By: KeyCrew Media
For growing companies, credential security is a foundation cost rather than an optional tool. Passpack CEO Chris Skipworth explains what European expansion changes for small and mid-sized businesses.
When a small or mid-sized business expands into Europe, security spending rarely makes the budget headline. It should. Every new office, client, and system adds more logins, and every login is a point of exposure. Where that credential data is stored, who can read it, and whether employees actually use the tool all carry a cost, and getting them wrong costs more.
“Password management isn’t a nice-to-have add-on,” said Chris. “It’s foundational infrastructure. Almost every breach story starts with a credential, so getting that layer right is where security spending pays off first.”
The compliance cost of location
Data location has become a cost line in its own right. Under GDPR, penalties for violations, including unlawful international transfers, can reach €20 million or 4% of global annual turnover, whichever is higher. The legal basis for moving European data to the US has also been unstable: the Court of Justice invalidated Privacy Shield in 2020, and its replacement, the EU-US Data Privacy Framework, is now under appeal after surviving a challenge in September 2025.
For a smaller firm without a compliance department, the cheapest way to manage that uncertainty is often to avoid it. Passpack has expanded its Amsterdam data center capabilities for this reason. “Our European customers should be served from a European base, not a US one,” Skipworth said. “Part of that is GDPR and how data is stored, but it’s also quality of service: speed, access and backup.”
He is candid that the move is about infrastructure rather than novelty. “It’s more of an infrastructure upgrade than a dramatic new feature, but for a European customer it matters.”
Limiting the cost of a vendor breach
A European data center decides which laws apply to stored credentials. What an attacker could see after a breach comes down to encryption. Passpack uses a zero-knowledge model, where credentials are encrypted on the customer’s device and the decryption key is never sent to Passpack. Passpack runs the service and holds the encrypted vaults, but it has no way to see the passwords stored in them.
“The financial risk in a vendor breach depends on what an attacker can actually read,” Skipworth said. “If we can’t read your credentials, neither can anyone who gets into our systems. That limits the damage by design.”
Security that gets used
The final cost is adoption. A tool that is paid for but poorly used delivers little protection. Passpack is introducing support for Portuguese, Spanish, French, German, Italian and Dutch, a move Skipworth ties to the infrastructure work. “The translation and the European infrastructure go hand in hand,” he said. “They’re both about properly supporting customers outside the US.”
His reasoning is a security one. “If people can’t comfortably use the tool, they fall back on reused passwords and shortcuts, and that undoes the protection you paid for. Language is part of getting credential hygiene to stick across a team.”
What it means for SMBs
Smaller companies face the same obligations as larger rivals without the same budgets, so the vendor has to carry more of the load. “A small business has the same obligations as a large one, but without a compliance department,” Skipworth said. “Enterprise-grade security shouldn’t be something only big companies can afford.”
For business leaders, the broader lesson is that security should be judged by outcomes. Data in the right jurisdiction, credentials that can’t be read by the vendor, and a tool the whole team actually uses add up to a cheaper security position than any one of them alone.
