Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: claimed_with_trust_page
1Password DPA, FedRAMP & SOC 2 Type II Review
Before you share customer data with 1Password, your compliance team needs documented proof they can be trusted. ThirdProof investigated 1Password across 27 intelligence sources — here's what we found.
⚠ FedRAMP Status: Not found in the FedRAMP Marketplace. Vendors handling government data or CUI must be FedRAMP authorized.
Risk Tier
Tier 3 — Moderate RiskSOC 2
⚠ Vendor AttestedFedRAMP
— Not AuthorizedLast Assessed
Apr 6, 2026🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 22.4 years🟢Infrastructure: 11 open ports, 0 CVEs
- FedRAMP Status
- 1Password is not listed on the FedRAMP Marketplace as of March 2026.
- SOC 2 Status
- 1Password has a SOC 2 claim detected on their trust page. Claim is vendor-attested — no public registry exists for independent verification.
- Sanctions Screening
- 1Password returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned 1Password a Moderate Risk tier with 100% confidence across 27 intelligence sources.
25 sources queried. 100% confidence. Every 1Password investigation produces both a risk report and an auto-filled security questionnaire — no vendor follow-up required.
Get 1Password's Full Report Free →5 free investigations|Risk report + auto-filled questionnaire|Avg. 7 minutes
Certification & Compliance Status
Security Questionnaire — Auto-Filled
44 of 133 questions answered for 1Password
Auto-filled from public evidence • 33% complete
Q38
Do you have ISO 27001 certification?
1Password has achieved ISO 27001, 27017, 27018, and 27701 certifications.
Q41
Are you FedRAMP authorized? At what level?
Not found in FedRAMP marketplace
Q40
Are you HIPAA compliant? Do you sign BAAs?
1Password does not sign Business Associate Agreements because AgileBits cannot access or decrypt customer data, so it is not defined as a Business Associate under HIPAA.
Q42
Are you GDPR compliant? Do you have a DPA available?
1Password offers a Data Protection Addendum (DPA) that outlines terms for processing personal data in compliance with GDPR and other data protection regulations.
+ 4 more compliance questions answered in the full report
Every investigation produces a full PDF report plus the complete 133-question questionnaire, mapped to SOC 2, HIPAA, PCI DSS, SIG, and more.
Get 1Password's Full Report Free →✗Not Listed on FedRAMP Marketplace
Verified against FedRAMP Marketplace API as of March 2026
Organizations with federal compliance requirements should verify this directly at marketplace.fedramp.gov.
1Password is not listed on the FedRAMP Marketplace. 1Password maintains SOC 2 Type II certification.
◇27 data sources queried per assessment
◷Reports generated in an average of 7 minutes
◈SHA-256 verified for audit integrity
✓Deterministic risk scoring — no AI guesswork
3Tier
Moderate Risk
1Password
Vendor Risk Assessment
Confidence Score100%
Based on data availability and source coverage
25
Sources Queried
25
Sources With Data
April 6, 2026
Last Assessed
Executive Summary
AI-generated analysis for 1Password
1Password (1password.com) is a well-established password management and secrets platform assessed at Risk Tier 3 (Moderate Risk) with a confidence score of 100%. Given its critical data access level — storing and managing credentials, secrets, and access controls for enterprise environments — this vendor warrants elevated scrutiny and active oversight. Positive signals are substantial across several domains:
Key Findings
- **Domain maturity**: 1password.com has been registered since 2003 and archived since 2001, reflecting over two decades of operational continuity.
- **Clean threat posture**: The domain is not listed on SURBL, Spamhaus DBL, or any active malware blacklist, and carries a zero IP abuse score via Cloudflare CDN infrastructure.
- **TLS configuration**: A strong TLS 1.3 configuration with AES-256-GCM is in place, with a current certificate issued by Let's Encrypt expiring May 31, 2026 (54 days from assessment date).
- **SOC 2 Type II claim**: 1Password asserts SOC 2 Type II certification on its published security page. While this is vendor-attested rather than independently registry-verified (no public SOC 2 registry exists), it represents a meaningful compliance signal when confirmed by requesting the full report.
