two reassuring lines vanished from the website after the journalists started asking questions.

This piece isn’t only about Passwork. Passwork is just one more example of Brussels’ incompetence. Get this straight, “Made in EU” on a product page carries no legal weight, and protects you from nothing.

Nobody, not Brussels, not a label, checks it for you. So let’s learn to do it ourselves.

The problem: a flag proves nothing

You pick a piece of software to protect your data. You see “European”, you see a head office in the EU, and you decide sovereignty is ticked off. You’ve just confused two things that have nothing to do with each other.

A company’s registration address tells you where its lawyers and its taxes sit. It doesn’t tell you where the code running on your machine comes from. Those are two separate chains: the legal chain, and the software supply chain. The first is easy to display on a website. The second is invisible, and it’s the only one that matters.

Take the case documented by the investigation. Passwork Europe S.L. is indeed registered in Barcelona. But Passwork LLC is registered in Arkhangelsk, Russia, in November 2022. Same logo, a common code base at the origin, and user manuals the investigation calls “virtually indistinguishable aside from the language”. On the two versions released in early April 2026, a researcher notes an install script of around 517 lines that he describes as “basically identical”.

Two products presented as separate. One code base, or nearly.

The point isn’t “a Russian company, that’s bad”. The point is more uncomfortable: nothing on the product page let you know. The “Made in EU” label did exactly the job it exists for, reassuring you, without proving anything.

The mechanism: the three questions the label never asks

A tool’s sovereignty can’t be read off a flag. It’s read off three concrete questions, and not one of them shows up on a sales brochure.

Who ships the binary?

The code you use isn’t the one sitting in a public repository. It’s the one that lands on your machine at the next update. So the real question is: which entity builds and delivers that update?

In the Passwork case, the cofounders Ilya Garakh, who owns the domains, and Andrey Pyankov, a manager, operate through Passwork FZ-LLC, registered in Ras Al Khaimah, in the Emirates, in July 2022. It’s this entity that supplies the updates to the European branch. Passwork describes it as “limited product related knowledge-transfer support” during a transition period meant to end in August 2026.

Translation: the European binary is, at least until that date, fed from outside Europe. A researcher quoted in the investigation sums up the EU/Russia split as “technically shallow”.

Who signs the code, and with which key?

A legitimate update is cryptographically signed. That’s what guarantees the file you install really comes from the vendor and hasn’t been tampered with along the way. Except a signature guarantees origin, not innocence. If the entity holding the signing key is also the one that could slip something into an update, a valid signature protects you from nothing. It just certifies the parcel really came from the sender, whatever the contents.

It’s the update channel, not the storage, that concentrates the risk. A researcher quoted in the investigation describes it as “the most elegant and hardest-to-detect attack vector”. OCCRP itself draws the parallel with SolarWinds, that 2019-2020 attack where a perfectly legitimate monitoring tool served as the vehicle for a massive compromise, through its signed updates.

Let’s stay precise: to date, no backdoor has been found in Passwork, no leak, no compromised client. We’re talking about a vector that exists, not an attack that took place. The channel would allow, structurally, what SolarWinds proved possible. This isn’t an accusation. It’s a geometry.

Which state got to review the source?

Here’s the question nobody thinks to ask, and it may be the heaviest.

Passwork LLC is certified by FSTEC, which VSquare ties to the Russian Ministry of Defense, and by the FSB. These certifications aren’t administrative rubber stamps. The process requires the source code to be submitted to accredited laboratories, tasked with detecting “vulnerabilities or undeclared capabilities”.

In other words: a state organized the review of this software’s source code. Not the European Union. Not an auditor you hired. A service under another jurisdiction, with its own priorities.

When you install a piece of software, you’re not just trusting the vendor. You’re trusting, without knowing it, everyone who had their hands in its code before you.

The regulatory maze that saw nothing coming

At this point you might tell yourself this is exactly what we pay regulators for. Europe churns out digital regulation by the yard, a fresh acronym every quarter, a triumphant press release for every text passed. So this Russian vault dressed up as a European product, sold to its own public bodies, did they see it coming? No. Not one alert, not one line.

Look at the regulatory stack meant to cover this ground. The Cyber Resilience Act imposes “by-design” security on digital products: how they’re built, not by whom or from where. The Cyber Solidarity Act, in force since 4 February 2025, organizes crisis response: a European alert system, a cybersecurity reserve, a post-incident review. Useful the day the house is on fire, silent on who lit the match. And ENISA’s certification schemes, the EUCC for products, the EUCS for cloud, assess assurance levels against technical criteria.

Look through all of that for the box marked “which entity ships the binary” or “which state reviewed the source”. It doesn’t exist. None of these texts certifies a product by its real origin, and none of them bans anything on that basis. A company can display “Made in EU”, have its code reviewed by a foreign intelligence service, and stay perfectly compliant with Brussels. Compliant, stamped, spotless on paper. That’s the level of protection you were sold with billions poured into European cybersecurity and press conferences.

While this vault, whose Russian strain is FSB-certified, thrived on the European public market, where was the same Union pouring its energy? Into trying to force messaging apps to scan your private conversations before encryption, the CSAR (Chat Control 2.0). Translation: Brussels couldn’t spot a tool reviewed by a Russian service and sold to its own public bodies, but it wants to search the messages of hundreds of millions of Europeans. Incompetent on the real threat, zealous about surveilling the innocent.

Read next: Chat Control 2.0, the EU wants to read your messages before you send them and NIS2 forces you to encrypt, CSAR forbids you from really doing it

The conclusion is unpleasant but clear. Software sovereignty isn’t delegated to a regulator. It’s on you. You, the citizen. You, the small business.

What this changes in practice: your verification checklist

Good news, you don’t need to be a cyber-defense analyst. You need a method. Before you hand your passwords, your contracts or your accounts to a piece of software, run it through these six questions. Take the most sensitive example there is, a password vault, the one that holds the keys to everything else.

  • Who ships the binary? Look for the entity that actually publishes the updates, not the one that cashes your invoice. Company register, legal notices, corporate history. A European address on the homepage and a parent company elsewhere is a signal, not an answer.
  • Who signs the code, and with which key? A serious vendor publishes its signatures and lets you verify them. Look at who holds the signing key and where. A key controlled by an entity under an opaque jurisdiction cancels the benefit of the signature.
  • Which state got to review the source? National certifications are public. An FSTEC or FSB certification means the code was reviewed by accredited Russian labs. Conversely, an ANSSI visa (like the one earned by KeePassXC) means a French evaluation. That’s not neutral: ask yourself which state you’re willing to let look under the hood.
  • Self-hosted or cloud? Software you host yourself takes the vendor out of the storage loop. Your data stays on your infrastructure, under your jurisdiction. It doesn’t solve the update-channel problem, but it shrinks the surface. The vendor’s cloud, on the other hand, stacks both dependencies.
  • What update history, through which channel? A mature project has a readable changelog, a stable and documented distribution channel. Opaque updates, a channel that keeps changing, an exotic distribution entity: so many red flags. The channel is the real entry point, watch it as such.
  • Is the code auditable? Open source doesn’t magically make software safe, but it makes lying harder. Public code could have been read by anyone, including people with no interest in reassuring you. Closed code asks you to take the vendor at its word, and you’ve just seen what words on a product page are worth.

None of these six questions needs a budget. They need ten minutes and the will to look behind the flag. Apply them to your current manager tonight. Some will pass the test without breaking a sweat, others far less so.

Read next: Apple, Bitwarden, KeePassXC or 1Password, the honest comparison of password vaults

The limits: what this checklist won’t tell you

We have to be honest on two points, otherwise we slide into trial by insinuation.

First, fairness to the vendor in question. Passwork claims its independence, says the transition with the Russian entity ends in August 2026, and that its clients’ data lives on those clients’ servers. Its CEO, Alexander Muntyan, invokes a “zero-knowledge architecture”, with encryption and decryption on the client side: “we would simply have no data to provide”. This argument deserves to be taken for what it is, a marketing argument, not a technical guarantee. In the self-hosted version, that layer can be disabled, and a server-side layer exists. Above all, zero-knowledge protects the storage, not the update channel, and it’s the channel that worries the researchers.

On the client side, caution too. The investigation establishes that two Irish bodies, the Office of Public Works and the State Laboratory, say they weren’t informed of the product’s origin, the latter now treating the matter as a “potential risk”. Beyond that, on the Russian side Passwork LLC lists clients from the military-industrial complex, including Almaz-Antey, MMZ Avangard, Kometa and Gazprom Neft. Several appear on Western sanctions lists, but under different regimes, EU, United States or export controls depending on the case. No lumping together: neither “all sanctioned by the EU”, nor “all European clients compromised”.

Second, the checklist itself has limits. It doesn’t detect an active compromise, it assesses a structural risk. Software that ticks every box can still be attacked, and software that misses one isn’t necessarily a trap. The checklist doesn’t replace an audit, it stops you from mistaking a sales brochure for proof. That alone is huge.

In short

“Made in EU” is a marketing claim. Not a controlled label, not a legal guarantee, not proof of sovereignty. The Passwork affair shows it without needing a single proven compromise: a piece of software can be registered in Barcelona, coded in Arkhangelsk, updated from the Emirates, and reviewed by a Russian service, all while staying perfectly compliant with the European regulatory stack. That stack, Cyber Resilience Act, Cyber Solidarity Act, ENISA schemes, never asked the right questions. It still doesn’t. Don’t count on it. It didn’t protect you, it reassured you. That’s not the same job.

So ask them yourself. Who ships the binary, who signs the code, which state got to read the source, can you host it yourself, what’s the update channel, is the code auditable. Six questions, ten minutes, applied first to the most sensitive spot there is: the vault where all your passwords live. Sovereignty can’t be read off a flag. It has to be verified. Nobody will do it for you.

Sources

The investigation

The regulatory framework