Quick answer
Shared plans are end-to-end encrypted. Every row of a plan is encrypted on your iPad, Mac or browser with a key that belongs to that plan, and that key is sealed separately for each person on it. Each Apple device keeps its own key in the Secure Enclave, and in a browser a passkey unlocks your plans. Our servers store and pass on ciphertext they have no key for. Plans you don’t share never leave your device at all.
MPP Studio is coming to Mac and iPad. Get told when it launches
AES-256-GCMfor every row- A key per plan, sealed for each member
- Device key in the Secure Enclave
What’s encrypted, and what isn’t
To be useful, a sharing service has to know who may open what. Everything else in a plan is encrypted.
| Encrypted: unreadable to us | Readable: needed to run the service |
|---|---|
| Plan names, and every task, link, resource, assignment, calendar and baseline | Email addresses, for signing in and invitations |
| The .mpp files you share | Who is on which plan, and with which role |
| History: who did what, and the values before and after | Internal ids of accounts, plans and rows |
| People’s names | Sizes and times: how many rows, and when they changed |
| Presence: who is in a plan and which task they have selected |
That’s the usual line for end-to-end encrypted services. Because we can’t read plan contents, invitation emails don’t name the plan or the person who invited you; the app shows both once you have access.
How the keys work
Four layers, each unlocking the next. Nothing on the server can open the first one.
- Device keyMade inside the Secure Enclave of your iPad or Mac. It never leaves the chip.
P-256 · Secure Enclave - Account keysYours, on every device. The server keeps them only sealed: by each device key, your passkeys and your recovery key.
X25519 + Ed25519 - