Articles on: General questions (f.a.q.)

Handling & securing Data

This article explains which personal data Maglr stores and where, how Maglr protects its platform and office, what Maglr does when a security breach happens, and which security options you can use yourself.


Personal data Maglr stores


Maglr stores the account data of its platform users: their name, email address and hashed password, together with their company details. Maglr needs this data to give users login access.


Maglr keeps the personal data of the visitors of Maglr publications to a minimum, in line with the GDPR. Maglr stores visitor data in these cases:


  • Forms and newsletter sign-ups: information that visitors enter in a Maglr form or a newsletter sign-up in a publication is sent to the email addresses, the webhook, or both, that the customer has set. Maglr doesn't keep a list of form responses or subscribers. When a response is sent by email (including the backup email Maglr sends if a webhook doesn't respond), that email, with the submitted details, is kept in Maglr's email log for up to one year and then deleted automatically.
  • Single Sign-On: when a visitor logs in to a secured publication with Single Sign-On, Maglr stores the basic profile the identity provider sends, such as name and email address, together with a unique user ID, so the visitor can log in.
  • Email login: when a customer secures a domain with email login, Maglr stores the visitor email addresses that the customer uploads or adds, so those visitors can log in.


The content of a publication can also contain personal data, such as contact details in an article. That depends on what the customer publishes.


Where Maglr data is hosted


According to Maglr's security page, Maglr hosts its platform on Amazon Web Services (AWS) servers in Frankfurt, Germany. Backups are made twice a day, with extra backups stored in Ireland. For requests from outside the Netherlands and Germany, media are cached by the Cloudflare CDN for less than 24 hours.


Security risks on the Maglr platform


A security breach at Maglr could affect customers in two ways:


  • Access to data and content: someone who obtains a user's account data (name, email address and hashed password) could read the data and project content in that account. Maglr is mainly used to publish public content, so the impact is limited when an account holds no confidential or sensitive information.
  • Unauthorised changes: someone without authority could edit and publish projects, for example to show misinformation, or delete complete projects. This is the greater risk.


How Maglr responds to a security breach


When a security breach happens at Maglr, Maglr first fixes or closes the issue that caused it. Maglr can temporarily lock user accounts from the back end. Live publications stay online and readable for visitors, but locked users cannot edit or create content until Maglr lifts the lock.


Maglr notifies the affected client, or all clients, within 24 hours. Who is informed depends on the incident:


  • Login with a stolen or weak password: when someone signs in to an account through the regular login with a stolen or simple password, Maglr treats this as an account issue for that client, not as a breach of the platform. Only that client is informed.
  • Leak in the server infrastructure: when someone gets into Maglr's server infrastructure through a security leak and may have access to all content, Maglr informs all clients of the platform.


Keeping sensitive information safe in Maglr


Maglr recommends that you never upload very sensitive information to the platform. Maglr is built as a publishing platform to share information publicly, and content you upload is stored in the cloud.


  • Maglr offers several security options for projects, but a wrong value in a project's or domain's security settings can make the content public.
  • Public content can be found by search engines such as Google. The domain name setting Index for search engines controls whether the projects on a domain are indexed.
  • Most security problems are caused by human mistakes, so check these settings before you publish.


How Maglr secures its platform and office


Maglr takes the following measures to keep its platform, office and data secure.


Office and staff


  • Maglr staff get a weekly security reminder.
  • Local workstations are protected with passwords, screensavers that lock automatically and anti-virus software. Passwords must be changed every six months.
  • Network and file access is divided by user permissions, and protected with firewalls and VPN access.
  • Two-factor authentication (2FA) is always used where possible, for example for Microsoft 365 mail.
  • Staff are taught not to share sensitive data through unsecured channels of third-party tools. Microsoft 365 mail is the main tool for communication.
  • Only a limited number of people have access to the infrastructure and the underlying internal or external servers.
  • The Maglr office in Breda is secured with an alarm and video surveillance, and only Maglr employees can enter it.
  • Backups are stored offsite in a locked room.


Platform and servers


  • The operating systems of the servers get security patches automatically and are kept up to date with current versions.
  • Third-party modules and open-source plugins in Maglr's software are kept up to date.
  • All servers run within the Amazon Web Services network, with several security layers, firewalls and two-factor authentication (2FA) for access.
  • Only specific employees with the correct credentials and two-factor authentication (2FA) have access to the AWS servers.
  • Code is deployed through CI/CD with integrated tests and code approvals, so every code change passes one central point before it goes live.
  • All steps in the platform and all actions on the servers are logged. Maglr can look back at what happened and what caused it, even when a page in Maglr suddenly changes.
  • External software monitors the servers for security vulnerabilities, combined with automatic penetration tests.


Securing your Maglr account and projects


Depending on your plan, Maglr offers these security options for your own account and content:


  • Two-factor authentication (2FA): each user can protect their login with an extra code from the Microsoft or Google Authenticator app.
  • Single Sign-on (SSO): each user can log in with a Microsoft or Google business account.
  • Security for all users: an admin can require 2FA or SSO for every user in the account. See Enable additional security for all users.
  • Project and domain security: a single project can be protected with a password or an automatically generated login link. A domain name can protect all its projects with a manual password, an auto-login URL, dashboard login, an IP filter, Single Sign-On or email login. See Securing your project(s).
  • Index for search engines: this domain name setting controls whether search engines such as Google index the projects on that domain.


A user can use two-factor authentication or Single Sign-on, not both at the same time.


To turn on two-factor authentication for your own account:


  1. In the top-right corner, point to your name and click My profile.
  2. Under Account security, click Enable next to Two-Factor Authentication (2FA).
  3. If Maglr asks for your password, enter it.
  4. Scan the QR code with the Microsoft or Google Authenticator app, enter the 6-digit code from the app under Authenticator code and click Confirm.
  5. Save the 8 recovery codes Maglr shows. They are shown only once, and you need one if you lose access to the app. Then click Continue to dashboard.


For more detail, see Enable Two-Factor Authentication for your account.


Frequently asked questions


Where is my Maglr data stored?


According to Maglr's security page, Maglr hosts its platform on Amazon Web Services (AWS) servers in Frankfurt, Germany. Backups are made twice a day, with extra backups stored in Ireland.


Does Maglr store the data my visitors enter in forms?


Information that visitors enter in a Maglr form or a newsletter sign-up in a Maglr publication is sent to the email addresses, the webhook, or both, that you have set. Maglr doesn't keep a list of form responses or subscribers. When a response is sent by email (including the backup email Maglr sends if a webhook doesn't respond), that email, with the submitted details, is kept in Maglr's email log for up to one year and then deleted automatically.


How quickly will Maglr tell me about a data breach?


Maglr notifies affected clients within 24 hours of a security breach. If someone signs in to your account through the regular login with a stolen or weak password, Maglr treats it as an account issue and informs only your organisation. If Maglr's server infrastructure is breached, all clients are informed.


Can I turn on two-factor authentication for my Maglr account?


Yes, depending on your plan. In the top-right corner, point to your name, click My profile, and under Account security click Enable next to Two-Factor Authentication (2FA). You then scan a QR code with the Microsoft or Google Authenticator app, enter the code and save your recovery codes. See Enable Two-Factor Authentication for your account. An admin can also require 2FA for all users; see Enable additional security for all users.

Updated on: 20/10/2026