Encryption protects content stored in the database: someone who obtains just a copy of the database (e.g. from a hosting backup) cannot read messages or task descriptions. The key sits in a .env file on the server, outside the database.

Where to find it

⚙ icon → Settings → Advanced tab → Data encryption section. This section is visible only to an administrator account.

First run

  1. Click Generate encryption key.
  2. Immediately download a copy of the key (the "Download key copy" button) and keep it somewhere safe, e.g. in a password manager. Without the key, encrypted data cannot be recovered - not even by the maker of the program.
  3. Turn on the Encrypt new data switch and click Save.
  4. Click Encrypt existing data - the switch only encrypts what gets saved from this point on, while this tool goes through data saved earlier.

What is encrypted

With encryption enabled, a ciphertext (AES-256-GCM) is stored in the database instead of plain text:

  • message content in tasks and chats - including AI Assistant replies in the thread, AI Agent messages (e.g. reminders and confirmations of sent emails), messages added by Automations and the n8n integration, and out-of-office auto-replies,
  • task descriptions - including tasks created by Automations and n8n,
  • items added to to-do lists using the "+ Add item" button,
  • out-of-office messages (leave, sick leave) - with encryption enabled, the program no longer keeps a plain-text copy of them alongside the user's account,
  • email content in Mail.

The counter in the section shows, for each of these groups, how many entries are already encrypted.

Not encrypted include task subjects, chat and workspace names, email subjects and senders, notes, files, conversations with the AI Assistant (in the Assistant window and questions about emails in Mail - the reply may quote the email content), AI Agent plans (including the content of scheduled messages and emails), and system entries in the thread (who changed the status, due date, task name, or the list of participants).

Search and encryption: the search box at the top of the list also shows hits within encrypted content in its results, but it only checks the roughly 200 most recent messages and roughly 200 tasks - it may not find older encrypted content. Simply narrowing down the list of tasks and chats by a typed phrase takes into account unencrypted subjects, names and content.

As a separate mechanism, independent of this switch, the program always encrypts SMTP passwords, AI provider API keys and n8n webhook secrets.

Encrypting and decrypting existing data

  • Encrypt existing data - goes through all the groups listed above and encrypts entries stored as plain text. It can be safely stopped ("Stop") and resumed later. After encrypting out-of-office messages, the tool also removes their old plain-text copies.
  • Decrypt everything - the reverse operation, needed only before permanently disabling encryption. It saves the data in the database back as plain text.

Key rotation

Rotate key creates a new key and rewrites all encrypted data with it. The old key stays on the server only until the rotation is complete.

  • Before rotation, all data must be encrypted - run "Encrypt existing data" first. System entries (e.g. about a status change) are saved as plain text, so if the rotation refuses to start because new ones have appeared in the meantime, run this tool again right before the rotation.
  • You'll see the new key only once - make a copy of it straight away.
  • During rotation, everything is readable as usual: entries not yet rewritten are read by the program using the old key. If you interrupt the rotation, you can finish it with the "Continue rotation" button.
  • During rotation, the encryption switch and the regular migration are locked.

When something goes wrong

  • Instead of the content you'll see „[Encrypted - no key]” - there's no .env file with the key on the server (e.g. after moving the program to a different server). Restore the file or enter the key from a backup copy into it.
  • Instead of the content you'll see „[Decryption error]” - the entry is encrypted with a different key than the one on the server. Check that the .env file has the correct key (the key hint in the section helps you compare it with a backup).