1Password Public-Source Startup Diligence Report
1Password has a credible late-stage enterprise-security profile: public evidence supports a $6.8B valuation signal, a large business customer base, recognizable enterprise logos, 1,400+ employees, and a product expansion from password management into Extended Access Management. The investment case depends on validating ARR quality, net retention, security/compliance evidence, and competitive positioning against IAM, PAM, endpoint, and browser-security suites.
1Password Public-Source Startup Diligence Report
Track with high-priority private diligence. Public evidence supports an active private unicorn with meaningful enterprise traction and a broad identity-security product surface, but audited financials, current ARR, burn, customer concentration, cap-table terms, incident history, and contract economics remain unavailable.
Financial quality, ARR bridge, burn, and current valuation are not public
Diligence request: Obtain audited financials, management accounts, ARR/GMV bridge, gross margin, burn, cash runway, debt and cohort/unit economics.
Public logos, users or scale metrics do not disclose revenue concentration, churn, retention, cohort quality or margin by segment.
Diligence request: Request top-account revenue/GMV, churned/severed relationships, NRR/retention cohorts and customer/seller references.
Public valuation is $6.80B, but pre/post-money, preference stack, primary/secondary mix and investor rights are not public.
Diligence request: Request fully diluted cap table, financing documents, option pool, side letters, liquidation waterfall and debt/warrant schedule.
Crowded identity/security market with bundle pressure from IAM and platform vendors
Diligence request: Have counsel review litigation, regulatory correspondence, privacy/security, IP, contracts, licenses and insurance.
Security incident, compliance, and enterprise trust risk is existential for a credential platform
Diligence request: Run win/loss calls, pricing benchmarks, displacement analysis and CAC/payback review.
Public headcount and leadership signals do not prove org depth, retention, succession, supplier redundancy or execution capacity.
Diligence request: Review HRIS roster, attrition, succession, supplier contracts, incident history and delivery roadmap.
Funding history and public scale signals are available; audited financials, projections, cash runway, debt, cap table, revenue quality and working-capital detail are private. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| metric | public value | public evidence | verification status | private data request |
|---|---|---|---|---|
| Businesses served | 180000 | Company page says over 180,000 businesses | partially_verified | Audited financials, ARR/GMV bridge, gross margin, burn, cash and cohort detail. |
| Employees | 1400 | Company page says 1,400+ global employees | partially_verified | Audited financials, ARR/GMV bridge, gross margin, burn, cash and cohort detail. |
| Fortune 100 penetration | 30 | Company says more than 30% of Fortune 100 | partially_verified | Audited financials, ARR/GMV bridge, gross margin, burn, cash and cohort detail. |
Scale metrics are not substitutes for audited economics.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| stakeholder | public position | evidence | diligence gap |
|---|---|---|---|
| ICONIQ Growth | public investor/strategic partner | Named in funding or company materials | Ownership percentage, rights, liquidation preferences and side letters not public |
| Accel | public investor/partner signal | Named in funding or company materials | Ownership percentage, rights, liquidation preferences and side letters not public |
| Slack Fund | public investor/partner signal | Named in funding or company materials | Ownership percentage, rights, liquidation preferences and side letters not public |
| Enterprise customer/security ecosystem | public investor/partner signal | Named in funding or company materials | Ownership percentage, rights, liquidation preferences and side letters not public |
Request fully diluted cap table and financing documents.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| date | round or event | amount | valuation | public evidence | diligence caveat |
|---|---|---|---|---|---|
| 2019 | Series A | $200M | Not disclosed | SecurityWeek says Series A netted $200M in venture capital investments | Financing documents, preference stack and primary/secondary mix are not public. |
| 2021-07 | $100M round | $100M | $2B | SecurityWeek references a July round led by Accel at $2B valuation | Financing documents, preference stack and primary/secondary mix are not public. |
| 2022-01 | Series C | $620M | $6.8B | SecurityWeek reports ICONIQ-led $620M round at $6.8B valuation | Financing documents, preference stack and primary/secondary mix are not public. |
| 2026-03 | CB Insights list row | not disclosed | $6.80B | CB Insights tracker lists 1Password at $6.80B | Financing documents, preference stack and primary/secondary mix are not public. |
Public valuation anchors require reconciliation to financing documents.
