How is this different from a cloud service?
The question “where are my case documents kept?” comes up often when signing a contract or during an audit. You install Task Manager on your own server - either yourself or using remote installation as an add-on service - so the database and files stay wherever you decide. The way the interface loads doesn't determine where the data is stored. It does, however, let you check whether the browser is connecting to third-party services.
The browser loads the interface exclusively from the application server. It doesn't use CDNs, Google Fonts or external avatar generators. This also applies to the login, registration, password reset, password reminder, account activation and installer screens. Avatars with initials are drawn by a script bundled with the application. The Roboto, Fira Code and Material Symbols fonts, as well as the text-formatting library, are part of the program package.
Interface resources are available from the application server even on a network without internet access. The server connects to the licensing panel on its own: when logging in, when activating a key and when checking for updates. It only passes it licence data, such as the key and domain, plus the program version. It connects to other services only when you point to or enable them: mail servers, the AI provider, Google Calendar, n8n webhooks and push notification gateways. The browser reaches beyond the application server in only four situations: with video (e.g. from YouTube or Vimeo) or an image from another site embedded in content, with Mail messages containing elements downloaded from the web (remote images only after clicking Show images), when enabling push notifications, and when logging in to Google while connecting a calendar.
What exactly happens to task and message content?
Restricting browser connections isn't enough if someone gets hold of a database dump. Content encryption works in the Pro variant and is disabled by default. Once a key is generated and encryption is switched on by the administrator, Task Manager encrypts messages written by users and task descriptions with AES-256-GCM, and in Mail (Pro) also the content of emails. The DATA_ENCRYPTION_KEY key sits in the .env file, outside the database. The database receives the ciphertext and an eight-character key hint, but not the key itself.
A separate mechanism, AES-256-CBC with the ENCRYPTION_KEY key, is always active. It secures the AI provider's API key, SMTP and mailbox passwords in Mail, Google Calendar tokens and the licence's log_secret. n8n integration API keys are hashed with bcrypt rather than encrypted.
Existing data can be migrated in batches of 1-200. Reading supports plain and encrypted rows at the same time, since each one has an is_encrypted flag. The key can later be rotated in a start - batches - finish mode. During rotation, the tool reads encrypted entries with either the new or the old key and saves them again with the new one. If encryption is disabled or the key is missing, the application stores the text in plain form. The encryption audit goes to logs/encryption-audit.log: it records who performed the logged operation, when and from where, without raw keys or plain text.
What do you gain?
You don't have to explain to a client why simply viewing the login page connects their browser to a font provider. The browser loads resources from the application server.
Your team doesn't reveal to external font or avatar providers who opens the interface or when. It also doesn't send them people's names in image URLs.
If a database copy leaks from a backup or an old disk, enabled encryption protects the specified content from being read without the key. You also know that using AI involves a separate external connection and isn't required to display the interface.
A law firm that needs to cover this in a contract
The law firm manages cases in tasks: it records case descriptions, correspondence and attachments. A corporate client asks for the contract to specify where documents are processed and list the subprocessors. The lawyer needs to establish where the data goes before responding.
In the Pro variant, task descriptions and message content can be encrypted with a key kept outside the database, and the lawyer's browser only fetches the interface from the application server. The law firm must separately account for the services the server connects to: AI, mail, Google Calendar or n8n. Encryption in the database doesn't limit what reaches the AI provider, because the program decrypts the content before sending it. Deploying the program on its own doesn't replace deciding what to put in the contract.
Frequently asked questions
Do my data leave my server?
Content from your database only leaves the server through the features you point to or enable: AI, mail, Google Calendar, n8n webhooks and push notifications. The server connects to the licensing panel on its own, but only passes it licence data, such as the key and domain, plus the program version. The browser loads the interface from the application server, with no CDNs, Google Fonts or external avatar generators.
What exactly is encrypted in the database?
Content encryption works in the Pro variant and is disabled by default. Once a key is generated and encryption is switched on by the administrator, Task Manager encrypts new messages written by users and task descriptions with AES-256-GCM, and in Mail (Pro) also the content of emails. You can encrypt earlier entries with the "Encrypt existing data" button. Plain text remains for, among others, task titles, notes, replies and conversations with the AI Assistant, and attachments. A separate mechanism always protects SMTP and mailbox passwords, the AI provider's API key, Google Calendar tokens and the licence's log_secret.
Where is the encryption key stored?
The DATA_ENCRYPTION_KEY for user content sits in the .env file on the server, outside the database. The database stores the ciphertext and an eight-character hint of the current key, but not the key itself. The hint lets you identify the right key backup.
Will Task Manager work on a network without internet access?
The interface doesn't need the internet to load fonts, the Markdown library or the script that draws user initials - these resources are part of the application. The internet is only needed by the features that use it: AI, mail, Google Calendar, n8n webhooks, push notifications and update checks.
Can I change the encryption key after a while?
Yes. Task Manager rotates the key in batches: it reads encrypted messages, task descriptions, absences and email content with either the new or the old key and saves them again with the new one. Regular migration is blocked during that time.