mSecure is a password manager and the company has recently released their latest version (v5) that uses their own servers to store and sync user data.
Some people are concerned about how they are securing user data and mSecure provided this description
when you first sign up for an account, we generate a super secure password mentioned above that we call an “Account Key.” We then take a known piece of text (it doesn’t really matter what the text is, but it happens to be a copyright notice) and encrypt it with your account key. The encrypted text is then stored in your cloud account. To be clear, this is not the account key itself; it’s a known piece of text that has been encrypted with the account key. We then encrypt the account key with your master password – the password you use to unlock the app – and store it in the mSecure database locally on your device. We then send you an “mSecure Authentication” email that contains your account key, which is required to authenticate you as the owner of your account.
Your account key is not stored in the mSecure Cloud.
When you log into mSecure on your device, it reads the account key out of your local database and decrypts it with your master password. This is why you don’t need to use the QR code each time you launch mSecure. When you want to install and use mSecure on a new device, we require you to sign in with your email and master password then ask you for the QR code. mSecure reads in the account key from the QR code, decrypts the data in the code with your master password then downloads the known piece of text mentioned earlier from your cloud account. Once the known piece of text is downloaded, mSecure attempts to decrypt it with the account key, and, if the decryption is successful, downloads the rest of your data that is also encrypted with your account key from the mSecure Cloud. After the data is downloaded from your cloud account, it can now be decrypted with the account key locally on your device.
Does this sound reasonable, or are there points that are of concern, such as the “mSecure Authentication” email that contains your account key which they claim isn't an issue as it's already encrypted?