Prevents falling behindOff-the-shelf productEstablished, AI retrofitted

1Password

AgileBits Inc., trading as 1Password, Toronto, Canada ·1password.com· As of: 2026-08-17

Holds a company’s passwords, keys and credentials in vaults with permissions per person and group, so that access is withdrawn in one place when somebody leaves instead of living on in browsers, spreadsheets and chat histories.

Work through this tool with an AI

Our verdict

Running central credential management wins nobody a customer. Not running it loses deals: a corporate procurement security questionnaire asks how privileged access is managed, the cyber insurer asks the same, and the first ISO 27001 audit puts the question on the table anyway. The benefit is one-sided and the vendor interchangeable, because Keeper, Bitwarden and the company’s own directory service answer the same question. What separates 1Password from the rest is the key model: the vendor cannot read vault contents even when an authority demands it, and that is what its privacy notice says. This design costs elsewhere, namely in account recovery.

Evidence:As of 2026-08-17Legal entity, registered office and the complete library of legal documents including the naming of ISO and SOC 2 attestationsOpen sourceAs of 2025-12-29Separation of vault contents, service data and diagnostic data, the training clause based on legitimate interest, the choice of storage location and disclosure to authorities in encrypted form onlyOpen sourceAs of 2026-07-30Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract endingOpen sourceAs of 2026-07-30Sub-processors with purpose and country, Amazon Web Services as sole data centre operator, hosting of Privileged Access and Apono exclusively in the United States, shared items always in the European UnionOpen sourceAs of 2024-09-12The terms of service dated 12 September 2024 and the absence of any provision on artificial intelligence in the contract textOpen sourceAs of 2026-08-17No price for any of the five business products, replaced throughout by the instruction to request a quoteOpen sourceAs of 2026-08-17Prices for individuals and families in both billing modesOpen sourceAs of 2026-08-17The Events API being tied to the Business plan, the scope of events and the named destinationsOpen sourceAs of 2026-06-15The acquisition of Apono on 15 June 2026 and its focus on access provisioning for people, machines and AI agentsOpen sourceAs of 2022-01-19The equity round of 620 million US dollars led by ICONIQ Growth and the number of business customers by the company’s own countOpen sourceAs of 2023-10-23The self-disclosed incident connected to the session leaked at Okta, including timing and scopeOpen sourceAs of 2026-08-17Founding year and headcount by the company’s own accountOpen sourceAs of 2026-08-17Access to the certificates solely through a form requiring name, company, job title, company size and countryOpen source

Who it fits

Solo

suitable

For individuals the vendor publishes prices openly: 2.99 US dollars a month billed annually, 3.99 billed monthly, and for families 4.49 and 5.99 respectively. That is where price transparency ends. Anyone working alone needs neither approval chains nor log export, and the individual plan carries the purpose in full.

Mid-market

suitable

This is where the use case sits, and where price negotiation starts. On 17 August 2026 the pricing page lists five business products and, next to each, the instruction to request a quote. No entry price appears publicly anywhere. Anyone needing log export into their own analysis system lands on the Business plan, because the Events API hangs off that tier. That is the threshold on which the calculation for a thirty-person firm is decided.

Enterprise

suitable

The procurement checklist is served: a data processing agreement as an open document, a complete sub-processor list with country and purpose, sign-in through the company’s own directory service, user provisioning via SCIM, log export into Splunk, Microsoft Sentinel, Datadog and a dozen others. One question remains and belongs on the agenda: the core can be run in the EU, while the acquired Privileged Access and Apono areas run exclusively in the United States according to the sub-processor list.

Buy, switch or build

Off-the-shelf

The directory service you already pay for

Microsoft Entra ID already sits in most companies’ subscriptions and makes passwords unnecessary for everything that supports single sign-on. Corporates stay with it because the directory service is the source for joiners and leavers anyway, and because one access management system is less to audit than two. For privileged accounts on servers and in databases they reach for CyberArk, which records sessions and rotates credentials automatically. The gap stays the same one 1Password gets bought for: the service with no directory connection, the shared account at the payment provider, the key in the deployment script.

AI-native

Access for machines and agents

The young class leaves people aside and picks up the accounts that belong to nobody: service accounts, deployment pipelines and, more recently, AI agents. Astrix Security and Entro Security inventory these accesses and withdraw them once they are no longer needed. The price difference cannot be quantified in either direction, because none of those vendors publishes amounts either. What has to be given up is what the established class brings: management of human access. How the two halves grow together is shown by the vendor itself, since Apono, from exactly that class, has belonged to 1Password since 15 June 2026.

