Database Encryption

Encrypt the database Omniscio keeps on your computer, so it can't be read without your key.

What it is

Omniscio keeps everything you do — your sessions, messages, and settings — in a database file on your computer. Normally that file is protected by your computer login and, if you've turned it on, full-disk encryption like BitLocker or FileVault. Database Encryption adds a second lock: it encrypts the database file itself, so even someone who copies the raw file off your machine can't read it without your key.

It's off by default — if you never turn it on, nothing changes. Your automatic backups are already encrypted with a key your computer's own keychain holds; this closes the last gap by protecting the live file too. On a machine where that keychain is unavailable, Omniscio still writes a backup rather than leave you with none — it writes an unencrypted one and raises an alert telling you so.

Turning it on

Open Settings → Database Encryption and switch it on.
Omniscio shows you a one-time recovery code. Save it somewhere safe (a password manager is ideal) — it's the only way back in if your computer can't unlock the database later. Mislaid it later while Omniscio still opens? You can generate a replacement — see Settings → Database Encryption → Recovery code → Generate new code.
The actual encryption happens at the next restart. Omniscio makes a safety copy first, then encrypts your database — safely, so a power cut in the middle can't lose anything.

Save your recovery code. It's shown only once. If you ever reinstall your operating system, move to a new computer, or set a passphrase and forget it, the recovery code is how you get back into your database. Without it — and without your passphrase — an encrypted database cannot be recovered by anyone, including us. That's the point of real encryption.

Two ways to protect the key

A random key does the actual encrypting. How that key is protected is up to you:

Automatic (default)

The key is sealed inside your computer's keychain — the same secure vault that already guards your saved passwords and API keys. Omniscio unlocks the database for you automatically whenever you're logged in. Zero friction, no prompts.

Passphrase (zero-knowledge)

For maximum privacy, set a passphrase (Settings → Database Encryption, once encryption is on). Your key is then locked behind that passphrase and the keychain copy is removed, so nothing but your passphrase (or the recovery code) can open the database — not even someone logged into your computer as you. Adding or changing a passphrase is instant (your data isn't re-encrypted). At each launch you'll type it in a small window before Omniscio opens.

What you'll see at launch

With automatic protection, nothing changes — Omniscio just opens. With a passphrase, a small unlock window appears first:

Type your passphrase and press Unlock. A wrong one just asks you to try again.
Quit closes Omniscio without opening the database.
Forgot it? Choose “Use recovery code instead” and enter the code you saved.

Frequently asked

Will it slow Omniscio down?

There's a small, one-time cost when you turn it on or off (your database is encrypted or decrypted once, at a restart — roughly a handful of seconds even for a large database). Day to day the overhead is minor and only applies while encryption is on. If you never turn it on, there's no cost at all.

What if I forget my passphrase?

Use the recovery code you saved when you turned encryption on — the unlock window accepts it in place of the passphrase, and lets you back in. That's exactly why the recovery code is mandatory.

I've mislaid my recovery code — can I get a new one?

Yes, as long as Omniscio can still open your database (it opens automatically, or you know your passphrase). Go to Settings → Database Encryption → Recovery code and choose Generate new code. Omniscio re-locks the same key under a fresh code and shows it once, exactly like the original — save it straight away. The old code stops working the moment the new one is made. Your data isn't re-encrypted, so it's instant.

What if I lose both my passphrase and my recovery code?

Then the database can't be opened — by anyone. Real at-rest encryption means there's no back door; if there were, it wouldn't be secure. Keep your recovery code somewhere safe, like a password manager, so this never happens. (Losing only the recovery code is not this situation — while Omniscio can still open the database you can generate a replacement, above.)

What happens if I get a new computer or reinstall my OS?

Your computer's keychain doesn't move with your files, so on a fresh machine Omniscio can't unlock the database automatically. Enter your recovery code once and it's restored — the automatic unlock re-establishes itself from there.

Is my data safe while it's being encrypted?

Yes. Omniscio takes a full safety backup of your database before it starts, and the encryption itself is done in a crash-safe way — your original stays intact until the new encrypted copy is complete and verified. A power cut, restart, or crash in the middle loses nothing. If Omniscio can't make the safety backup first (for example, the disk is full), it won't start the change and tells you to free up space — your database is left untouched.

Can I turn it back off?

Yes. Switch it off in Settings and, at the next restart, your database is decrypted back to normal with all your data intact. Removing a passphrase (without turning encryption off) switches you back to the automatic keychain unlock.

Can an AI agent or my phone turn this on or off?

No. Turning encryption on or off, and setting or changing a passphrase, is a human-only action on this desktop app. An automated agent, the command-line interface, and a paired phone are all blocked from it, and your key is never shared with any of them.