- **No sanctions, no SEC enforcement, no FDIC concerns**: Screening across OFAC, EU, and UN sanctions lists returned zero matches, and no regulatory enforcement actions were identified. Several areas require attention before this vendor can be treated as fully cleared for critical-tier use:
- **Security incidents (2023–2025)**: Adverse media identified a published breach summary covering 2023–2025 incidents, warranting direct inquiry into remediation status and current architectural controls.
- **CLI vulnerability**: A 1Password CLI vulnerability disclosure was flagged with meaningful community engagement (119 points), representing risk specifically for DevOps and automated pipeline deployments.
- **No public AI data usage policy**: Given 1Password's expanding feature set, the absence of a discoverable AI data handling policy is a gap for organizations with AI governance obligations.
- **Subprocessor list unparseable**: A subprocessor page exists at trust.1password.com/subprocessors but could not be automatically parsed, leaving the third-party supply chain unconfirmed.
- **HTTP security headers (marketing site)**: The marketing domain scored C- (45/100) on HTTP security scanner; the application domain (app.1password.com) should be assessed independently. Overall, 1Password is a mature, commercially credible vendor with a recognized security posture, but the documented incident history and unresolved gaps in AI policy transparency and subprocessor visibility warrant conditional approval with specific follow-up requirements prior to production onboarding at critical data access levels.
Independence Statement
All evidence in this assessment was independently sourced from external data providers, public registries, and open-source intelligence without vendor participation or notification.
Investigation Findings
4 findings identified for 1Password
1 critical3 medium
critical
Adverse Media: security incident
Article from onerep.com: "1Password Breach: 2023–2025 Incidents And How To Stay Safe"
medium
HTTP Security Grade: C-
1password.com received a mediocre grade (C-). Some security headers are configured but improvements are needed. Note: This scan was performed on the marketing site (1password.com). The application endpoint (app.1password.com) may have different security headers. Verify the application domain separately.
medium
Multiple Certificate Issuers (25)
1password.com has certificates from 25 different Certificate Authorities. This may indicate inconsistent certificate management practices.
medium
AI Data Usage Policy Not Discoverable at Standard Paths
An AI-specific data usage policy was not discoverable for 1password.com through automated scanning of common policy paths and web search. The vendor may publish relevant data handling commitments in enterprise agreement documents (DPAs, product terms, licensing portals) that are not indexed at standard public URLs. Request the vendor's Data Protection Addendum or AI-specific terms directly.
✓
Security Strengths
23 positive signals verified
✓
Not Found as FDIC-Insured Institution
FDIC Institution Check →✓
No LEI Registry Match (Expected for Most Companies)
Business Registration →✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No Adverse Media Signals
Adverse Media Scan (Fallback) →✓
Firmographic Data Available
Company Intelligence →✓
Domain Infrastructure Healthy
Domain Analysis →✓
Valid SSL Certificate
Domain Analysis →✓
11 Open Ports Detected
Infrastructure Exposure →✓
Established Domain (22+ years)
Domain Registration →✓
Clean domain reputation
Threat Intelligence →✓
Tech Community Discussion: security
Tech Community Sentiment →✓
Large Certificate Footprint (64 subdomains)
Certificate Transparency →✓
Established Web Presence (24+ years)
Web Archive History →✓
Domain in 18 Threat Intelligence Pulses
Threat Intelligence (OTX) →✓
Clean IP Reputation
IP Reputation →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Certification Claimed: SOC 2
Trust & Compliance Page Scan →✓
Subprocessor Page Found, No Entries Parsed
Supply Chain & Subprocessor Discovery →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
News Coverage Found (No Risk Signals)
Historical Media Search →✓
HITRUST Directory Match — Manual Verification Required
Certification Registry Verification →✓
SOC 2 Compliance Claimed on Trust Page
Certification Registry Verification →Recommended Actions
Steps to address findings for 1Password
- 1
**[PRIORITY 1 — Within 30 days]** Request 1Password's SOC 2 Type II report and a current bridge letter. Start at their trust portal ([trust.1password.com](https://trust.1password.com)) or contact their enterprise security team. Retain the report with a reviewer signature as SOC 2 CC9.2 audit evidence.
