About the design of 1Password Credential Governance

Learn how credential data stays encrypted when account ownership is transferred from team members to administrators.

1Password lets administrators take ownership of work-related accounts and the credentials used to access them. The experience depends on your setup:

Both experiences share the same underlying design, which provides visibility and control over work-related accounts and their credentials while preserving 1Password’s zero-knowledge and end-to-end encryption security model.

Technical design

Item and app discovery

1Password can discover work-related items, applications, and credentials in business account vaults when item or app discovery is turned on.

If you use 1Password Business without SaaS Manager, administrators take ownership of the credentials item discovery identifies and manage them on 1Password.com. Company-managed credentials appear on the Items page.

Risk assessment with SaaS Manager

If you use SaaS Manager, it assigns a risk score to each discovered application based on the risk of the associated accounts. It estimates risk using factors such as the potential impact if an account is compromised, the sensitivity of the data the app can access, the level of privileged access associated with the account, and the likelihood of common real-world attack patterns. These risk scores are continuously refined based on actual usage, access, and security posture data.

Transferring account ownership

When an administrator decides to take ownership of a work-related account, 1Password creates a company-managed credential policy. If you use SaaS Manager, the policy is created in 1Password SaaS Manager. If you use 1Password Business only, the policy is created on 1Password.com. In both cases, the policy identifies the credentials used to access the account by attributes such as domain and username. The policy defines which credentials should be managed, but it doesn’t modify any credential data on its own.

When a team member unlocks 1Password on their device, the 1Password client evaluates the credentials the team member can access against the company-managed credential policy. If the client finds a matching credential, it begins the ownership transfer locally on the device.

During the transfer, the 1Password client decrypts the credential, generates a new item-level encryption key, and re-encrypts the credential with that key. The new key is then shared with an authorized group, allowing people in that group to manage the credential. By default, the authorized group is the Administrators group in your 1Password account.

Newly transferred credentials are stored on 1Password servers and are always end-to-end encrypted. Administrators can assign team members access to credentials and manage their permissions in SaaS Manager or on 1Password.com, depending on which setup you use.

Security model

Company-managed credentials remain end-to-end encrypted throughout the ownership transfer process. Credential data is encrypted with a symmetric, item-level encryption key using AES-256-GCM, and only devices belonging to authorized groups can decrypt it.

Credential ownership transfers are performed locally on the 1Password client. A new symmetric item-level key is generated on the device and used to re-encrypt the credential data, making sure the credential is never decrypted or re-encrypted on the 1Password server.

The new item-level key is encrypted for the authorized group using RSA-OAEP with 2048-bit moduli and a public exponent of 65537. To prevent unauthorized transfer of credentials, 1Password uses DNS-based verification to establish an external source of trust for the group keys involved in the credential ownership transfer.

Risk considerations

Company-managed credential fields, such as passwords, remain concealed to team members in the 1Password apps. Team members can use company-managed credentials by autofilling with the 1Password browser extension. While 1Password controls access to company-managed credentials, it can’t prevent a team member from attempting to capture credential information after it’s been used. We recommend using multi-factor authentication or passkeys for company-managed credentials.



Published: