In short
1Password secures each business vault with the user's account password plus a 128-bit Secret Key that 1Password has no record of. Its line-up runs from Teams Starter Pack (10 members) to 1Password Business and the quote-only Enterprise Password Manager. Forever Systems can quote and supply 1Password and help set it up.
Get a quote for 1Password Business
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
1Password's two-key security model
1Password protects each account with two secrets. The account password is chosen by the user and, in 1Password's words, is one "which we never store and only you know" (1Password security (opens in a new tab)). The Secret Key is created on the user's device:
| Part | What 1Password says |
|---|---|
| Secret Key | "34 letters and numbers, separated by dashes", stored on devices you have signed in on and in your Emergency Kit, with "128 bits of entropy" (Secret Key (opens in a new tab)) |
| Who holds it | "We have no record of your Secret Key and can't recover it." |
| What each protects | "Your 1Password account password protects your data on your devices ... Your Secret Key protects your data off your devices." |
| Sign-in | Secure Remote Password (SRP) "authenticates your account without sending your credentials over the Internet" |
| Encryption | "Your credentials are encrypted on your device before they reach our servers. We never hold your decryption keys." (Enterprise Password Manager (opens in a new tab)) |
The practical effect is that a copy of 1Password's servers would not let an attacker guess their way into a vault with a weak password, because the Secret Key never leaves users' devices. Keep each user's Emergency Kit safe: 1Password Business admins can recover accounts for people who are locked out, which is part of the plan.
Published assurance. 1Password says it "is SOC 2 type 2 certified" and "has achieved ISO 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications"; annual penetration test reports are available through the 1Password Trust Center, and its bug bounty runs on HackerOne (security assessments (opens in a new tab)). The full design is in 1Password's security design document (opens in a new tab). For the wider question of trusting any password manager, see are password managers safe?
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Teams Starter Pack vs 1Password Business
1Password's business pricing FAQ explains the difference: "Teams Starter Pack helps secure a small team for a flat monthly price and includes 10 members ... 1Password Business is priced per user and adds identity-provider integrations, expanded role-based vault sharing and permissions, Watchtower alerts, and broader business administration and reporting capabilities."
| Feature | Teams Starter Pack | 1Password Business |
|---|---|---|
| Who it is for | "Password manager for small teams" | "Password manager for established businesses" |
| Size | 10 users minimum, up to 20 users (10 additional seats can be added) | 1 user minimum, priced per user |
| Sharing and permissions | Share passwords and sensitive data; role-based permissions | Expanded role-based vault sharing and permissions |
| Security alerts | "Actionable security alerts" | Watchtower (opens in a new tab) for breaches, weak, reused or expiring passwords, 2FA and passkey availability, plus Business Watchtower reports across shared vaults |
| Identity provider | Not listed | Unlock with SSO (opens in a new tab) and automated provisioning (opens in a new tab) with Okta, Entra ID, OneLogin, Duo and others |
| Policies and reports | Not listed | Custom policies, activity monitoring and custom business reports |
| Free Families account for each user | Not listed | Yes (1Password (opens in a new tab)) |
| Developer tools | 1Password Developer tools | 1Password Developer tools |
Every 1Password subscription includes Travel Mode (opens in a new tab), which "removes vaults from your 1Password apps and browser extension, except those you mark as safe for travel"; with 1Password Business, admins can turn it on and off for team members. 1Password also lets you "create, use, and share passkeys", with shared vaults making passkeys available to colleagues (1Password passkeys (opens in a new tab)). Apps run on macOS, iOS, watchOS, Windows, Android and Linux, with browser extensions for Chrome, Safari, Edge, Firefox and Brave.
How to choose: the Teams Starter Pack suits a team of 10 to 20 people that does not need directory integration. Choose 1Password Business if you want staff to sign in with Microsoft Entra ID or Google, accounts created and suspended from your directory, Watchtower reports, or free family accounts for staff. Comparing with another vendor? See Keeper vs 1Password, 1Password vs LastPass, NordPass vs 1Password or 1Password vs Bitwarden.
Enterprise Password Manager and Unified Access
For larger organisations, 1Password no longer sells a plan simply called "1Password Enterprise". Its Enterprise products are quote-only, under a platform it calls Unified Access, which 1Password says "brings together five products: Enterprise Password Manager, SaaS Manager, Credential Broker, Device Trust, and Privileged Access" (1Password platform (opens in a new tab)). 1Password's pricing page adds that individual products can also be bought separately.
| Product | What 1Password says it does |
|---|---|
| Enterprise Password Manager (opens in a new tab) | "Protect every credential that keeps your business running": apps outside SSO, granular vault permissions, multi-tenant support, a developer toolkit and audit-ready activity logs; it can "Stream audit events to your SIEM and automatically suspend compromised accounts" |
| Device Trust (opens in a new tab) | "Surface what's on every endpoint and enforce access based on device health and posture", with what 1Password describes as 125+ prebuilt device checks, on macOS, Windows, Linux, iOS and Android, including BYOD |
| SaaS Manager | "Discover, secure access, and optimize AI and SaaS spend" |
| Privileged Access | "Just-in-time and just-enough privileged access" |
| Credential Broker | Verifies AI agents and machine workloads at runtime, then delivers only the credentials each is authorised to receive |
Enterprise Password Manager also finds "plaintext secrets on developer devices" and moves them into a managed vault. If you are weighing these products against Microsoft Entra ID or a privileged access tool you already run, our enterprise password manager guide covers the decision.
