What is data encryption in Task Manager?
Data encryption in Task Manager is a Pro variant feature that stores message content, task descriptions and emails in the database as an AES-256-GCM cipher instead of plain text. Anyone who gets hold of just a copy of the database - say, from a hosting backup - won't be able to read this content. The key sits in the .env file on the server, outside the database.
Encryption is turned off by default. An administrator enables it in Settings → Advanced → Data Encryption - only an administrator account can see this section. Only an eight-character key fingerprint is kept in the database, which helps compare the key on the server with the saved copy.
Encryption protects the database copy, but doesn't replace access control over accounts and the server. If someone obtained the key file together with the database, the situation would be different. SMTP and mailbox passwords, AI provider API keys, Google Calendar tokens and n8n webhook secrets are encrypted by the program using a separate mechanism, in every variant.
How does it work?
- 01
message content in tasks and chats - including AI Assistant replies in the thread, AI Agent messages, entries from Automations and n8n, and absence auto-replies,
- 02
task descriptions, including those created by Automations and n8n,
- 03
items added to to-do lists with the "+ Add item" button,
- 04
absence messages (leave, sick leave),
- 05
email content in Mail.
What do you gain?
You don't need to assume the worst if an old database backup ends up in the wrong hands. If encryption also covered earlier entries, the messages, task descriptions and emails in it are unreadable, and the key isn't in the database.
When a client asks what someone with a copy of your database would see, you can answer precisely: you know which content is encrypted and which is in plain text. Your team knows where to put what's confidential.
You don't need to remember who changed the encryption settings and when - every such change is logged with the author, time and address.
An everyday example
An accounting office with 11 people keeps client arrangements in tasks: amounts, payment deadlines, notes on tax filings. One of the clients asks directly: "What would someone who takes a copy of your database from the hosting see?"
The owner starts not with the switch, but with a decision on where the company will keep the key copy and who's responsible for it. Then the administrator generates the key, saves a copy in the company's password manager, turns on encryption for new data and encrypts the existing entries. The team gets one rule: arrangements go into the description and messages, not into the open subject line or a note.
Six months later, someone loses a laptop with a copy of the key. The administrator encrypts the existing data again, because system entries are saved in plain text and without this, key rotation may refuse to start. Then they rotate the key and immediately keep a copy of the new one - the program won't show it a second time.
Frequently asked questions
Is data encryption available in the Standard variant?
No, this is a Pro variant feature. In Standard there's no "Data Encryption" section in Settings, so encryption can't be turned on. Passwords and API keys are encrypted by the program using a separate mechanism in every variant. Prices for both variants are listed in the pricing, in amounts excl. VAT.
What happens if I lose the encryption key?
Without the key, no one can recover the encrypted content, not even the program's publisher. That's why you download a copy of the key right after it's generated and keep it off the server. When the .env file with the key is missing from the server, for example after moving the program, you'll see "[Encrypted - key missing]" instead of the content - then you restore the file or enter the key from your copy into it.
Does encryption cover task subjects, notes and files?
No. Task subjects, chat names, notes and conversations in the AI Assistant window remain in plain text. Files and attachments stay on disk in their original form, and the program only serves them to people with access.
Will the AI Assistant read encrypted messages?
Yes, if you've configured AI. Before sending a query, the program decrypts the content it needs, so database encryption doesn't limit what reaches the chosen AI provider. Without the key, nothing reaches the AI provider.
Does search still work once encryption is turned on?
Yes, but it only checks encrypted content among roughly the 200 most recent messages and roughly 200 tasks, so it might not find an older entry. Narrowing the list of tasks and chats by a typed phrase only takes into account unencrypted subjects, names and content.