Build it yourself

Vaultwarden for people, Infisical for machines

Building this yourself is cheap here, and therefore worth taking seriously. Vaultwarden is an open-source server that speaks to the Bitwarden applications and runs on a small rented server for around ten euros a month. For keys in deployment pipelines, Infisical from this catalogue is available, likewise self-hosted. Going by the vendor documentation, both are set up in a day. Reckoned at a 1,200 euro day rate, setup therefore costs roughly 1,200 euros once plus 120 euros of server cost a year. Setup is the cheap part. Recovery is the expensive one: when a managing director loses her master password, somebody must have built a recovery route that has itself been tested. On top come the browser extensions for four browsers across three operating systems, which need updating after every browser change, emergency access for when the builder leaves, and a log an auditor will accept. Those four things are the price, and they recur every month rather than once.

Our advice

  • Solo: Take it: the individual plan carries the purpose and costs under three US dollars a month.
  • Mid-market: Buy it, but negotiate log export into the same quote.
  • Enterprise: Settle first what already runs through the directory service, then scope the remainder.

Who is behind it

Staying power: Established

Twenty-one years in market, an equity round of 620 million US dollars in January 2022 and five acquisitions since, the most recent in June 2026. The legal documents are maintained: the data processing agreement and the sub-processor list both carry 30 July 2026. More than 1,400 employees and over 100,000 business customers are the company’s own figures.

  • Legal entity and registered office: AgileBits Inc., trading as 1Password, 4711 Yonge St, 10th Floor, Toronto, Ontario M2N 6K8, CanadaAs of 2026-08-17Legal entity, registered office and the complete library of legal documents including the naming of ISO and SOC 2 attestationsOpen source · As of 2026-08-17
  • Founding and headcount, per the company: founded in 2005, more than 1,400 employeesAs of 2026-08-17Founding year and headcount by the company’s own accountOpen source · As of 2026-08-17
  • Last reported equity round: 620 million US dollars led by ICONIQ Growth, announced on 19 January 2022, with more than 100,000 business customers by the company’s own countAs of 2022-01-19The equity round of 620 million US dollars led by ICONIQ Growth and the number of business customers by the company’s own countOpen source · As of 2022-01-19
  • Most recent acquisition: Apono, a provider of just-in-time access provisioning, announced on 15 June 2026; no purchase price was disclosedAs of 2026-06-15The acquisition of Apono on 15 June 2026 and its focus on access provisioning for people, machines and AI agentsOpen source · As of 2026-06-15
  • Maintenance state of the legal documents: data processing agreement version 4.8 and sub-processor list version 202607, both dated 30 July 2026; the terms of service, by contrast, dated 12 September 2024As of 2026-07-30Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract endingOpen source · As of 2026-07-30
  • Documented incident and how it was handled: Disclosed by the company on 23 October 2023: using a session leaked at Okta, an attacker reached 1Password’s Okta administration on 29 September 2023. Employee-facing applications were affected; the company’s own investigation found no access to user data.As of 2023-10-23The self-disclosed incident connected to the session leaked at Okta, including timing and scopeOpen source · As of 2023-10-23