Public sources describe the product surface; SKU economics, roadmap, gross margin and technical performance require private diligence. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| product | audience | features or evidence | verification status | diligence gap |
|---|---|---|---|---|
| Password Manager / Business vaults | Teams and enterprises | Credential storage, sharing, Watchtower/security checks | verified | SKU adoption, margin, support cost and roadmap timing are private. |
| Extended Access Management | Security and IT teams | Secure every sign-in for every app on every device | verified | SKU adoption, margin, support cost and roadmap timing are private. |
| Enterprise services and support | Large enterprises | Business/enterprise pricing and sales motion | verified | SKU adoption, margin, support cost and roadmap timing are private. |
Product claims are public positioning, not usage or profitability proof.
| package or model | public signal | evidence | gap |
|---|---|---|---|
| Public self-serve or sales-led packaging | Public pages expose pricing or sales motion but not realized discounting | Pricing/contracts require data-room review | EC-008 |
| Enterprise / strategic deals | Public enterprise or partner signals exist | MSAs, SLAs, minimums and support obligations not public | EC-008 |
| Usage / transaction economics | Public scale metrics exist | Take rate, gross margin and overage economics not public | EC-008 |
Pricing realization and margin are central diligence requests.
| dependency | role | public evidence | risk or gap |
|---|---|---|---|
| Cloud infrastructure providers (not publicly itemized) | core infrastructure or operating dependency | Publicly implied by product model or company materials | Spend, redundancy, SLAs and concentration not public |
| App/browser/OS ecosystems | operating dependency | Publicly implied by product model or company materials | Spend, redundancy, SLAs and concentration not public |
| Security assessors and auditors | operating dependency | Publicly implied by product model or company materials | Spend, redundancy, SLAs and concentration not public |
Supplier dependency should be quantified with spend and incident records.
Public customer/user/partner signals exist, but revenue by customer, churn, retention and concentration are not publicly verifiable. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| customer or segment | public signal | evidence | revenue gap |
|---|---|---|---|
| Canva | Named public customer/user/partner segment or platform participant | Public page or profile signal; no revenue contribution disclosed | Top-customer revenue, churn, renewal and margin not public |
| Oracle Red Bull Racing | Named public customer/user/partner segment or platform participant | Public page or profile signal; no revenue contribution disclosed | Top-customer revenue, churn, renewal and margin not public |
| Elastic | Named public customer/user/partner segment or platform participant | Public page or profile signal; no revenue contribution disclosed | Top-customer revenue, churn, renewal and margin not public |
| Named public customer/user/partner segment or platform participant | Public page or profile signal; no revenue contribution disclosed | Top-customer revenue, churn, renewal and margin not public | |
| ClickUp | Named public customer/user/partner segment or platform participant | Public page or profile signal; no revenue contribution disclosed | Top-customer revenue, churn, renewal and margin not public |
Named logos/users do not prove ARR or GMV concentration.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| partner | nature | public evidence | diligence gap |
|---|---|---|---|
| ICONIQ Growth | financing or strategic partner | Named in public sources | Contract economics, exclusivity, renewals and rights not public |
| Accel | investor/partner/ecosystem participant | Named in public sources | Contract economics, exclusivity, renewals and rights not public |
| Slack Fund | investor/partner/ecosystem participant | Named in public sources | Contract economics, exclusivity, renewals and rights not public |
| Enterprise customer/security ecosystem | investor/partner/ecosystem participant | Named in public sources | Contract economics, exclusivity, renewals and rights not public |
Review all strategic contracts and side letters.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| bucket | public revenue weight | evidence | request |
|---|---|---|---|
| Top customer | not_publicly_verifiable | No public revenue concentration schedule | Top-20 customer/seller/merchant ARR or GMV, renewal and margin |
| Top 5 customers | not_publicly_verifiable | Public logos or users lack dollar weights | Customer cohort and concentration bridge |
| Churned/severed relationships | not_publicly_verifiable | No churn/severed partner schedule public | Churned customer/merchant/seller list and reasons |
Intentionally a gap table.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| supplier or dependency | role | public evidence | risk or gap |
|---|---|---|---|
| Cloud infrastructure providers (not publicly itemized) | supplier/dependency | Publicly implied by business model | Contracts, spend, redundancy and termination rights private |
| App/browser/OS ecosystems | supplier/dependency | Publicly implied by business model | Contracts, spend, redundancy and termination rights private |
| Security assessors and auditors | supplier/dependency | Publicly implied by business model | Contracts, spend, redundancy and termination rights private |
Request supplier spend, SLAs and BCP/DR plans.
