1Password

Password manager · 1password.com · last read 2026-10-12

Identity

Legal entity	AgileBits Inc. dba 1Password
HQ	CA
Parent company	—
Ultimate ownership	—
EU contracting entity	—
LEI	9845002BEA37EFDSFC41
US CLOUD Act reach	Not determined from the sources read
Source	1password.com · 2026-10-08

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

Data location

Region	EU data location	Minimum plan	Source	Observed
EU	Terms not stated	—	support.1password.com	2026-10-08

EU: Customers can choose to create their account on 1Password.eu, billed in EUR with secure data hosted in the European Union. The document names no plan requirement or extra cost for this region.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · 1password.com

Term	What the agreement says
Transfer mechanism	SCC module 2
Transfer mechanism	UK Addendum
Notice of new subprocessors	30 days prior notice of subprocessor changes (SCC Clause 9(a) Option 2); notice method not stated
Notice of new subprocessors	At least 30 days in advance, informed specifically in writing of intended additions or replacements
Notice of new subprocessors	Customer notified of any intended addition or replacement of sub-processors (advance notice period not separately stated; 30-day objection window follows)
Notice of new subprocessors	General authorisation under SCC Clause 9(a); 30-day time period (UK Addendum Table 2)
Notice of new subprocessors	Processor regularly updates the subprocessor list published at a URL; no advance notice period stated
Notice of new subprocessors	Sub-processor list on vendor website updated with changes at least once a year
If you object to one	Written objection within 30 days (otherwise consent assumed); parties negotiate in good faith; if no solution within 30 days either party may terminate immediately on written notice
Breach notification	within 72 hours (or otherwise without undue delay) of becoming aware of a material Personal Data Breach
Breach notification	without undue delay after becoming aware of the breach
Transfer impact assessment	Parties document the transfer assessment (Clause 14(b)) and make it available to the competent supervisory authority on request; importer makes best efforts to provide exporter with relevant information
Audit	Annual SOC 2 attestation report; a copy of each report goes to the controller within 30 days of the processor receiving it, or promptly on request
Audit	Information on request and third-party audit reports; if those are insufficient and audit is required by law or the SCCs, the customer may audit at most once a year at its own cost
Audit	Information to demonstrate compliance; audits on request at reasonable intervals or if there are signs of non-compliance; by the exporter or an independent auditor, possibly including on-site inspections with reasonable notice; certifications may be taken into account
Audit	On written request, no more than once per rolling 12 months unless non-compliance reasonably suspected: audits/inspections by customer or third-party auditor; confidential summary penetration test reports; written responses to reasonable information requests

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Assurance

Scheme	Status	Scope	Source	Observed
SOC 2 type 2 · SOC2T2	Claimed	—	1password.com	2026-10-08

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

Register	Offering, as the register names it	Status	Level	Valid until	Observed
Global LEI Index (GLEIF)	AGILEBITS INC. · AGILEBITS INC.	ISSUED	CA-ON	2026-12-20	2026-10-09

ACN qualified cloud (Italy): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password
DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password
Data Privacy Framework List (US): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password
EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password
FedRAMP Marketplace (US): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password
SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under 1Password; AgileBits Inc. dba 1Password

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Product	Support period	State	SBOM	Source	Observed
1Password 8	—	Not declared	unknown	support.1password.com	2026-10-11
1Password browser extension	—	Not declared	unknown	support.1password.com	2026-10-11

Vulnerability reporting: [email protected], [email protected] (security.txt, no Expires field; read 2026-10-11)

Documents

What we read, how it was disclosed, and when.
Document	Disclosure	Transcription	HTTP	Observed
certifications	Public	full	200	2026-10-08
dpa	Public	full	200	2026-10-09
lifecycle-2	Public	full	200	2026-10-11
residency	Public	full	200	2026-10-08

History

Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.