Infrastructure and operations

• Daily and encrypted

  The database is backed up every night and encrypted on the server to a public key (age). There is no key on the server that can open a backup; even a compromised server cannot read old backups.

• Private key offline

  The private key needed to restore is held only by the service owner, offline.

• Encrypted offsite copy

  A copy of the encrypted backup is transferred to a separate storage provider over an encrypted connection only; copying to plain FTP is refused by the software. Old backups are deleted automatically after a set period.

• Restore testing

  The restore test opens a backup into a temporary database and checks that the schema, row counts, database privileges and row-level security come back. It never touches the production database.

Because backups are daily, in the worst case changes since the last backup could be lost (recovery point objective: 24 hours). An encrypted copy of your vault also stays on the devices you are signed in on.

• Least privilege

  The API connects to the database with an unprivileged role that does not own the tables. PostgreSQL row-level security separates organizations as a second line of defense behind the application's own authorization checks.

• Hardened containers

  Services run in separate containers with privilege escalation disabled and Linux capabilities dropped; the API container has a read-only file system. The database and Redis sit on an internal network with no outside access.

• A single entry point

  Only the TLS-terminating reverse proxy is exposed. The payment page uses a separate origin that vault cookies never reach.

• Secrets are not logged

  The reverse proxy's access log is turned off; request bodies, tokens and ciphertext are never written to application logs. IP addresses in audit records are masked (IPv4 /24, IPv6 /48).

• Operator access

  The operator panel is only open to designated staff accounts; every change requires re-authentication with the master password and a second factor and is written to a separate operator audit log. Operators cannot see vault contents either.

• Rate limits

  Sign-in, sign-up, recovery and second-step attempts are limited per IP address and per account; responses do not reveal whether an account exists.

• Continuous monitoring

  Service health, the remaining validity of the TLS certificate, disk usage and the freshness of both the local and the offsite backup are checked every few minutes; an email alert goes out when the state changes.

• Tested changes

  Changes pass linting, type checking, unit tests and end-to-end tests before they are released. The crypto format is guarded by frozen test vectors.

• Updates

  Containers are updated by rebuilding from official base images (PostgreSQL 16, Redis 7, Caddy 2); TLS certificates renew automatically. The application version is embedded in every build.

• Strict-Transport-Security

  max-age=63072000; includeSubDomains; preload

  Forces the browser to use HTTPS only for two years, covers subdomains and is eligible for the HSTS preload list.

• Content-Security-Policy

  default-src 'self'; script-src 'self' 'nonce-…' 'strict-dynamic' 'wasm-unsafe-eval'; style-src 'self' 'nonce-…'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com/range/; worker-src 'self' blob:; manifest-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'

  A fresh nonce on every request: only scripts and styles we serve can run. No third-party scripts, fonts or connection origins; the page cannot be embedded by other sites (frame-ancestors 'none').

• Cross-Origin-Opener-Policy

  same-origin

  Isolates the page from windows opened by other sites.

• X-Frame-Options

  DENY

  Prevents framing in older browsers too.

• X-Content-Type-Options

  nosniff

  Stops the browser from guessing content types.

• Referrer-Policy

  no-referrer

  No address information is sent with requests to other sites.

• Permissions-Policy

  camera=(self), display-capture=(self), microphone=(), geolocation=(), payment=(), usb=()

  Camera and screen sharing are only allowed for our own origin (QR code scanning); microphone, location, payment and USB are off.

• Set-Cookie (mgv_refresh)

  HttpOnly; Secure; SameSite=Strict; Path=/api/auth

  The session refresh cookie is hidden from JavaScript, sent only over HTTPS and only from the same site.

A strict Content Security Policy with per-request nonces. No third-party scripts, fonts, trackers or analytics.