The company competes in a crowded market with platform, vertical and regional alternatives; win/loss and pricing pressure data are private. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| competitor | segment | product overlap | target differentiator or risk |
|---|---|---|---|
| Dashlane | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
| Bitwarden | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
| Keeper Security | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
| Okta | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
| Microsoft Entra | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
| LastPass | publicly identifiable alternative | Overlaps with enterprise security and identity platform | Differentiation and win/loss data require customer diligence |
Competitor list is an analyst mapping from public market context.
| axis | target public position | risk | private validation needed |
|---|---|---|---|
| Product breadth | Public product suite appears broad | Bundles can dilute willingness to pay | Win/loss and attach-rate data |
| Trust/compliance | Public trust signals vary by company | Security/legal failures can impair adoption | SOC, audits, incidents, regulator correspondence |
| Distribution | Public user/customer scale exists | Scale may be subsidized or low quality | CAC, payback, retention and cohort quality |
Competition diligence needs customer calls and pricing data.
Public GTM and channel signals are visible, but CAC, sales productivity, payback and pipeline quality are not public. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| channel | public evidence | risk or gap | request |
|---|---|---|---|
| Self-serve / product-led | Public web/product pages support online acquisition | Conversion and paid activation unknown | Signup-to-paid funnel and CAC |
| Enterprise / partnerships | Public investor/customer/partner signals exist | Sales cycle, discounting and support obligations unknown | Pipeline, quotas, ACV, win/loss |
| Marketplace / ecosystem / brand | Public brand/user/customer signals exist | Attribution and repeat usage not public | Cohort retention and channel mix |
GTM economics are not public.
| signal | public evidence | verification status | gap |
|---|---|---|---|
| Company website/newsroom | Active positioning and product updates | verified | Traffic, CAC and attribution not public |
| Customer/user logos or scale | Public proof points visible | partially_verified | Logo-to-revenue and cohort quality unknown |
| Investor/press coverage | Funding and valuation articles exist | verified | Terms and current valuation not public |
Marketing signals need conversion validation.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| metric | public value | why it matters | request |
|---|---|---|---|
| CAC / payback | not_publicly_verifiable | Validates scalability of demand generation | Cohort CAC and payback by channel |
| Quota attainment | not_publicly_verifiable | Validates sales-force productivity | Rep ramp, quota and attainment history |
| Pipeline coverage | not_publicly_verifiable | Validates forecast predictability | Pipeline by stage, source and close probability |
This is a diligence-request table.
Public product/R&D signals are visible; roadmap cost, technical debt and talent depth require management review. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| person or role | public role | evidence | gap |
|---|---|---|---|
| David Faugno | CEO | Company page | Detailed responsibilities, incentives and retention terms private |
| Michael Hughes | President | Company page | Detailed responsibilities, incentives and retention terms private |
| Greg Henry | CFO | Company page | Detailed responsibilities, incentives and retention terms private |
| Nancy Wang | CTO | Company page | Detailed responsibilities, incentives and retention terms private |
| Jacob DePriest | CISO & CIO | Company page | Detailed responsibilities, incentives and retention terms private |
Leadership roles are public signals, not org-depth proof.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| initiative | public status | evidence | risk or gap |
|---|---|---|---|
| Password Manager / Business vaults | publicly marketed or reported | Credential storage, sharing, Watchtower/security checks | Roadmap date, cost and technical debt private |
| Extended Access Management | publicly marketed or reported | Secure every sign-in for every app on every device | Roadmap date, cost and technical debt private |
| Enterprise services and support | publicly marketed or reported | Business/enterprise pricing and sales motion | Roadmap date, cost and technical debt private |
| Private roadmap | requires diligence | Only public roadmap fragments available | Product delivery risk and staffing needs private |
Request technical roadmap and engineering staffing plan.
Public leadership and headcount signals exist, but org chart, compensation, attrition and succession are private. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| source or date | public headcount signal | evidence | definition gap |
|---|---|---|---|
| 2022-01 | 570 | SecurityWeek article employee count | Employee, contractor and profile-count definitions differ |
| 2026-06 | 1400 | Company page employee count | Employee, contractor and profile-count definitions differ |
Request HRIS roster by function, location and worker type.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| name | role | public source | diligence gap |
|---|---|---|---|
| David Faugno | CEO | Company page | Employment terms, equity, references and succession plans private |
| Michael Hughes | President | Company page | Employment terms, equity, references and succession plans private |
| Greg Henry | CFO | Company page | Employment terms, equity, references and succession plans private |
| Nancy Wang | CTO | Company page | Employment terms, equity, references and succession plans private |
| Jacob DePriest | CISO & CIO | Company page | Employment terms, equity, references and succession plans private |
Management references and employment documents are required.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| topic | public status | risk | request |
|---|---|---|---|
| Attrition / turnover | not_publicly_verifiable | Leadership or talent churn could impair execution | Two-year attrition by function/location and regretted-loss list |
| Compensation / equity | not_publicly_verifiable | Retention and dilution risk | Comp bands, option grants, refresh policy and acceleration terms |
| Employee relations | not_publicly_verifiable | Unresolved claims or morale issues could create liabilities | Employee-relations log and material investigations |
People diligence requires private HR records.
