Teams and organizations
Team password sharing without blind trust in the server
In MGVault you create an organization, open shared vaults and grant each person access per vault. Every vault has its own encryption key, delivered only to members you have verified; the server cannot read shared content. When someone leaves, the key is rotated and the passwords to change are listed.
- Free for up to 3 users
- Per-vault permissions
- Append-only audit log
How it works
- 1
Create your organization
Open an organization from your account. As the owner you manage members, roles and shared vaults.
- 2
Invite and verify members
The invited person creates their own account. You approve them by comparing key fingerprints by phone or in person; nothing is shared with an unverified key.
- 3
Grant access to vaults
For each shared vault, choose View, Edit or Manage per person. The vault key is encrypted separately to each member’s public key and signed by you.
- 4
When someone leaves
When you remove a member, their access ends, the vault key is rotated, and the passwords and 2FA items they could see are collected in a rotation checklist.
Roles and permissions
There are two layers: roles that decide who runs the organization, and permissions granted per person for each shared vault.
| Action | Owner | Admin | Member |
|---|---|---|---|
| Use vaults shared with them | yes | yes | yes |
| Send invitations | yes | yes | no |
| Confirm new members | yes | yes | no |
| Remove members | yes | yes | no |
| Change roles | yes | no | no |
| See the audit log | yes | yes | no |
| Action | View | Edit | Manage |
|---|---|---|---|
| See and copy items | yes | yes | yes |
| Add, edit and delete items | no | yes | yes |
| Decide who has access | no | no | yes |
| Rotate the vault key | no | no | yes |
When an employee leaves: an honest process
Revoking access does not make someone forget what they have seen. Rather than ignore that, MGVault deals with it openly.
Access ends immediately
Their copies of the vault keys are deleted and their access to shared vaults ends.
The key is rotated
The vault moves to a new, signed key version. Clients refuse to write with the old key, so new items are out of the departed person’s reach.
Rotation checklist
The passwords and 2FA accounts they could access are listed, and you tick them off as you change them.
Audit log
Membership, invitation, role, sharing and key events are kept in an append-only log with masked IP addresses. You can filter by event type and export to CSV. Copy and autofill events are reported by members’ apps and are labeled as such.
Retention: 7 days on Free, 365 days on Team.
Plans
- Free: up to 3 users, 1 shared vault and 50 shared items.
- Team: no limit on users, vaults or items; priced by quote.
Questions about team sharing
Can organization admins see members’ personal vaults?
No. Your personal vault is completely separate from the organization and opens only with your key. Admins see only the shared vaults they have access to, the member list, roles and the organization’s audit log.
Could the server slip in a fake member to read shared passwords?
Not without being noticed. Shared vault keys are signed with Ed25519 by the person sharing them and clients verify the signature before opening anything; new members are approved by fingerprint. The known limit: a teammate’s key is trusted the first time it is seen (TOFU). Comparing fingerprints by phone or in person closes that gap.
What happens when an employee leaves?
When you remove them, their access ends and the keys of the vaults they could reach are rotated, so they cannot read new items. Because they may remember what they saw, MGVault gives you a rotation checklist of the passwords and 2FA accounts to change.
Does team sharing cost money?
It is free for up to 3 users, 1 shared vault and 50 shared items. For larger teams, the Team plan removes these limits and keeps the audit log for 365 days; pricing is quoted based on organization size.
Where is our team data kept?
Encrypted vaults, account data and the audit log are kept in our data centers in Türkiye (Datacasa, Mars Datacenter, Equinix and PenDC) and processed under KVKK. For organization accounts, the organization itself may also be a data controller for the decisions it makes about its members.
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.