On Wednesday, Marek, the owner of an accounting office with 11 people, gets a question from a client: "What would someone see if they took a copy of your database off the hosting?" Data encryption in a task management program can hide the content of messages and task descriptions from such a person - if the administrator has also covered earlier entries with it.
Data encryption in a task management program protects a copy of the database, not every place where data is held
Content encryption in Task Manager protects messages and task descriptions from being read by someone who gets hold of just a copy of the database. It doesn't encrypt the entire contents of the application and doesn't replace access control over accounts and the server.
Imagine Marek finds out that an old copy of the hosting database has been leaked. If the administrator switched on encryption and also covered earlier entries, then instead of the content covered by this mechanism, the database holds AES-256-GCM ciphertext - a form unreadable without the right key. The key sits in an .env file on the server, not in the database itself. If someone also got hold of the key, the situation would be different - a copy of the database alone isn't the same as a copy of the database together with the server's files.
Task Manager runs on the client's hosting as PHP files and a MySQL database, so the application's data sits on your own server. The company administrator switches on encryption in the settings and keeps a copy of the key off the server, for example in the company's password manager.
Separately, the application suspends logins for 15 minutes after five wrong passwords on one account; it also limits attempts from a single IP address to 20 failed attempts in 15 minutes. These mechanisms relate to logging in, not to reading a database that's been taken off-site.
What is encrypted, and what stays in plain text?
Once encryption is switched on, Task Manager stores as ciphertext the content of messages, task descriptions, items added to to-do lists, absence notices, and email content in Mail. It doesn't encrypt, among other things, task subjects, chat and Workspace names, notes, files, or conversations in the AI Assistant window.
| Encrypted once switched on | Stays in plain text |
|---|---|
| Message content in tasks and chats, including AI Assistant replies saved in the thread, AI Agent messages, entries from Automations and n8n, and absence auto-replies | Task subjects and chat and Workspace names |
| Task descriptions, including those created by Automations and n8n | Notes and files |
| Items added to to-do lists with the "+ Add item" button | System entries in the thread, for example information about a change of status, due date, task name or participants |
| Absence notices, for example about leave or illness | Conversations in the AI Assistant window, including questions about emails in Mail, and AI Agent plans |
| Email content in the Mail module | Email subjects and senders |
The difference between an AI Assistant reply in a task thread and a conversation in the AI Assistant window matters: the former is one of the encrypted messages, the latter stays in plain text. A reply to a question about an email may also quote its content in the unencrypted conversation. AI Agent plans may include the content of scheduled messages and emails, and are not covered by this encryption.
You can encrypt email content just like messages, but the Mail module is only available in the Pro variant. Regardless of the switch discussed here, Task Manager always encrypts, through a separate mechanism, SMTP passwords, AI provider API keys and n8n webhook secrets; this also applies to mailbox passwords and Google Calendar tokens.
How to switch on encryption without losing access to content
Encryption is switched on by the administrator in the Settings → Advanced → Data Encryption section. First they need to generate a key and download a copy of it, only then switch on encryption of new data and separately encrypt entries already saved.
Only the administrator account sees this section. The order matters:
- Click "Generate encryption key".
- Immediately click "Download key copy" and keep it off the server, for example in your company's password manager.
- Switch on "Encrypt new data" and click "Save".
- Click "Encrypt existing data" to also cover earlier entries.
Nobody can recover encrypted data without the key, not even the software vendor. So don't put off downloading a copy of it until after migration. The switch itself only applies to content saved from the moment it's turned on; it doesn't encrypt the entire history retroactively. You can pause the tool for earlier data with the "Stop" button and resume it later, and a counter in the settings shows progress separately for each group of entries.
If you ever want to permanently turn off encryption, use "Decrypt all" first. This operation writes the affected content back to the database as plain text. So don't treat turning off the switch as a way to solve a missing-key problem.
When to turn on encryption, and when to prepare the key first?
Turn on encryption when messages or task descriptions hold content that shouldn't be exposed if the database itself were leaked. First arrange somewhere to keep a copy of the key and someone responsible for keeping it; without that, you risk losing access to the encrypted entries.
On Wednesday, Marek opens a client's task: the subject contains the client's surname, and the description holds the agreed terms. Once encryption is turned on and earlier entries are encrypted, the description will be protected within the database copy itself, but the subject will remain readable. Marek also checks a note - its content isn't covered by this switch.
If your company hasn't yet decided where to keep a copy of the key, start with that decision, not with the switch. The same applies when tidying up data migrated from another tool: check what you're putting in descriptions and messages, and what goes into fields that stay in plain text. We cover this in more depth in our article on a task management tool, GDPR and your own server.
