Trust Center · Incident response
What we do in a security incident
No service is entirely immune to incidents. What matters is limiting their impact by design, acting quickly and communicating openly.
What would a server breach expose?
Because vault contents are end-to-end encrypted, the impact of a server breach is limited from the start.
Could be exposed
- Encrypted items and wrapped keys (unreadable without the keys)
- The Argon2id hash of your login key (not your master password itself)
- Metadata: email address, organization names and memberships, session and device information, timestamps, audit records with masked IP addresses
Not exposed
- Your master password and decryption keys
- Item titles, usernames, passwords, notes and the 2FA secrets in your vault
- Names of shared vaults
The risk of an attacker who controls the running server serving modified code to the web vault is described in the whitepaper. The browser extension ships its code with the installation and does not load remote code, so it is not affected through this path.
How we respond
- 01
Detect
Monitoring alerts (service health, certificate, disk, backup freshness), audit logs and reports from outside.
- 02
Contain
We isolate the affected component and close the hole; if needed we revoke sessions and rotate server secrets and credentials.
- 03
Assess
We determine which data and which accounts were affected, when the incident started and how it happened.
- 04
Notify
Where required, we notify the Personal Data Protection Board and affected users within the times below.
- 05
Learn
We fix the root cause, add a regression test, summarize it in the security changelog and update this page if needed.
Notification under KVKK
72 hours
Personal Data Protection Board (KVKK Kurulu)
We notify the Board without delay and within 72 hours at the latest of becoming aware of a personal data breach.
As soon as possible
Affected users
We inform affected people directly as soon as reasonably possible once the affected data has been identified.
These obligations come from Article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Board's decision on data breach notification.
How we would tell you
Email
To affected account holders at the email address on their account: what happened, which data was affected, what we did and what you should do.
Site and app notice
If an incident affects more than one user, we publish a notice on this site and in the app.
MGVault will never ask for your master password, recovery code or 2FA code by email, phone or message. A message asking for them is phishing, even if it looks like an incident notice.
What you should do
In an incident notice we state clearly which steps are needed for that incident. In general:
- 1If your master password is short or used elsewhere, change it to a long, unique one.
- 2Check the signed-in devices in Settings and sign out any session you do not recognize.
- 3Turn on two-step login (a passkey or an authenticator app), or set it up again.
- 4Create a new Emergency Kit; the old recovery code stops working immediately.
- 5If you manage an organization, review the audit log; if needed, rotate shared vault keys and change critical passwords.
- 6Sign in by typing our address yourself instead of clicking links.
Noticed something?
Security contact
If you see activity you do not recognize in your account, or a security issue, write to us right away.
muhammed@aliguc.com
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.