Encrypted scripts

The server can read standard cloud scripts to make review links and Word exports. For encrypted scripts, your device encrypts the content before upload. Devices with the key share the script key with collaborators. The server does not receive a readable key.

You can enable encryption for individual scripts.

Pages, comments, breakdown tags, and schedules inside the encrypted document are unreadable to the server. The server can read this information:

• the script's title, logline and title-page fields
• who is on the production and their roles
• when it was edited and how large it is
• the labels and dates of saved versions
• who you @mention

To keep scripts off our servers, use Local Mode. Encrypted scripts can sync and support collaboration.

Some older scripts have production records stored separately from their encrypted documents. These records remain stored to prevent data loss, but plaintext production views do not expose them.

1. Open Account → Encrypted scripts → Set up.
2. Enter your current password.
3. Save the recovery key. Setup shows this key only once.

Your device creates your account keys during setup. Your password can unlock a new device. After a password reset, use your recovery key.

Keep the recovery key in a safe location. Account recovery codes cannot replace it. We cannot recover the key for you.

Encryption disables some features and deletes readable automatic captures. Before you enable encryption, examine the access list and feature changes. As the workspace owner, select Script → Encrypt script. To create an encrypted script, select New encrypted script in the command palette.

Your device encrypts the script and named versions before upload. Encryption deletes existing automatic hourly captures because they contain readable data.

Encryption remains off if older production records are absent from the document that your device will encrypt. Your records stay unchanged, and you can continue editing without encryption.

An AV script cannot be encrypted because the server must read the script to create its PDF.

Open full size

Writers, editors, admins, and owners can open encrypted scripts after setting up encryption. To share the script key, open the script while the collaborator is waiting. Key sharing happens automatically.

Producers, readers, and guests cannot open encrypted scripts. The server has no readable copy to show them.

Removal of a collaborator stops future updates. It cannot remove a copy or key on their device. Encryption prevents server access to script content.

• Review links. The server cannot render the script for guests. Turning encryption on revokes existing links.
• Word export. The server must read the script. PDF, Final Draft, and Fountain exports work on your device.
• Drafts view. The server must read scene data. Version history, comparison with the current draft, and restore stay available.
• Call-sheet PDFs. Print the call sheet from its page.
• Budget PDF, guest link, API, and archive CSV. The server cannot read an encrypted budget. The Budget page, print, CSV, and .xlsx export work on your device.
• The note in @mention emails. Emails identify who mentioned you and where, but leave out the comment text.

Your device can import and export PDF, Final Draft, and Fountain files. Reports, sides, revisions, locked pages, comments, breakdowns, schedules, shots, budgets, beat boards, and table read stay available.

On a new device or after sign-out, use your password to unlock encrypted scripts. After a password reset, use your recovery key once. Your new password then protects the key for subsequent access.

If your password cannot unlock encryption, use your recovery key or an unlocked device. Without any of these, you cannot recover encrypted scripts. We cannot restore them. If your password can unlock encryption, generate a replacement recovery key in Account.

Disabling encryption uploads a readable copy to the server. Server features and role-based access become available again. To disable encryption as the owner, use the Script menu or Script settings.

Each account has a key pair. Each script has a different key for permitted collaborators. Your device encrypts changes and saved versions before upload.

Script keys are shared with a hybrid key exchange: ML-KEM-768 together with P-256. New accounts get hybrid keys automatically.

An existing account can upgrade in Account ▸ Encrypted scripts. Enter your password and click “Upgrade keys”. The upgrade gives you a new recovery key. The old recovery key stops working. Your fingerprint changes, and collaborators confirm it once.

After the upgrade, your scripts get new hybrid key shares when a person who can share them opens them. No action is necessary.