Their file format specs are open, and there are opensource implementations of it. Sure - closed source isn't ideal - but this is as good as it gets. The 'opensource' alternatives have a way worse security trackrecord. I tried quite a few options - but always went back to 1pass...