- 2
**[PRIORITY 2 — Within 30 days]** Inquire directly about the 2023–2025 security incidents described in the [adverse media coverage](https://onerep.com/blog/1password-breach-what-happened-and-how-to-stay-safe). Ask 1Password's security team for an incident summary, root cause analysis, and documentation of remediation steps taken. This is particularly important given the critical data access level.
- 3
**[PRIORITY 3 — Within 45 days]** Obtain 1Password's Data Protection Addendum (DPA) and any AI-specific product terms. Specifically confirm: (a) no customer credential data is used for AI model training, (b) named third-party AI processors if any, and (c) applicable data retention policies for AI-processed inputs.
- 4
**[PRIORITY 4 — Within 45 days]** Manually review the subprocessor page at [trust.1password.com/subprocessors](https://trust.1password.com/subprocessors) in a browser. Document each subprocessor's name, location, and function. Cross-check any non-EU/US subprocessors against your data transfer framework (SCCs, adequacy decisions).
- 5
**[PRIORITY 5 — If using the CLI or DevOps integrations]** Review the [1Password CLI vulnerability disclosure](https://news.ycombinator.com/item?id=45478553) and confirm whether your deployment is affected. Check 1Password's changelog and security advisories for the patch status, and ensure automated workflows using the CLI are pinned to a patched version.
- 6
**[PRIORITY 6 — Within 30 days]** Confirm with 1Password that automated TLS certificate renewal is active. If your account team cannot confirm this, flag it for re-check after May 31, 2026. Consider setting a calendar reminder at the 30-day mark (May 1, 2026).
- 7
**[PRIORITY 7 — Before next SOC 2 audit cycle]** If 1Password is within your SOC 2 audit boundary, document the complementary user entity controls (CUECs) your organization must implement — including access provisioning/deprovisioning, MFA enforcement on the 1Password account, and audit log review procedures. Retain this assessment report with a reviewer signature as CC9.2 evidence.
Intelligence Sources Queried
25 sources in this assessment
25of 25 sources returned data
IP Reputation
AI Data Usage Policy
Threat Intelligence (OTX)
Adverse Media Scan
Certification Registry Verification
Certificate Transparency
Domain Analysis
FDIC Institution Check
Business Registration
Historical Media Search
Tech Community Sentiment
Company Intelligence
Adverse Media Scan (Fallback)
HTTP Security Scan
Sanctions & Watchlist Screening
Malware & Phishing Check
SEC Filing Search
Infrastructure Exposure
SSL/TLS Analysis
Supply Chain & Subprocessor Discovery
Trust & Compliance Page Scan
Website Security Scan
Threat Intelligence
Web Archive History
Domain Registration
Data Coverage Notes
Some data sources may have had limited availability during this assessment. This does not reflect negatively on the vendor.
- The subprocessor page at trust.1password.com/subprocessors was found but returned zero parseable entries. The page likely uses a JavaScript-rendered or non-standard format that automated parsing cannot extract. Manual browser-based review is required to identify individual subprocessors.
- The HTTP security header scan was performed on the marketing domain (1password.com). The application endpoint (app.1password.com) may have materially different security header configurations and should be assessed separately to reflect the actual attack surface for authenticated users.
- External cyber risk scoring was not available for this assessment. A vendor cyber score relative to the SaaS industry average could not be computed.
- The adverse media finding references an article summarizing 1Password incidents across a 2023–2025 timeframe. Individual incident dates and remediation details could not be extracted from the article metadata alone; direct vendor inquiry is required to assess current exposure.
- ISO 27001 registry status returned 'not_found' via IAF CertSearch. This may reflect a registry coverage gap or the vendor's use of a non-IAF accreditation body. Manual verification with the vendor is recommended before concluding ISO 27001 is absent.
- No AI data usage policy was discoverable at standard public URLs. Relevant commitments may exist in non-indexed enterprise agreement documents (DPAs, licensing portals) not accessible to automated scanning.
183+
Vendors assessed
98%
Average confidence
<2 min
Time to report
Security & Compliance Profile
33% complete · 44/133 questions answered from public sourcesAre you 1Password? Claim this profile to complete your security record. Buyers are reviewing this profile now.
