1Password vs heylogin

1Password

A Security Design White Paper, named algorithms (AES-GCM-256, PBKDF2-HMAC-SHA256, SRP), a 128-bit Secret Key combined with the account password, ISO 27001 and SOC 2 Type 2 certifications, an ISE penetration test with 2020 dates, a public HackerOne bug bounty and a stated policy of publishing unaltered annual pentest reports — that is a serious, largely provable posture. I stop short of the top band because I found no public information on which fields are and are not encrypted (including URLs and metadata), on past security incidents and their impact, or on reviewable client source code, and the only named, dated assessment is from 2020.

heylogin

A security whitepaper is published and names the cipher suite (XSalsa20 with Poly1305, Curve25519), a zero-knowledge model with device security chips, and ISO 27001:2022 certification for heylogin GmbH. What I cannot show the board: no independent penetration-test firm, report or date, no bug bounty or vulnerability disclosure programme, and no incident history anywhere in the captures; the privacy policy lists usernames, passwords and URLs as end-to-end encrypted but is silent on which fields and metadata are not.

1Password

Vault sharing with groups and guests, five granular item permissions on Business plus client settings that can conceal passwords while allowing other actions, and account recovery documented down to key rotation (new Secret Key, new account password, two-factor reset, bulk recovery via CLI), with deprovisioning-based suspension for leavers. I found no public information on time-limited or one-time sharing with external parties, emergency access with a waiting period, or delegated administration per team or location; access requests appear only as a feature name on the homepage.

heylogin

Teams, permission-bearing roles (user, admin, custom roles with per-role permissions), sending and receiving passwords to and from external parties, hidden-password sharing and individual login assignment are all documented, and the recovery key model is stated publicly: organisation vaults are additionally encrypted with admins' device security chips for cryptographic recovery, while admins cannot read personal vaults. We found no public information on time-limited or one-time shares, emergency access with a waiting period, or approval workflows; offboarding rests only on the admin's ability to add and remove employees and on group-membership removals syncing through.

1Password

Unlock with SSO over OIDC with PKCE, a described encrypted-credentials-and-device-key model, named providers (Entra ID, Okta, Google, Duo, Ping among others), provisioning that suspends users on deprovisioning with immediate confirmation, and explicit guardrails keeping automated provisioning away from account-wide cryptographic access. Weaker spots: I found no public information on MFA with FIDO2 or hardware keys; the pages state only one identity provider can be configured, SSO unlock requires an internet connection (biometrics allowed for offline), and Owners cannot use SSO at all; passkey support surfaces only as an export restriction on iOS and Android.

heylogin

Directory integration with Microsoft Entra ID and Google Workspace is documented in detail — user import under admin consent, and Entra groups synchronised as heylogin teams with membership changes including removals applied automatically — and unlock supports FIDO2 security keys, Touch ID, Windows Hello, smartwatches and passkeys. We found no public information on single sign-on to the vault itself, on how an identity-provider login would release the vault key, on SCIM, or on conditional access and device policies.

1Password

An Events API covering sign-in attempts, item usage and audit events, native integrations to sixteen named SIEM providers including Splunk, Microsoft Sentinel and Elastic, bearer tokens with configurable expiry and event scopes, retention control, Watchtower and domain breach reports, and Business client settings that can block export, printing and sharing outside the product. I found no public information on enforceable master-password or MFA policies, on browser-extension behaviour policies, or on compliance reports a customer could use in an ISO 27001 or NIS2 audit; most reports and the audit log are Business-plan features.

heylogin

The audit log records granular item access — website logins performed, passwords copied, passwords and hidden fields revealed — states a one-year retention, and confines logging to in-organisation events, with breach monitoring (Pwnitoring) notifying administrators. But login-change and user-related events are listed only as upcoming, the log sits in the Enterprise plan only, and we found no public information on log export, SIEM integration, or enforceable policies for sharing and export.

1Password

Clients for macOS, Windows, iOS, Android, Linux, browsers and CLI, a customer-selectable EU, US or Canada region, a status page, and documented export plus import from named competitors give real portability. The export path is where I hesitate: the pages state exported files are not encrypted and are stored in plaintext, CSV covers only Login and Password items with named excluded fields, export is blocked while SSO unlock is on, and passkeys export only on iOS and Android; I found no public information on a self-hosted vault option, status-page incident history, an encrypted full-fidelity export, or access during a vendor outage.

heylogin

Production runs on named EU infrastructure (Hetzner in Nuremberg with a Falkenstein standby and independent backups at IONOS), clients cover iOS, Android, four major browsers and a web app, and import is documented from ten named password managers plus CSV and Excel, with a step-by-step export in the settings. We found no public information on Linux clients, on offline access during a vendor outage, or on an encrypted full-fidelity export; the on-premises option duplicates the encrypted data onto customer servers rather than being a self-hosted deployment.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario and Canadian law, with support and email hosted primarily in the United States and Canada — but EU hosting is customer-selectable, item-sharing data is stored in the EU while an item is shared, a Data Processing Agreement is published, and transfer safeguards include SCCs, adequacy decisions and binding corporate rules. I found no public information on an EU contracting entity or representative or on a published subprocessor list with locations; AWS appears only inside a third-party audit description rather than a declared list.

heylogin

The chain is largely provable: heylogin GmbH in Braunschweig is the contracting entity and controller, vaults are hosted on Hetzner servers in Nuremberg and Falkenstein with backups at IONOS SE in Germany, and the privacy policy publishes subprocessor names and locations (IONOS in Montabaur; the Have I Been Pwned operator in Australia, stated as involving no data transfer). The captured pages give different pictures of third-country involvement — the security page says exclusively European subprocessors while the privacy policy cites the EU-US adequacy decision for transfers to the USA — and we found no public information on ownership or on a self-hosted option removing the vendor from the data path.

1Password

The pricing page itself states that pricing is tailored to the organization and a sales quote is required — no per-user figure for any tier is public, so a buyer cannot compute an annual cost from what I read. The terms do document the commercial model in detail: per-user fees quoted in US dollars, monthly or yearly billing, net-thirty payment terms, quarterly reconciliation for added users, taxes borne by the customer and separately invoiced, non-refundable fees, automatic renewal and a suspension right after thirty days overdue.

heylogin

The Business tier is published at 3,99 € per user per month with annual billing and all prices excluding VAT, features are listed per tier, and a free Private plan is offered. But the Enterprise tier — which carries the audit log and custom roles — is sales-contact only, the optional onboarding and on-premises backup add-ons carry no public price, and no seat minimum is stated.