Security you can check, not just take our word for.
My1Login looks after the keys to your organisation's apps, so we hold ourselves to the standard you'd expect of that. Here is how we protect your data, how it's independently tested, and the evidence your security team will ask for.
- Zero-knowledge encryption
- Rated A+ by CREST-approved penetration testers
- Cyber Essentials Plus certified
- Encryption
- AES 256-bit, client-side · keys stay in your network
- Penetration testing
- CREST-approved testers · rated A+
- Certification
- Cyber Essentials Plus
- Hosting
- ISO 27001-certified data centres · UK option
- Availability
- 99.9% SLA · typically 100% in practice
- A+penetration test rating from CREST-approved testersAbout our testing
- CE+Cyber Essentials Plus certifiedCertificate details
- AES-256client-side encryption, keys never leave your networkHow it works
- 100%typical availability, with a 99.9% SLALive status
We can't read your passwords. Nobody outside your organisation can.
Stored sign-in details are encrypted with AES 256-bit encryption on the client side, inside your own environment. The keys are held there and are never sent to My1Login, so what reaches our service is unreadable without them, to us and to anyone who might ask us.
What that means in practice
- Encrypted before it leaves your networkPasswords travel and are stored only in encrypted form.
- No keys on our serversA breach of our service would expose nothing readable.
- Nothing to hand overWe can't decrypt your data, so we can't be made to.
- In transit, tooConnections use TLS 1.2 or later.
What customers say about our security model
"My1Login's client-side encryption architecture meant that our Identity Management vendor did not have access to our passwords. It was genuinely safe."
James Serjeant, Head of IT, Cresta World Travel · Read the story
"…their zero-knowledge encryption gave me confidence that even My1Login themselves could not access our data."
Michelle Ronald, ICT Manager, Turning Point Scotland · Read the story
Certified, tested and recognised by others.
We tell you exactly what we hold and what our suppliers hold, so there are no surprises in your due diligence.
- Certified
Cyber Essentials Plus
The UK government-backed scheme, independently audited and tested: firewalls, secure configuration, access control, malware protection and patching.
Request the certificate → - Rated A+
Penetration tested by CREST-approved testers
Our latest independent test rated My1Login A+, which the testers define as
Request the summary letter →suitable for use in defence and other high security industries
. - Hosting certified
ISO 27001-certified hosting
My1Login runs in data centres certified to ISO 27001, with a UK hosting option for organisations that need data kept in the UK.
- G-Cloud 8 to 13
UK Government G-Cloud
Crown Commercial Service accepted My1Login onto six G-Cloud frameworks in a row, G-Cloud 8 to 13.
- Recognised
KuppingerCole Leadership Compass
My1Login is featured in KuppingerCole's 2024 Leadership Compass for Privileged Access Management.
- Winner
SC Awards Europe 2025
Best Identity and Access Management Solution, judged by security professionals.
My1Login does not hold ISO 27001 certification itself; the certificate above belongs to our hosting provider.
Tested by specialists, the way attackers would.
Testing is done independently, by people whose job is to break in.
Independent penetration tests
CREST-approved testers attack the service, the apps and the infrastructure every 12 to 24 months, timed around major upgrades.
Findings fixed and re-tested
Anything found is fixed and checked again before the test is closed.
Secure development
Code is reviewed before release, and dependencies are checked for known vulnerabilities.
Responsible disclosure
Security researchers can report issues to us directly, and we acknowledge every report. How to report
Where your data lives, and what we can and can't see.
Data protection, in plain terms.
What My1Login stores
- Encrypted sign-in details, readable only with your keys
- Users and groups synced from your directory
- Policies and sharing settings
- The audit log of sign-ins and changes
What My1Login never sees
- Your passwords in readable form
- Your encryption keys
- The content of the apps your workforce signs in to
- Hosting location
- UK data centre option. Other regions: please contact us to discuss.
- Our role under UK GDPR
- Data processor for your organisation's data.
- Data processing agreement
- Available to every customer. Request the DPA
- Subprocessors
- Microsoft (UK): hosts the services that process data.
- When you leave
- Your data is available for 90 days from the end of your contract, or for less time if we agree that with you.
- ICO registration
- Z3073986
Who looks after what.
Zero knowledge means some of the most important controls stay with you, by design.
My1Login looks after
- The service, its hosting and its availability
- Encryption of everything we store
- Independent testing and Cyber Essentials Plus
- Fixing vulnerabilities and telling you about incidents
- The integrity of the audit log
Your organisation controls
- The encryption keys, inside your network
- Your directory and who is in it
- Which apps are covered and who can use them
- Policies: MFA, step-up, password rules, time limits
- Who can see the audit log
Built to be there when your workforce signs in.
