# Security

> How MorphGate protects your vault, what our servers can and can't see, who processes data for us, and how to report a vulnerability.

MorphGate keeps SSH hosts, keys and passwords in a vault that is encrypted on your devices. This page explains how we protect it, and the service around it, and where to report a problem. The binding terms are in our [privacy policy](https://morphgate.com/privacy.md) and, for teams, the [data processing agreement](https://morphgate.com/dpa.md).

## Report a vulnerability

Email [contact@vallic.com](mailto:contact@vallic.com) with "MorphGate security" in the subject. Please tell us what an attacker could do, what they need first (a network position, a device, an account), the app version and platform, and the steps that show it. Keep it private until a fix is out; we'll tell you when it is, and credit you if you'd like.

Please don't test the live service (scanning, load, other people's accounts) without our written agreement. Testing your own copy of the app, or your own sync server, needs no permission. Our contact details are also in [security.txt](https://morphgate.com/.well-known/security.txt).

## End-to-end encryption

- Every vault item, attachment and session log is encrypted on your device with XChaCha20-Poly1305 before it is uploaded, and padded so exact sizes don't show. Items are signed with Ed25519, so the server can't change them unnoticed.
- Your account keys are protected by a key derived from your master password with Argon2id (at least 64 MiB of memory), and separately by your recovery key. We never receive either.
- In a team, each vault key is sealed to each member's own key by an admin's app. The server holds no key that opens a vault, and can't add anyone to one.
- When someone leaves a team, the vaults they could open are flagged for key rotation. After rotation, changes under the old key are refused.

How it works in detail: [Vault encryption](https://morphgate.com/docs/vault-encryption.md).

## What our servers can and can't see

**We can't see** what is in your vaults: hosts, usernames, passwords, private keys, notes, snippets, attachments, and team session logs. They reach us only as ciphertext.

**We can see** what we need to run your account: your email address; your devices (name, platform, app version, when they last synced); your plan; counts, padded sizes and dates of your items; and, in a team, its name, members, roles, vault permissions and activity log. The activity log stores no IP addresses. You can download everything we keep about you from your [account page](https://morphgate.com/account).

## Accounts and access

- The sign-in key your app derives is stored only as an Argon2id hash. A sign-in for an address with no account takes as long, and answers the same way, as one with a wrong password, so accounts can't be discovered.
- Access tokens last 15 minutes. Refresh tokens are replaced at every use: a copied one used again within two weeks signs that device out, and signing in again on a device ends all its earlier tokens. Tokens, links and codes are stored only as hashes.
- Two-step verification with an authenticator app; each code works once.
- Teams can require two-step verification, single sign-on (OIDC or SAML 2.0) and approval of new devices. Roles and per-vault permissions are checked on every request.
- Rate limits on sign-in, sign-up, recovery, invites and sign-in links. The account page signs you out after 30 minutes without activity.

## Infrastructure

- The service runs on Vallic Cloud, the hosting platform Vallic operates, on UpCloud machines in London, United Kingdom.
- All traffic goes through bunny.net's CDN, with a web application firewall, bot protection and protection against denial-of-service attacks. Sync and account traffic is never cached.
- The database and stored files are backed up every night, encrypted before they leave the machine, to two offsite locations with different providers (Cloudflare R2 and Scaleway in Paris), each with its own key. The last four daily backups are kept.
- Health checks watch the database, storage and scheduled jobs, and alert our operators. A release that fails its checks rolls back by itself.
- Your apps keep a full copy of your vaults and keep working while the service is unavailable.

## How we work

- **Staff access.** Support uses a console that shows account and team details, never vault contents. Staff can't reset a master password or turn off two-step verification, and every action in the console is logged with their name. Production access is limited to the people who run the service, with personal SSH keys and two-factor sign-in; every login is recorded. The site's admin pages accept connections only from allowed addresses.
- **Changes.** Every change reaches production through a pull request that can't be merged until the automated tests, coding standards checks and static analysis pass. The tests include a security suite that checks who can reach every endpoint, that one team can never see another's data, and that every endpoint that changes data stands up to thousands of malformed and hostile requests.
- **Limits.** Storage, devices and downloads are limited per plan, so no account can use the service as general file storage.

## Your data

- Vallic d.o.o. in Croatia runs MorphGate under the GDPR. Your data is stored in London.
- Teams are covered by our [data processing agreement](https://morphgate.com/dpa.md), which every team accepts with the terms.
- Deleting your account or team removes it from our live systems at once; backups expire within 7 days. Accounts and teams without a plan that nobody uses for 12 months (24 if they ever paid) are deleted after two email warnings.

### Sub-processors

- **BunnyWay d.o.o. (bunny.net), Slovenia**: content delivery network, firewall and attack protection for all traffic. Vault contents pass through only as ciphertext.
- **UpCloud Ltd, Finland**: the machines that run the service, its database and file storage, in London.
- **Cloudflare, Inc. (Cloudflare R2)**: encrypted backup storage in Europe.
- **Scaleway SAS, France**: encrypted backup storage in Paris.
- **MailerSend, Inc.**: delivery of account and team emails.

Payments go through Stripe, which handles card details; we never see them. We tell team owners 30 days before we add or replace a sub-processor.

## If something goes wrong

Monitoring alerts our operators, who assess and contain an incident and record what happened and why. If it affects personal data, we notify the affected teams' owners within 48 hours. Because vaults are encrypted end to end, a breach of our systems would expose ciphertext and the account details listed above, not vault contents; we would still tell you.

## Certifications

We don't hold SOC 2 or ISO 27001 certification today. Business customers can ask us for our answers to a standard security questionnaire, and the data processing agreement gives teams a right to audit. Write to [sync@morphgate.com](mailto:sync@morphgate.com).