After encryption is turned on, older entries may be missed by Search
Task Manager's Search does include encrypted content, but it checks it among roughly the 200 most recent messages and roughly 200 tasks. So it may fail to find an older entry, even though you can still open it in the relevant thread.
You'll notice this limitation if, after a few months, you try to find a word hidden only in an old message. Separately, narrowing the task and chat list by a typed phrase takes into account subjects, names and unencrypted content - it doesn't search encrypted messages that way. A readable subject helps you find a thread, but don't put information you want to keep hidden from whoever holds a copy of the database in it.
There are also two messages an administrator should be aware of. "[Encrypted - no key]" means the server is missing the .env file with the key, for example after moving the installation. You need to restore the file or enter the key from your saved copy into it. "[Decryption error]" indicates the entry was encrypted with a different key than the one available on the server; the key hint in the settings section helps you compare it against your copy.
Rotate the key only after encrypting earlier entries
You can change the key with the "Rotate key" function, for example if you suspect a copy of it has reached someone it shouldn't have. Before rotating, run "Encrypt existing data", since the operation requires the affected entries to already be encrypted.
You'll only see the new key once, so save a copy of it straight away. During rotation, Task Manager still reads entries not yet rewritten with the new key using the old one; the old key stays on the server only until the operation finishes. If you interrupt it, you can finish it via "Continue rotation". During this time, the encryption switch and a regular migration are both locked.
Sometimes rotation refuses to start because new plain-text system entries have appeared in the meantime. In that case, run "Encrypt existing data" again right before rotating. This is another reason to check the counters before changing the key, rather than assuming a migration done once has settled the matter for good.
Encrypting the database doesn't stop content sent to the AI provider
Before sending a query to the AI provider, Task Manager decrypts the content it needs. The query, along with its context, goes to the model provider configured by the administrator using the company's API key, so encrypting the database doesn't mean the data used by AI stays solely on your server.
The administrator chooses the provider in AI Settings: OpenAI, Google Gemini, Anthropic Claude or xAI Grok. When AI is turned off, nothing is sent to the model provider. Mail as a source of AI knowledge is disabled by default and requires a separate decision from the administrator. Knowledge sources - tasks, calendar, workspace, notes or files - are chosen by the user themselves in their Assistant thread; the administrator enables AI separately for tasks, chats and the Assistant window, and the Assistant only sees what the user asking has access to. You'll find details in the article what reaches the AI provider and in the description of the Your model, your key principle.
Standard or Pro? You get encryption in both
Content encryption works in both the Standard and Pro plans. You don't need to choose Pro just to encrypt messages and task descriptions; Pro adds Mail, Files and Automations, and the content of emails is encrypted if you use Mail and turn on this mechanism.
For Marek's 11-person company, the question is therefore not "how much does encryption alone cost?", but "does the team need Mail and the other Pro features?". We've laid out this decision in our comparison of the Standard and Pro plans; you can check current prices in the Task Manager pricing. The licence is perpetual, includes 12 months of updates, and has an optional yearly renewal. You pay once for a plan matching your number of seats, not a monthly subscription per person.
Tomorrow, start by deciding where to keep a copy of the key
Before the administrator clicks the switch, designate someone responsible for the key and decide where the company will keep a copy of it. Then check with your team whether information that needs protecting ends up in encrypted content rather than in readable subjects, notes or files. If you'd like to see how Task Manager organises tasks and conversations on your own hosting, open the Demo.
Frequently asked questions
Does Task Manager encrypt messages and task descriptions by default?
No, encryption of this content is switched on by the administrator in Settings → Advanced. Regardless of this switch, SMTP passwords, AI provider API keys and n8n webhook secrets are encrypted, among other things.
What happens if I lose the encryption key?
Without the key, nobody can recover the encrypted data, not even the software vendor. Download a copy as soon as you generate the key and keep it off the server, for example in your company's password manager.
Will the search still work once encryption is switched on?
Yes, but it only checks encrypted content among roughly the 200 most recent messages and roughly 200 tasks. Narrowing the list by a phrase also takes into account subjects, names and unencrypted content.
Can the AI Assistant use encrypted messages?
Yes, when such content is a knowledge source selected by the user: before sending a query with context to the configured AI provider, the program decrypts the content that's needed, and the Assistant only sees what the user has access to. With AI switched off, nothing is sent to the model provider.
Does data encryption in the task management program work only in Pro?
No, encryption of messages and task descriptions works in both Standard and Pro. The Mail module, whose email content can also be encrypted, is available in Pro.
Sources
The Task Manager Team - we write about teamwork, AI in business and keeping tasks organised, using examples from Task Manager, software installed on your own server. Task Manager has been developed by Blue Creation Group (Piotr Łącz) since 2013 and is used by organisations including Neonet, the Military University of Technology and Polpharma - read customer reviews. We check our articles against the user guide and the latest version of the software.
