CONFIDENTIAL COMPUTING AT 1PASSWORD

Summary from the TLDR InfoSec newsletter

To ensure the security of its customers' secrets, 1Password utilizes end-to-end encryption to ensure that the data is not accessible by anyone, even at 1Password. To achieve this goal, 1Password utilizes AWS Nitro Enclaves to create a cryptographically verifiably, isolated confidential compute environment. 1Password publishes each enclave release to a public transparency log and then verifies the attestation when the client opens an encrypted channel. This ensures that no 1Password or AWS employees can access the code or communications running in the enclaves.