As part of 1Password’s ongoing commitment to responsible transparency, security, and compliance, we’re centralizing the distribution of our penetration testing reports. Effective November 3, 2025, all annual pentest reports will be available through the 1Password Trust Center.
“Available” and “trust” are interesting words here because it seems they do not have much confidence in the contents of the reports. When you want to get access 1Password demands that you sign a NDA. Which is a bit funny as then I am not able to tell after whether you can rely on that report. Aside from that given the trust page only allows a “work” email (whatever that may be?), it seems inaccessible to general users.
Is there any world or mindset where hiding this behind an NDA makes sense? Cybercriminals probably aren’t going to care about an NDA. I feel like I don’t even have to say that. All I could see this achieving is making 1Password look bad.
The NDA comes from SafeBase, the platform 1Password moved to. It’s B2B tooling for enterprise security questionnaires, and the NDA is standard there for all companies using it, I believe.
That is just not something we’re used to seeing in consumer and opensource world, but that’s the B2B way. That explains wording (trust center, work email) too, that’s how people speak in enterprise.
I think you should not worry about their confidence, they are fine.
What exactly? I do not know much about the problems they solve, but generally, from their parent company’s website, it seems to be about helping companies meet compliance requirements:
Ok, I think I"m starting to get it. It sounds like that page wasn’t meant for us, but for security business dealings that are normally out of the public eye.
Oh, yes, that is what I meant to say. From a pure logic standpoint, it makes sense: if a 1Password regular user were interested in straightforward transparency, they would choose an open source password manager.
1Password is cool, but it is for a different audience, and the enterprise sector is a noticeable part of it. So language and customs there can feel odd for some users here.
Not really. At my company we mostly work with small businesses. But back when we had a few enterprise clients, we laughed about the language so much. One of my favorites: the client operated in a market in the Middle East, and their manager said “changing situation” every time a normal guy would just say “war”
the thing is: they are fine even without this reviewing. But if something is blocking you: on linked forum they help people to go through the SafeBase ui