Encryption & the Vault

Coalface is privacy-first: sensitive content is protected without you having to think about it. There are two layers — encryption at rest, which is on by default, and the Vault, which you opt into for your most sensitive values.

Encryption at rest

By default, three kinds of content are encrypted at rest:

• Task descriptions
• Note (comment) content
• Subtask titles

This means that in the database, these fields are stored as ciphertext, not readable text. Task titles stay readable so that boards, cards, sorting and quick search keep working.

Encryption keys are scoped per group, so the key boundary matches who can see the boards. You can turn encryption on or off per group as well as set a workspace-wide default — encrypt a client’s group and leave an internal one plain, for instance.

Is this end-to-end encryption?

No — and we’re careful never to claim it is. Coalface holds the keys so it can decrypt your content to do useful things: sync it to WordPress, send it to Slack, run search and AI when you ask. It protects your data at rest in the database; it isn’t zero-knowledge.

The Vault

For values that should never leave Coalface — a login, an API key, a client secret — use the Vault. A Vault field is:

• Never synced to WordPress
• Never sent to Slack, webhooks or AI
• Never included in search or export

It simply stays in Coalface, encrypted, and shows only when a permitted person reveals it.

Managers-only mode

By default, any group member with access to a board can use its Vault. You can switch on a stricter managers-only mode, so only owners, admins and managers can reveal or set Vault values — everyone else doesn’t even see the field.

Turning it on

Encryption defaults are set per workspace and can be overridden per group in that group’s Security settings. The Vault is enabled per group in the same place. For the extra login protections that pair well with this, see account security.

The short version: descriptions, comments and subtasks are encrypted at rest by default, keyed per group. For values that must never leave Coalface — secrets and logins — put them in the Vault, optionally locked to managers only.