Claim this profile →What a ThirdProof assessment covers↓
Sanctions Screening
Is 1Password on any OFAC, EU, or UN sanctions list? Are any officers or affiliates flagged?
Cyber Risk Assessment
What is 1Password's security posture? Threat intelligence scanning, known vulnerabilities, and security header analysis.
Business Registration
Is 1Password a legitimately registered business entity? Corporate status, jurisdiction, and officer verification.
Adverse Media Analysis
Has 1Password appeared in negative news coverage? Data breaches, lawsuits, regulatory actions, and complaints.
Domain & Infrastructure
Is 1Password's website secure? TLS configuration, DNS hygiene, security headers, and domain age analysis.
Company Intelligence
What are 1Password's firmographics? Employee count, industry classification, technology stack, and corporate structure.
Trust & Compliance Verification
Does 1Password claim SOC 2, ISO 27001, HITRUST, or FedRAMP? ThirdProof scans trust pages for certification claims and cross-references the FedRAMP public registry for independent verification.
Supply Chain & Subprocessor Discovery
Who does 1Password depend on? ThirdProof discovers subprocessors from vendor-published pages and runs sanctions screening and safe browsing checks against each one.
Regulatory & Financial Filings
Has 1Password appeared in SEC enforcement filings? Is it associated with any FDIC bank failures? ThirdProof searches regulatory databases with entity verification to confirm attribution.
Full methodology, rule engine, and AI disclosure: /methodology
1Password Security and Compliance Status
1Password is a password management platform claiming SOC 2 and CCPA compliance. 1Password is not listed on the FedRAMP Marketplace and has not pursued FedRAMP authorization. For organizations managing credential vaults across teams, 1Password's zero-knowledge architecture means the vendor cannot access stored credentials — but organizations should verify this claim through 1Password's SOC 2 report and assess the security implications of 10 open ports identified during ThirdProof's infrastructure scan.
1Password Security Posture
ThirdProof investigated 1Password across 27 intelligence sources and assigned a Moderate Risk (Tier 3) rating with 82% confidence. Sanctions screening returned clear with no matches. Domain reputation is clean across 93 security engines with a 22-year domain history. The SSL/TLS grade is B and the HTTP security grade is C- (45/100) — these infrastructure findings should be weighed against 1Password's application-layer security model and zero-knowledge architecture.
Compliance Resources
→ SOC 2 Vendor Assessment: What Your Auditor Actually Reviews→ SOC 2 CC9.2 Vendor Management with ThirdProof→ HIPAA Vendor Risk Assessment with ThirdProof→ ABA Model Rule 1.6 Vendor Due Diligence for Law Firms→ Sanctions Screening for Vendor Due Diligence→ Vendor Due Diligence Checklist→ All 27 Intelligence Sources
Seeing this in an audit? ThirdProof lets you investigate 1Password and every other vendor in your stack — average report time: 7 minutes. Get 1Password's Full Report Free →
Frequently asked about 1Password
Is 1Password FedRAMP authorized?+
1Password is not currently listed on the FedRAMP Marketplace as of April 2026.
Does 1Password have SOC 2 Type II?+
Yes — 1Password holds SOC 2 (Type II not confirmed). Rated Moderate Risk — subprocessor list unavailable. See all 6 findings →
Is 1Password on the OFAC sanctions list?+
1Password returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of April 2026.
What is 1Password's vendor risk tier?+
ThirdProof assigned 1Password a risk tier of Moderate Risk with 100% confidence based on assessment across 27 intelligence sources as of April 2026.
Does 1Password have SOC 2 Type 2?+
ThirdProof's assessment found that 1Password claims SOC 2 certification on its trust page. Organizations should request 1Password's current SOC 2 Type II report directly to verify scope, trust service criteria covered, and the audit period. 1Password also claims CCPA compliance. These certifications are vendor-attested — ThirdProof flags certification claims that could not be independently verified.
Does 1Password offer a DPA?+
Organizations subject to GDPR, CCPA, or similar data protection regulations should request 1Password's Data Processing Agreement (DPA) before onboarding. ThirdProof's assessment verifies 1Password's compliance claims and data handling posture as part of the standard vendor risk assessment. Run a free assessment to see the full compliance profile.