Is 1Password Business the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Unlock with SSO, provisioning and SIEM
1Password Business connects to your identity provider in two separate ways, and it helps to plan both together:
| Integration | What it does | Points to plan for |
|---|---|---|
| Unlock with SSO (opens in a new tab) | Team members sign in to 1Password "with their identity provider username and password instead of their account password and Secret Key" | OpenID Connect only; one identity provider per account; people in the Owners group keep their account password; the same email address in 1Password and the identity provider. 1Password lists Auth0, Duo, Google, JumpCloud, Microsoft Entra ID, Okta, OneLogin and Ping |
| Automated provisioning (opens in a new tab) | Create users and groups, grant and revoke access to groups, and suspend users from your identity provider | Provisioning does not include SSO, so set up both if you want both. 1Password lists Google Workspace, JumpCloud, Microsoft Entra ID, Okta and OneLogin |
| SIEM event streaming | Sends 1Password events to SIEM tools, which 1Password names as Splunk, Elastic, Sumo Logic and Panther | Agree which events your security team wants before you connect it |
For Microsoft Entra ID, 1Password's guide says to choose a private client "if your identity provider's policies require one, such as Conditional Access policies in Microsoft Entra ID". Existing team members unlock with their account password and Secret Key once before switching to Unlock with SSO, so a staged rollout by team works best.
Personal accounts for 1Password Business users
1Password says: "When you're part of a team that uses 1Password Business, you get a complimentary 1Password Families membership, which you can share with your family." Only the subscription status is linked, "No other information is shared", and the membership stays active "as long as it's linked to your business account" (1Password support (opens in a new tab)).
Personal logins stay out of shared work vaults, and the organisation never holds staff's personal data.
Who makes 1Password, and 1Password in the UK and EU
1Password's terms of use (opens in a new tab) say the service is "operated by AgileBits Inc."
1Password accounts are created in one of three regions, and the region (opens in a new tab) decides where secure data is hosted and the billing currency:
| Account on | Secure data hosted in |
|---|---|
| 1Password.com | United States |
| 1Password.ca | Canada |
| 1Password.eu | European Union |
UK organisations that want their data hosted in the EU should create the account on 1Password.eu. 1Password says data "is never automatically moved from one region to another": changing region means creating a new account and copying the items across, so it is worth deciding at the start. "Regardless of your region, 1Password staff can't access your saved logins or other items."
How we supply 1Password
Forever Systems can quote and supply 1Password for your business. Where we manage 1Password for you, it runs on 1Password's Enterprise Password Manager - MSP Edition (opens in a new tab), which 1Password describes as having "centralized billing and admin controls to simplify deployment and multi-tenant client management". On that edition:
- Pricing is consumption-based per user: 1Password says "Pricing is consumption-based per user", with "no license minimums", and the data region is chosen for your compliance needs
- Your organisation owns its data: 1Password says "Your clients own their 1Password data. We can't see the vault names, vault items, or their account password"
- Technician access is controlled: 1Password lists "Enhanced technician MFA" and "Auditable technician logs" in the MSP console
The Teams Starter Pack, 1Password Business and Enterprise Password Manager are 1Password's line-up; the plan and terms for your organisation are confirmed at quote. We can help you choose the plan, connect Unlock with SSO and provisioning to Microsoft Entra ID, Google Workspace or Okta, set up groups and shared vaults, and import passwords from browsers, spreadsheets or another manager. 1Password can be billed monthly, with terms confirmed at quote; licence options are on 1Password licensing (opens in a new tab).
Contact us for free advice on which 1Password plan fits, or a quote.
Frequently asked questions
What is the 1Password Secret Key?
The Secret Key is a 34-character code with 128 bits of entropy, created on the user's device and stored on the devices they sign in on and in their Emergency Kit. It is combined with the account password to protect data, and 1Password says "We have no record of your Secret Key and can't recover it" (1Password (opens in a new tab)).
What is the difference between 1Password Teams Starter Pack and Business?
The Teams Starter Pack includes 10 members (up to 20) for a flat monthly price. 1Password Business is priced per user, with a one-user minimum, and adds identity provider integrations, expanded role-based vault sharing, Watchtower alerts, broader administration and reporting, and a free Families account for each user.
Can we unlock 1Password with Microsoft Entra ID?
Yes. 1Password Business supports Unlock with SSO with Microsoft Entra ID over OpenID Connect, and automated provisioning can create, update and suspend users from Entra ID. If you use Conditional Access policies, 1Password advises setting up a private client (1Password SSO (opens in a new tab)).
Who owns 1Password?
1Password is operated by AgileBits Inc., according to its terms of use (opens in a new tab).
Is 1Password available in the UK and EU?
Yes. UK organisations can create their account on 1Password.eu, which hosts secure data in the European Union; 1Password.com hosts in the United States and 1Password.ca in Canada. Data is not moved between regions automatically, so choose the region before you start (1Password regions (opens in a new tab)).
Is there a free trial of 1Password Business?
Yes. 1Password offers a 14-day free trial of 1Password Business and the Teams Starter Pack with no credit card required. We can help you set up the trial with your identity provider and a few shared vaults so it reflects how you would really use it.
Still have a question about 1Password Business?
Ask us and a member of our team will get back to you.