What does installation on your own server mean?
Installed on your own server means Task Manager runs on your company's hosting, not in the provider's cloud. The database, application files and attachments sit on your server. You install the program through your browser: you upload the files, and the installer creates the database tables, an administrator account and a configuration file with encryption keys. You can do this yourself or order remote installation as an additional service - its price is listed in the pricing. A standard shared hosting plan with PHP and a MySQL or MariaDB database is enough.
The browser loads the interface solely from your server - no CDNs, Google Fonts or external avatar generators. This also applies to the login, registration, password reset and installer pages. The Roboto, Fira Code and Material Symbols fonts sit in the fonts/ directory. A local script draws placeholder avatars as SVGs with initials.
The interface doesn't need the internet, but some features do. The server connects to the licence panel on its own: it checks licence status at login, reports the activation result after a new key is entered, and - whenever the administrator has the program open - checks for new versions every few hours and every time they open the Updates tab. The panel then receives the licence key, domain and program version - no content from your database.
The server connects to other services only once you specify or enable them:
- mail servers: the SMTP given in the installer (email notifications), a user's personal SMTP, and mailboxes added in Mail (IMAP and SMTP), - the AI provider, and, with the "AI Assistant with internet access" permission, also the websites the Assistant reads at your request, - Google Calendar, - n8n webhooks, - browser push-notification gateways (e.g. Mozilla, Google, Apple).
The browser connects to other services only in these situations:
- someone has embedded a video in the content (e.g. from YouTube or Vimeo) or pasted an image from another site, - in Mail you open a message with elements fetched from the web (remote images will only show once you click Show images), - you enable push notifications on the device, - you connect Google Calendar and log in to a Google account.
What does your server need?
- 01
PHP 8.1 or newer
- 02
MySQL or MariaDB (the
pdo_mysqlextension) - 03
the PHP extensions
openssl(encrypting passwords and API keys) andmbstring(special characters) - 04
write permission for the
includes/directory - this is where the installer saves the configuration file
How does it work?
The installer creates the full set of tables in the database and records which database changes have already been applied. This means the first update won't repeat the installer's work. In the Updates tab you see two numbers: "Installed version" is the version the database has been brought up to, and "Code version" is the version of the program files. They're usually the same. They can differ, for example, after manually uploading files without updating the database.
The program always encrypts in the database (AES-256-CBC) the AI provider's API key, SMTP passwords and mailbox passwords in Mail, Google Calendar tokens, and the licence's log_secret. The installer saves the encryption key in the includes/config.php file, outside the database. n8n integration API keys are stored only as a bcrypt hash, so they can't be read.
In the Pro plan, you can additionally encrypt messages written by users, task descriptions and the content of new emails in Mail (AES-256-GCM). This protection is disabled by default. It's enabled by the administrator in Settings → Advanced: first generate a key, then enable encryption. The key is stored in the .env file on the server, while only an eight-character hash of it is kept in the database. Download a copy of the key right after generating it - without it you won't be able to read encrypted content.
Messages and task descriptions saved before encryption was enabled can be encrypted with a separate button. The program does this in batches, so you can pause and resume the operation. You can also replace the key with a new one (rotation). Every encryption-related operation - generating and downloading the key, enabling, disabling, migration and rotation - is recorded by the program in the logs/encryption-audit.log log: who, when and from which address. The log contains no keys or content.
Updates are downloaded by the administrator. Before downloading, they confirm they have a backup of the database and the uploads/ directory. The .zip package goes to the protected storage/updates/ directory. Before unpacking, the program checks its SHA-256 checksum and the publisher's digital signature - it won't unpack a package without a valid signature. The update runs database migrations and replaces the program files, but doesn't delete your data.
What do you gain?
When you're working on a network without internet access, you don't wait for fonts or avatars to load from external sites. The browser fetches them from the application server. Without internet access, only the features that rely on it won't work, e.g. AI, Google Calendar or update checks.
When older logs are increasing the size of the database, you don't need to delete tasks or messages to clear technical logs. Automatic cleanup covers technical data only. Permanently deleting old content is a separate, manual operation by the administrator, requiring confirmation with a code.
An everyday example
A law firm needs to know where case documents are stored and who can access them, and it signs a data processing agreement with every IT provider that stores this data. With a tool hosted in someone else’s cloud, you also need a list of the provider, its subcontractors and the locations of its data centres. You also need to keep track of any changes to that list.
In Task Manager, case documents sit on the law firm's hosting. The list of companies that store this data or receive it therefore includes the hosting company and any services the firm connects itself: Mail, AI or Google Calendar. In the Pro plan, the administrator can enable encryption of messages, task descriptions and emails. Attachments stay on disk in their original form, and the program only serves them to people with access. If the firm sets up AI, the server will send the chosen provider prompts with context, and in the Pro plan, with default settings, also the content of tasks and chats for summarising in the knowledge base. Encryption in the database doesn't limit this, because the program decrypts the content before sending it.
Frequently asked questions
Is my data sent to the AI provider?
Yes, once you set up AI. The server then sends the chosen provider (OpenAI, Google Gemini, Anthropic Claude or xAI Grok) a prompt with the context and content that particular AI feature works on. In the Pro plan, with default settings, the knowledge base also sends it new and changed tasks and chats once a day for summarising. With OpenAI and Gemini, fragments of notes and files needed for semantic search are sent as well. The administrator can turn this off in the AI settings, and without an AI key nothing reaches the provider.
Do I need my own server room?
No. A standard shared hosting plan with PHP 8.1 or newer, a MySQL or MariaDB database, and an Apache or LiteSpeed server is enough. On this kind of host, Task Manager installs through the browser, with no console and no third-party company involved. If your server runs on nginx, it works too - you just need to paste the ready-made nginx-taskmanager.conf file, which ships with the application, into your configuration. The installer checks all requirements before installation and tells you exactly what's missing.
Could an update delete my data?
Updating Task Manager runs database migrations and overwrites the application files, but it doesn't delete user data. Before it starts, it requires confirmation that you have a backup. The downloaded package is checked against its SHA-256 checksum and the publisher's digital signature.
Who is responsible for backups?
You, or your hosting provider if it does backups as part of its service, are responsible for backups - Task Manager doesn't make backups itself. A backup should include the database, the uploads/ directory with users' files, and the includes/config.php file with the key the program uses to encrypt passwords and API keys. If you enable content encryption in the Pro plan, also keep the .env file or a copy of the key downloaded in settings - without the key you won't be able to read encrypted content. Before every update, the program requires confirmation that you have a backup.