Docs Encrypted collections

Encrypted collections

Mark a collection as encrypted and every file in it, notes, images, PDFs, and the rest, is ciphertext on disk at all times, decrypted only in memory by Intabula itself. The agent, other apps, and whatever the folder syncs to see only encrypted bytes.

How it works

Each file is encrypted with AES-256-GCM under a per-collection master key. That key is wrapped by a key derived from your password (scrypt); the password itself is never stored, and neither is anything it could be recovered from. Changing the password rewraps the master key in place and leaves every file untouched.

You can encrypt a collection when you create it, or later from its collection settings. Encrypting an existing collection rewrites its notes and other files to ciphertext; removing encryption restores plaintext. A file added to an encrypted collection, for example an image dropped onto it, is encrypted as it is saved.

Unlocking

Unlock is per session: enter the password once and the collection opens normally in the app. It locks again on quit, after a period of idle, or when you lock it yourself. While locked, the collection asks for the password and shows none of its content.

What the agent sees

The agent can see that an encrypted collection exists, how many records it has, and the names of its records and files, since those are filenames. It can't read any record's fields or body, or the contents of any other file. Every vault operation that reads, writes, or queries records or files checks the collection and refuses encrypted ones, for every provider, whether or not the collection is currently unlocked. The refusal is enforced in code and does not depend on how the model behaves. Search results and backlinks from encrypted collections are filtered out of what the agent gets, and the full-text index stores no content from encrypted files. Bots can't run on or read encrypted collections.

What stays visible

Encryption covers the contents of every file: a record's fields and body, and the bytes of an image, a PDF, or any other file. Filenames (and therefore slugs), the number of files, file sizes, and modification times remain visible on disk. Intabula tells you this when you encrypt. If a name is itself sensitive, give the file a neutral one.

Sync and other apps

Encrypted files are ordinary files that happen to hold ciphertext, so they sync like everything else. iCloud Drive, Dropbox, and Git carry them without being able to read them. Other apps opening the same folder, Obsidian included, see unreadable content, and an encrypted image or PDF won't open in Preview either. Open and edit encrypted files only in Intabula.

No password recovery

There is deliberately no recovery. Intabula has no account, no server, and no key escrow, so nothing exists that could reset the password. If you lose it, the files stay ciphertext.

Where to go next