1Password is a password manager developed by AgileBits Inc., a privately held company headquartered in Toronto, Canada. Vault contents ("Secure Data") are end-to-end encrypted with keys derived from the user's account password and a 128-bit Secret Key, and the company states it cannot read this data. Outside the vault, 1Password collects account, diagnostic, and product-usage information, runs an opt-in in-app telemetry system, and — with its marketing partners — uses cookies and tracking technologies on its websites for analytical and advertising purposes, which its policy says may be considered a "sale or sharing" under some privacy laws. Business plans can stream employee sign-in and item-usage events to employer SIEM tools. It publishes SOC 2 and ISO 27001-suite attestations and penetration tests, and raised $620M at a $6.8B valuation in 2022.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
18 ON FILE
COLLECTION
1Password's security model documentation states that all account data is end-to-end encrypted, protected by a 128-bit Secret Key combined with the account password, and that authentication uses the Secure Remote Password (SRP) protocol so the account password is never sent over the internet.
As assessed by PrivacySpy on 2021-07-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — No.
1Password's Privacy Notice, effective 2025-12-29, states that user vault contents ("Secure Data") are encrypted with keys held only by users, that the company cannot access this data in readable form, and that it separately collects account/contact data, diagnostic and technical usage data, and — with permission — product usage information.
As assessed by PrivacySpy on 2021-07-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes, including independent audits.
TechCrunch reported on 2022-01-19 that 1Password closed a $620 million Series C round at a $6.8 billion valuation, led by Iconiq Growth with participation from Tiger Global, Lightspeed Venture Partners, Backbone Angels, and Accel.
In a company announcement dated 2024-02-20, 1Password CEO Jeff Shiner disclosed the acquisition of Kolide, a device security company whose device-health and contextual-access product became part of 1Password's Extended Access Management offering.
1Password's Privacy Notice, effective 2025-12-29, identifies the operating company as AgileBits Inc., doing business as 1Password, a Canadian company headquartered in Toronto, Ontario, Canada, acting as controller of user information.
1Password Events Reporting, a 1Password Business feature, lets account administrators send account activity — including sign-in attempts, item usage, and audit events — to employer-operated SIEM platforms such as Splunk, Microsoft Sentinel, and Datadog via the 1Password Events API.
As assessed by PrivacySpy on 2021-07-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
1Password's Privacy Notice, effective 2025-12-29, discloses that the company sends information to third-party marketing services to advertise its services, and states that this may be considered a "sale or sharing" of personal information under applicable privacy laws, with opt-out rights depending on where the user lives.
1Password's security assessments page documents third-party verification including SOC 2 Type 2 certification, ISO 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications, a penetration test and code review by Independent Security Evaluators performed April–June 2020, penetration-test reports distributed through its Trust Center, and a public HackerOne bug bounty program as of December 2024.
As assessed by PrivacySpy on 2021-07-01 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
In a disclosure published 2023-10-23, 1Password reported that on 2023-09-29 it detected suspicious activity on the Okta instance used to manage its employee-facing apps — linked to Okta's Support System breach — and concluded after investigation that no 1Password user data was accessed and no user-facing systems were compromised.
1Password's team telemetry documentation states that in 1Password Business and Teams accounts, only members of the Owners group can turn off telemetry participation, and individual team members cannot opt out of telemetry in their work accounts.
1Password's telemetry support documentation describes an opt-in in-app usage telemetry system that records events such as finishing onboarding, unlocking the app, and creating items, plus device/account metadata; it states telemetry never includes vault contents and that raw data is deleted 21 days after a user opts out.
1Password's Privacy Notice, effective 2025-12-29, states that 1Password and its marketing partners use cookies and other tracking technologies to collect information about interactions with its websites and products for essential, functional, analytical, and advertising purposes.