Cost of leaving: Moderate

The data comes out. Every vault can be exported as CSV or in the vendor’s own 1PUX format, and the privacy notice states explicitly that the company locks nobody out of their own data. The export is also the risk, because it produces an unencrypted file holding every credential in the company, sitting somewhere for the duration of the move. What the export does not carry is the order above it: which group sees which vault, which grant was time-limited, who accessed what and when. That structure is rebuilt by hand at the new vendor. On top come the op:// references in build definitions and deployment pipelines, all of which must be replaced after a switch.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, no condition attachedpublic PDF, version 4.8 dated 30 July 2026As of 2026-07-30Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract endingOpen sourceThe agreement sits in the legal document library without any login and declares itself part of the respective main contract, so it applies without separate execution. AgileBits acts as processor within it. Anyone needing a signed copy for their own files has to approach sales, which the library states explicitly. Validity does not depend on it. What can be shown in an audit does.As of 2026-07-30
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.documented, tied to a conditionEU, US or Canada selectable, but only for the coreAs of 2026-07-30Sub-processors with purpose and country, Amazon Web Services as sole data centre operator, hosting of Privileged Access and Apono exclusively in the United States, shared items always in the European UnionOpen sourceThe privacy notice commits to holding encrypted vault contents wherever the customer chooses at sign-up, with the European Union, the United States and Canada on offer. Two limits only surface in the sub-processor list: a shared item is stored in the European Union for as long as the share lasts, regardless of the region chosen, and the Privileged Access and Apono areas run exclusively in the United States. Anyone running the core in the European Union who later adds privileged access leaves the chosen region again at that point. For administrative and diagnostic data the choice does not apply at all: the privacy notice records that these are accessed from and transferred to other countries.As of 2026-07-30
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.documented, no condition attachedcomplete public list with purpose and countryAs of 2026-07-30Sub-processors with purpose and country, Amazon Web Services as sole data centre operator, hosting of Privileged Access and Apono exclusively in the United States, shared items always in the European UnionOpen sourceThe list in its version of 30 July 2026 names every recipient with entity, product concerned, activity and processing country. Amazon Web Services is the only data centre operator named, with Canada, the European Union and the United States. The four affiliates Apono, Kolide, Trelica and Apono Tech in Israel each carry their own entry, which makes the acquisitions of recent years traceable. Among the further recipients are Google, Datadog, Sentry and Mixpanel, which analyse usage data.As of 2026-07-30
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, tied to a conditionstandard contractual clauses in the contract, allocation per recipient not publicAs of 2026-07-30Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract endingOpen sourceThe data processing agreement carries the European Commission’s standard contractual clauses under Module 2 in full as Appendix I, and the United Kingdom transfer addendum of the ICO as Appendix II. Both are therefore part of the contract in their full wording. For the vendor’s own seat, the Commission’s adequacy decision for Canada applies in addition, covering organisations subject to the Canadian data protection act. Which of the twenty-one listed recipients operates on which of the two bases is not assigned individually in any of the public documents.As of 2026-07-30
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.documented, but unfavourablevault contents excluded, administrative data includedAs of 2025-12-29Separation of vault contents, service data and diagnostic data, the training clause based on legitimate interest, the choice of storage location and disclosure to authorities in encrypted form onlyOpen sourceThis is the finding that makes the review worthwhile. The privacy notice distinguishes three classes. Vault contents it calls Secure Data, recording that the vendor has no way to decrypt them or pass them on in readable form. Separate from those sit Service Data and Diagnostic Data, and it is precisely these two, alongside contact details, for which the vendor claims a legitimate interest in order to develop and train new technology. Reading the enumeration one level deeper turns up vault names under Service Data. The contents therefore stay sealed. The labels on the cabinets do not. The privacy notice grants a right to object; anyone who does not exercise it stays inside this processing.As of 2025-12-29
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, no condition attached60 days on request, at the latest one year after the contract endsAs of 2026-07-30Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract endingOpen sourceBoth periods sit in the data processing agreement under clause 11: on request the vendor deletes or returns customer data within sixty days, and without a request within one year of the services ceasing in any event. Anyone reading only the privacy notice finds none of this; it stays with the formula that data is kept as long as the stated purposes require. For the data protection officer’s file it is therefore the contract that counts. One year is the ceiling and long enough to be worth shortening explicitly in the contract.As of 2026-07-30
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, tied to a conditionISO 27001, 27017, 27018, 27701 and SOC 2 Type 2 named, evidence only via a formAs of 2026-08-17Access to the certificates solely through a form requiring name, company, job title, company size and countryOpen sourceThe legal document library names four ISO standards and a SOC 2 Type 2 attestation, for the vendor itself; the data centre operators carry their own. Anyone wanting to see the certificate fills in a form with name, company, job title, company size and country. Publicly, therefore, neither the version of each standard nor the scope nor the audit period is stated. For a first pass in procurement the naming is enough. The file needs the certificate itself.As of 2026-08-17
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.documented, tied to a conditionno statement on the regulation, contract older than the AI offeringAs of 2024-09-12The terms of service dated 12 September 2024 and the absence of any provision on artificial intelligence in the contract textOpen sourceThe vendor advertises access control for AI agents on every page and runs a dedicated solution area for it. Neither the terms of service nor the privacy notice says anything about it: both mention artificial intelligence only in the navigation rendered around the contract text. The terms of service carry the date 12 September 2024 and therefore predate the advertised products. For the vendor’s own duty under Article 50 of the regulation this is tolerable, because no AI in the product faces people and generates content. Anyone deploying the agent controls carries the classification of their own deployment themselves.As of 2024-09-12
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.documented, tied to a conditionexport into the customer’s own analysis systems, from the Business plan upwardsAs of 2026-08-17The Events API being tied to the Business plan, the scope of events and the named destinationsOpen sourceThe Events API delivers sign-in attempts, item usage and administrative events into the customer’s own analysis system, and the documentation names the destinations, among them Splunk, Microsoft Sentinel, Datadog, Elastic and CrowdStrike. The interface is tied to the Business plan; the documentation says so in its first paragraph. Retention is therefore decided by the customer in their own system, which removes the question of a period at the vendor. Anyone staying below that plan has the events only in the vendor’s own interface.As of 2026-08-17