Public legal/regulatory surface can be identified, but litigation, IP, insurance, contracts and regulator correspondence require counsel-led diligence. For 1Password, public evidence frames enterprise security and identity platform, but private diligence remains necessary before underwriting.
partially verified confidence: medium
Public sources provide directional evidence for 1Password, but the checklist question still needs private records for underwriting.
| matter | public signal | verification status | diligence request |
|---|---|---|---|
| Security certifications | SOC 2 Type 2 public claim; report details private | inconclusive | Counsel-led search, schedules, correspondence and material contracts |
| Privacy/security obligations | Enterprise credential platform likely has DPAs, SLAs, incident obligations not public | inconclusive | Counsel-led search, schedules, correspondence and material contracts |
| Litigation/regulatory clearance | No counsel-led docket/regulatory search performed | inconclusive | Counsel-led search, schedules, correspondence and material contracts |
No assertion of legal clearance is made.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| asset or contract area | public evidence | risk or gap | request |
|---|---|---|---|
| Trademarks / brand | Public brand and product names visible | Ownership, jurisdictions and encumbrances not verified | Trademark docket and assignments |
| Software / platform IP | Public product claims visible | Invention assignment, open-source and third-party licenses private | IP assignment and OSS scan |
| Customer/supplier/partner contracts | Public relationships visible | Economics, termination, exclusivity and indemnities private | Material contracts schedule |
IP/contracts must be reviewed by counsel.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
not publicly verifiable confidence: low
No sufficient public disclosure was found for this checklist area; treat as a data-room request, not a negative finding.
| regulatory area | public signal | risk | request |
|---|---|---|---|
| Privacy/data/security | Public product may process sensitive data | Breach/regulator correspondence not public | DPA, subprocessor, breach log, regulator letters |
| Financial/payments where applicable | Product or business model can involve payments/fintech | Licensing/KYC/AML obligations may vary | Licenses, AML program, audits and SAR/escalation metrics |
| Employment/labor where applicable | Headcount/contractor signals public | Employment compliance and worker classification private | Employment audits, contractor classifications and claims |
Regulatory exposure varies by jurisdiction and product line.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists 1Password as a Canada/Toronto Enterprise Tech unicorn valued at $6.80B, joined 2021-07-08, with investors including Slack Fund, Accel and Skip Capital. | verified medium | SRC-001 |
| EC-002 | SecurityWeek reported 1Password closed a $620M financing led by ICONIQ Growth that raised valuation to $6.8B, after a $100M round at a $2B valuation and a $200M Series A. | verified high | SRC-002 |
| EC-003 | 1Password says it provides trusted access for people and AI agents and serves over 180,000 businesses, more than 30% of the Fortune 100, and over two-thirds of the Forbes AI 50. | verified medium | SRC-003 |
| EC-004 | The 1Password customer page names public customer stories and logos including Canva, Oracle Red Bull Racing, Elastic, Reddit, ClickUp and others. | verified medium | SRC-004 |
| EC-005 | 1Password markets Extended Access Management as securing every sign-in for every app on every device, extending beyond traditional password management. | verified medium | SRC-005 |
| EC-006 | 1Password states it is SOC 2 Type 2 certified and that its security model goes beyond end-to-end encryption. | partially verified medium | SRC-007 |
| EC-007 | No public source reviewed disclosed audited financial statements, ARR, gross margin, burn, cash runway, customer concentration, or full cap-table terms. | not publicly verifiable high | SRC-001SRC-002SRC-003 |
| EC-008 | 1Password publicly lists David Faugno as CEO and a senior leadership team including President, COO, CFO, CPO, CBO, CMO, CLO, CTO, and CISO/CIO roles. | verified medium | SRC-003 |
| EC-009 | 1Password reports 1,400+ global employees building identity security. | verified medium | SRC-003 |
| ID | Publisher | Title | Accessed |
|---|---|---|---|
| SRC-001 | CB Insights | CB Insights Complete List Of Unicorn Companies | 2026-06-08 |
| SRC-002 | SecurityWeek | 1Password Raises Mammoth $620 Million Funding Round | 2026-06-08 |
| SRC-003 | 1Password | 1Password company page | 2026-06-08 |
| SRC-004 | 1Password | 1Password customers page | 2026-06-08 |
| SRC-005 | 1Password | 1Password Extended Access Management page | 2026-06-08 |
| SRC-006 | 1Password | 1Password business pricing page | 2026-06-08 |
| SRC-007 | 1Password | 1Password security page | 2026-06-08 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.