1Password vs heylogin

1Password

The security page names AES-GCM-256 authenticated encryption, PBKDF2-HMAC-SHA256 key derivation and the 128-bit Secret Key combined with the account password, and the terms state the vendor has no way of decrypting Secure Data. Independent assurance is strong — ISO 27001/27017/27018/27701, SOC 2 Type 2, a dated 2020 ISE penetration test and code review, annual pentest reports published unaltered through the Trust Center, and a public HackerOne bug bounty. We found no public information on a field-by-field statement of what is and is not encrypted, on documented incident history, or on open-source clients or cryptography.

heylogin

The published security architecture names the algorithms (XSalsa20, Poly1305, Curve25519), describes the zero-knowledge model in which the cloud stores data but cannot decrypt vaults, and states the company's ISO 27001:2022 certification, with a security whitepaper offered containing the cryptographic details. We found no public information on independent penetration tests, a bug bounty, disclosed incident history, or a statement of which fields and metadata are not encrypted.

1Password

Shared vaults carry five granular item permissions in the Business plan, with a Manage Vault permission deliberately separated from viewing and editing, and account recovery is documented down to its key model: a new Secret Key and account password, 2FA reset, CLI bulk recovery, and recovery delegated to custom groups. Client settings can be enforced for viewing and copying passwords, export, import, move, print and sharing outside 1Password. We found no public information on time-limited or one-time sharing with external parties, or on emergency access with a waiting period.

heylogin

Teams with permissions, admin and freely adaptable custom roles, external sending and receiving of passwords, and hidden-password sharing are documented, and the recovery path is documented with its key model: organization vaults are additionally encrypted with admins' device security chips for cryptographic recovery while admins cannot read personal vaults. We found no public information on emergency access, time-limited or one-time sharing, approval workflows, or what happens to a leaver's shared items when an admin removes the employee.

1Password

Unlock with SSO is documented with named identity providers over OpenID Connect using Authorization Code Flow with PKCE, and its key handling is described — encrypted credentials and a device key replace the account password, with the Owners group excluded to prevent lockout. Automated provisioning with Entra ID, Okta, Google Workspace, JumpCloud and OneLogin creates users and groups, grants and revokes group access, and suspends members on deprovisioning, while account-wide cryptographic permissions are deliberately kept out of automated hands. Device trust policies and passkeys are documented; we found no public information on MFA hardware-key options.

heylogin

Entra ID and Google Workspace integrations import users and mirror Entra groups as heylogin teams with membership kept in sync, so directory groups drive shared access, and unlock is documented with FIDO2 security keys, Touch ID, Windows Hello and smartwatches on device security chips the vendor cannot derive keys from. We found no public information on SCIM, conditional access or device policies, or automated suspension of accounts on deprovisioning.

1Password

Events Reporting delivers sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with bearer tokens whose expiry and event scopes are configurable, data retention control, custom alerts, and a path to build a custom client through the Events API. Reports cover Watchtower, domain breaches with notification of affected users, devices, developer secrets and twelve months of usage, while Business client settings enforce export, import, copy, share and print behaviour. We found no public information on an enforceable master-password or MFA policy, or on compliance reporting aligned to ISO 27001 or NIS2 control sets.

heylogin

The audit log records website logins performed with heylogin, password copies, and password or hidden-field reveals — the view and copy events an ISO 27001 or NIS2 audit needs — with retention stated at one year and automatic breach detection notifying the administrator, while changes to logins and user-related events are announced as upcoming only. The log sits in the Enterprise plan, and we found no public information on export to a SIEM, an API for log retrieval, or enforceable policies for sharing and export.

1Password

Clients cover macOS, Windows, iOS, Android, Linux, the CLI and the major browsers, Secure Data hosting is customer-selectable across the EU, US and Canada, and a status page is named in the terms. Export is documented in detail but plaintext — the 1PUX and CSV paths are stated to be unencrypted, CSV drops everything but Login and Password items with the excluded fields named, and export is blocked for accounts unlocked with SSO until an administrator turns it off. We found no public information on a self-hosted vault deployment or an encrypted full-fidelity export covering all item types.

heylogin

Production runs on named German infrastructure — Hetzner in Nuremberg with a standby in Falkenstein and independent backups at IONOS — browser extensions cover Chrome, Firefox, Safari and Edge alongside iOS and Android apps, and documented importers cover named competitors plus CSV and Excel with a settings-based export. We found no public information on a self-hosted deployment, Linux clients, offline vault access during an outage, or the format and completeness of the export; the optional on-premises backup duplicates the encrypted data only.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario governing law, while Secure Data hosting is customer-selectable in the EU, US or Canada, a DPA is published, item-sharing data is stored in the EU, and direct billing runs through a 1Password.eu website. Customer support and email are hosted primarily in the United States and Canada, the payment processor is unnamed, and AWS appears only inside a third-party audit description rather than a declared subprocessor list. We found no public information on an EU contracting entity or representative, on ownership, or on a subprocessor list with locations.

heylogin

The contracting entity is heylogin GmbH of Braunschweig with its German register court stated in the legal notice, vault hosting runs on named German infrastructure, and subprocessors are published with locations — IONOS in Germany for encrypted backups and an Australian breach-check service stated to involve no data transfer. A strict data processing agreement with European subprocessors, an EVB-IT cloud contract for public authorities, and ISO 27001:2022 certification are offered; we found no public information on the ownership chain or on a self-hosted option that removes the vendor from the data path.

1Password

The captured pricing page routes every purchase through a sales quote — Unified Access pricing is tailored to the organization and the buyer is told to contact the sales team to receive a quote — and we found no public per-user price or priced tier in any captured page. The terms do document the commercial mechanics: per-user fees quoted and payable in US dollars, monthly or yearly billing cycles, thirty-day payment terms, quarterly reconciliation for additional users, taxes borne by the customer and separately invoiced, non-cancelable and non-refundable fees with discretionary refunds, and AWS Marketplace as a purchasing channel.

heylogin

The free private plan and the business tier are priced publicly at 3,99 € per user per month with annual billing, prices plus VAT, and per-tier feature lists showing that custom roles, the audit log and breach monitoring sit in Enterprise. The Enterprise tier itself is not priced publicly and refers to the sales team, nonprofit discounts are granted on individual review, and we found no public information on seat minimums, minimum term or add-on prices.