Our SLA commits to 99.9% availability, and in practice the service typically runs at 100%. You can check it yourself at any time on our live status page.
- Contracted. 99.9% availability in our SLA, with a response within 1 hour.
- Service status. The current status of the My1Login service, on our support site.
- Backups. Incremental backups every 10 minutes, and a full backup every day, at the start of every week and month, and in the last week of the year. You can restore to any point in the last 28 days. Backups are encrypted with AES-256 and stored in your contracted hosting location.
- Disaster recovery. Incremental backups every 10 minutes and point-in-time restore for 28 days mean very little data could ever be lost, and the service can be restored from a known good copy.
- Incident response. We respond to security incidents within 1 hour, and tell affected customers about them.
- Web portalOperational
- Browser extensionOperational
- Windows desktop agentOperational
- Directory syncOperational
How My1Login helps you meet your own obligations.
Many of the controls auditors ask about are access controls. My1Login gives you the controls and the evidence.
| Framework | What it expects of access | How My1Login helps |
|---|---|---|
| ISO/IEC 27001:2022 (yours) | Annex A controls for access control (5.15), identity management (5.16), authentication information (5.17), access rights (5.18), secure authentication (8.5) and logging (8.15). | Access from your directory, strong hidden passwords, MFA per app, leavers removed everywhere, and an audit trail of every access. |
| Cyber Essentials and Cyber Essentials Plus | User access control: accounts only for those who need them, strong passwords or MFA, admin rights kept separate. | Unique, strong passwords people never see, and MFA on the apps that need it. We hold Cyber Essentials Plus ourselves, so we know what assessors check. |
| Cyber Assessment Framework (CAF) | Objective B2: identity and access control, including privileged access. | Shared and privileged accounts released by policy and time, with every use logged. |
| UK GDPR, Article 32 | Appropriate technical measures, including the ability to ensure ongoing confidentiality of systems. | Zero-knowledge encryption and access control you can evidence. |
| NHS Data Security and Protection Toolkit | Access to patient data limited, managed and protected with strong authentication. | Directory-based access, MFA and a record of every access to patient systems. |
| PCI DSS v4.0 | Unique IDs for every user and MFA into the cardholder data environment. | Named access to shared accounts and MFA on the applications in scope. |
My1Login supports your compliance; it doesn't make an organisation compliant on its own.
The evidence your security team will ask for.
Choose what you need and we'll send it, usually within one working day. Some documents are shared under NDA.
Security overview
How My1Login is built, hosted, encrypted and run.
- On request · NDA
Penetration test summary letter
From our CREST-approved testers, with the A+ rating.
- On request
Cyber Essentials Plus certificate
Our current certificate.
- On request
Data processing agreement
Our standard DPA under UK GDPR.
- On this page
Subprocessor list
Microsoft (UK) hosts the services that process data.
- Download
Cyber Essentials Plus white paper
How My1Login helps you achieve Cyber Essentials Plus.
- On request
NCSC Cloud Security Principles
How My1Login meets the 14 principles.
Request documents
Trusted by
Security questions
Is My1Login ISO 27001 certified?
My1Login's hosting environment is certified to ISO 27001. My1Login itself is certified to Cyber Essentials Plus and is penetration tested by CREST-approved testers, who rate it A+. My1Login is working towards ISO 27001 certification as a company and expects to complete it in 2027.
Can My1Login see our passwords?
No. Sign-in details are encrypted client-side with AES 256-bit encryption, and the keys stay inside your organisation's network. Our service only ever holds data it cannot read.
Where is our data hosted?
In ISO 27001-certified data centres, with a UK hosting option for organisations that need their data kept in the UK.
How often are you penetration tested?
By CREST-approved testers every 12 to 24 months, timed around major upgrades. Our latest test rated My1Login A+, which the testers define as "suitable for use in defence and other high security industries".
Can we see the penetration test results?
Yes. We share a summary letter from the testers on request, under NDA.
Will you complete our security questionnaire?
Yes. Send it to us and our team will complete it. Many answers are also in our security overview.
Do you sign a data processing agreement?
Yes. Our standard DPA is available to every customer under UK GDPR.
What happens to our data if we leave?
Your data is available for 90 days from the end of your contract, or for less time if we agree that with you.
Send us your security questionnaire.
Our team will complete it, walk your security team through how My1Login works, and show you the zero-knowledge model on your own apps.
- Your questionnaire, completed for you
- A specialist replies within one working day
- Documents shared under NDA where needed