What it really costs

Entry price

For individuals 2.99 US dollars a month billed annually and 3.99 billed monthly, for families 4.49 and 5.99 respectively. For the five business products the pricing page names no amount on 17 August 2026, but instead, throughout, the instruction to request a quote.As of 2026-08-17No price for any of the five business products, replaced throughout by the instruction to request a quoteOpen source

As of 2026-08-17

What gets expensive

The split into five separately sold products. Password management, discovery of the services in use, privileged access, device posture and the joint bracket above them are priced one by one. Anyone starting with the password manager who later needs evidence about privileged access buys a second product. It does not exist as an added feature. The second threshold is the Business plan, because log export hangs off it. No amounts can be named here, because the vendor publishes none for business customers.

What it displaces

  • Shared passwords in spreadsheets, chat histories and sticky notes
  • A collective account at a service provider whose password nobody rotates any more
  • The access that survives an employee’s departure because nobody holds the list

Interfaces

  • Sign-in through the company directory service and user provisioning via SCIM
  • Events API for export to Splunk, Microsoft Sentinel, Datadog, Elastic, CrowdStrike and others, from the Business plan upwards
  • Command line tool and software development kits for retrieving keys in deployment pipelines via op:// references
  • Full export per vault as CSV or in the vendor’s own 1PUX format

Matching methods

  • "Context: Moat or Wall?" TestThe test separates what creates an edge from what merely prevents falling behind, and credential management reliably lands on the second side when the question is played through honestly.
  • Regulatory Density TestThe density of evidence duties decides whether log export is an add-on or the condition of purchase, and that is exactly what the jump to the next plan hangs on here.
  • Leading AI Agents as Team MembersAs soon as agents take on tasks they need their own credentials with their own permissions, and the question of who gives an agent a password and takes it away again is decided here.

Alternatives

Sources

  1. 1.Legal entity, registered office and the complete library of legal documents including the naming of ISO and SOC 2 attestations (opens in a new tab)1password.com/legal-center · As of 2026-08-17
  2. 2.Separation of vault contents, service data and diagnostic data, the training clause based on legitimate interest, the choice of storage location and disclosure to authorities in encrypted form only (opens in a new tab)1password.com/legal/privacy · As of 2025-12-29
  3. 3.Processing by AgileBits, standard contractual clauses as Appendix I and the United Kingdom transfer addendum as Appendix II, deletion within sixty days on request and within one year of the contract ending (opens in a new tab)1password.com/files/legal/agilebits-dpa-012026.pdf · As of 2026-07-30
  4. 4.Sub-processors with purpose and country, Amazon Web Services as sole data centre operator, hosting of Privileged Access and Apono exclusively in the United States, shared items always in the European Union (opens in a new tab)1password.com/files/legal/1password-subprocessor-list.pdf · As of 2026-07-30
  5. 5.The terms of service dated 12 September 2024 and the absence of any provision on artificial intelligence in the contract text (opens in a new tab)1password.com/legal/terms-of-service · As of 2024-09-12
  6. 6.No price for any of the five business products, replaced throughout by the instruction to request a quote (opens in a new tab)1password.com/pricing · As of 2026-08-17
  7. 7.Prices for individuals and families in both billing modes (opens in a new tab)1password.com/pricing/personal · As of 2026-08-17
  8. 8.The Events API being tied to the Business plan, the scope of events and the named destinations (opens in a new tab)support.1password.com/events-reporting · As of 2026-08-17
  9. 9.The acquisition of Apono on 15 June 2026 and its focus on access provisioning for people, machines and AI agents (opens in a new tab)1password.com/press/2026/june/1password-acquires-apono · As of 2026-06-15
  10. 10.The equity round of 620 million US dollars led by ICONIQ Growth and the number of business customers by the company’s own count (opens in a new tab)prnewswire.com/… · As of 2022-01-19
  11. 11.The self-disclosed incident connected to the session leaked at Okta, including timing and scope (opens in a new tab)1password.com/blog/okta-incident · As of 2023-10-23
  12. 12.Founding year and headcount by the company’s own account (opens in a new tab)1password.com/about · As of 2026-08-17
  13. 13.Access to the certificates solely through a form requiring name, company, job title, company size and country (opens in a new tab)1password.com/resources/iso27001 · As of 2026-08-17

Last reviewed: 2026-08-17 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.