Can I get an auto-filled security questionnaire for 1Password?+
Yes. Every ThirdProof investigation of 1Password produces two deliverables: an audit-ready risk report and a 133-question security questionnaire pre-filled with evidence from 27 independent sources. The questionnaire is mapped to SIG, SOC 2, HIPAA, PCI DSS and 9 other frameworks — answered without sending 1Password a single email or waiting for a vendor response.
Is 1Password safe to use as a vendor?+
1Password is a password management vendor that handles organizational data. Safety depends on their current security posture, certification status, and how they handle your specific data. ThirdProof automates this evaluation across 27 intelligence sources — sanctions databases (OFAC, EU, UN), business registration verification, adverse media scanning, and cyber risk assessment — producing a deterministic risk tier with confidence score plus an auto-filled security questionnaire. Run a free investigation to see 1Password's full risk profile.
Does 1Password have SOC 2 certification?+
Yes — 1Password holds SOC 2. Rated Moderate Risk — subprocessor list unavailable. See all 6 findings →
Has 1Password had any data breaches?+
Data breach history is an important signal for any vendor, particularly password management platforms like 1Password that handle organizational data. ThirdProof's adverse media analysis searches multiple news APIs and public records for data breaches, security incidents, lawsuits, regulatory enforcement actions, and financial distress signals. Each finding is linked to its original source with severity classification.
Is 1Password on any sanctions lists?+
Sanctions screening is standard due diligence for password management vendors. ThirdProof screens 1Password against OFAC SDN, consolidated international sanctions lists, and PEP databases. The screening uses entity name verification to reduce false positives. If 1Password or any associated officers appear on a sanctions list, this triggers automatic escalation to the highest risk tier.
How do I assess 1Password for vendor risk?+
Assessing 1Password as a password management vendor involves verifying SOC 2 Type II and applicable industry standards compliance, reviewing their subprocessor chain, and checking sanctions exposure. ThirdProof automates this across 27 intelligence sources in an average of 7 minutes — no questionnaires or vendor participation required. Your first 5 investigations are free.
How long does a ThirdProof assessment take?+
A ThirdProof assessment completes in an average of 7 minutes. 27 intelligence sources are queried in parallel — sanctions databases, business registries, threat intelligence feeds, certificate transparency logs, and more. The result is a deterministic risk tier with confidence score and audit-ready PDF report.
Is ThirdProof free?+
ThirdProof offers 5 free vendor assessments with no credit card required. Each assessment includes the full report — risk tier, confidence score, individual findings, executive summary, and PDF export. Paid plans start at $399/month for teams that need ongoing vendor monitoring.
Can I use a ThirdProof report as SOC 2 audit evidence?+
Yes. ThirdProof reports are designed to satisfy SOC 2 CC9.2 (vendor risk management) requirements. Each report includes SHA-256 integrity verification, methodology disclosure, source attribution for every finding, and AI content labeling. Auditors can independently verify the report's authenticity and trace each finding to its original source.
How is ThirdProof different from a security questionnaire?+
Security questionnaires require vendor participation, take weeks, and produce self-reported answers. ThirdProof queries 27 independent intelligence sources — no vendor involvement needed. Risk tiers are assigned by a deterministic rules engine (not AI opinion), and every finding links to its original source. You get an audit-ready report in an average of 7 minutes instead of waiting weeks for a questionnaire response.
Also investigate these vendors
1Password is in your vendor stack. Can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI-DSS, and CMMC all require documented vendor due diligence — not just knowing the answer, but having audit-ready evidence you verified it. Most compliance teams can't produce that documentation on demand.
ThirdProof investigates 1Password across 27 intelligence sources in an average of 7 minutes — sanctions screening, cyber posture, SOC 2 verification, FedRAMP status, and more. Every investigation produces two deliverables: an audit-ready risk report and an auto-filled security questionnaire your prospects and auditors expect to see.
✓ 5 free investigations✓ Risk report + auto-filled questionnaire✓ No credit card required✓ Average report time: 7 minutes
Replaces $600–$900 in manual compliance consulting time per vendor assessed.