1Password vs heylogin

1Password

The security page names AES-GCM-256, PBKDF2-HMAC-SHA256, a 128-bit Secret Key and the SRP protocol, links a Security Design White Paper, and states the vendor has no way of decrypting secure data; ISO 27001/27017/27018/27701, SOC 2 type 2, a public HackerOne bug bounty and published unaltered audit reports (ISE 2020, Onica) are all on the record. Before going higher I'd want the field-by-field encryption scope including URLs and metadata, incident history, and client source code I can read myself.

heylogin

The security pages name the algorithms (XSalsa20 + Poly1305, Curve25519), describe a zero-knowledge model where the cloud functions solely as storage and cannot decrypt the vaults, point to a downloadable whitepaper with the cryptographic details, and state ISO 27001:2022 certification. I found no public information on published penetration-test reports, a bug bounty, or open-source clients I could read myself, so I stop short of the higher bar.

1Password

Vaults shared with team members, groups and single-vault guests, five item-level permissions on Business plus a separate Manage Vault permission, client settings that can switch off password viewing, export, printing and sharing outside 1Password, and recovery documented in real depth — new Secret Key and account password, 2FA reset, bulk recovery through the CLI, self-recovery codes and per-domain notification routing. I found no public information on time-limited or one-time sharing with external parties or an emergency-access waiting period.

heylogin

Teams, per-team permissions, hidden passwords, and sending or receiving passwords to external parties are documented, with predefined roles out of the box and custom role-based permissions on the Enterprise plan. Recovery is documented with its key model: vaults are additionally encrypted with admins' device security chips for cryptographic recovery, while admins cannot read personal vaults. I found no public information on emergency access with a waiting period, time-limited shares, or approval workflows.

1Password

Unlock with SSO runs over OpenID Connect with PKCE against a long list of identity providers and describes the device-key model for the unlock, while automated provisioning from named providers creates users and groups, syncs access, and suspends people on deprovisioning — with provisioning deliberately excluded from groups holding account-wide cryptographic permissions. I found no public information on FIDO2 or hardware-key MFA in the captured pages, which holds this below the top band.

heylogin

Directory sync with Microsoft Entra ID and Google Workspace is documented, importing users and mirroring Entra groups as teams whose membership stays in sync and drives shared access, and unlock devices include FIDO2 security keys, Touch ID, Windows Hello and smartwatches, with passkey support listed. I found no public information on SSO login itself, SCIM, automated suspension on deprovisioning, or conditional access and device policies.

1Password

Events reporting pushes sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with a documented Events API for building your own client, configurable token expiry and revocation, and data retention control — that is pipeable into my stack. Breach, device, usage and developer-secrets reports exist, but the pages say most of them sit in the Business plan only, and I found no public information on enforceable master-password or MFA policies or browser-extension policy controls.

heylogin

The audit log records website logins, password copies and reveals, and reveals of hidden fields, retains events for one year, and breach monitoring with admin notification sits on the Enterprise plan. Changes to logins and user-related events are only announced as upcoming, and I found no public information on exportable logs, SIEM integration, or enforceable policies.

1Password

Client coverage is complete for my purposes — macOS, Windows, Linux, iOS, Android, browsers and a CLI — the vault region is customer-selectable between EU, US and Canada, and export and import are documented down to the field, including migration from named competitors. But the export is stated to be stored in plaintext, CSV drops security questions, linked items and custom fields, passkeys export only from iOS and Android, and an SSO unlock blocks export until an admin turns it off; I found no public information on a self-hosted vault, high-availability deployment, or vault access continuing during a vendor outage.

heylogin

The production system runs on named German infrastructure (Hetzner Nuremberg with a Falkenstein standby) with independent backups at IONOS, an on-premises backup option duplicates the encrypted data onto your own servers, and export with selectable data plus import from a long list of competitors and browsers is documented. I found no public information on a self-hosted vault, Linux clients, offline access during an outage, or the completeness of the export format.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario governing law, customer support and email services run in the United States and Canada, and AWS appears in a third-party audit description of the infrastructure. An EU vault region is selectable, a DPA is published, and standard contractual clauses, adequacy decisions and binding corporate rules are cited for transfers — but no EU contracting entity and no subprocessor list with locations appear in the captured pages.

heylogin

Contracting entity, production hosting and backups are all evidenced in Germany: heylogin GmbH in Braunschweig, Hetzner Nuremberg with Falkenstein failover, and IONOS in Montabaur, with subprocessors named and located in the privacy policy and a stated reliance on exclusively European subprocessors, plus an EVB-IT cloud contract for public authorities. Ownership is unstated on the captured pages and I found no self-hosted option that removes the vendor from the data path, so the chain stops short of full sovereignty.

1Password

The pricing page itself states that pricing is tailored to the organization's needs and requires a sales quote, and I found no published price figure anywhere in the captures. The terms document the mechanics — per-user fees in US dollars, monthly or yearly billing, 30-day payment terms, taxes separately invoiced and fees non-refundable — but nothing on these pages lets me compute an annual invoice.

heylogin

Business is published at 3,99 € per user per month with annual billing, VAT treatment stated ("Alle Preise zzgl. MwSt."), and per-tier feature lists showing where the audit log and on-premises backup sit. The Enterprise tier that carries those features has no public price — you are directed to sales — and I found no public information on seat minimums or add-on prices.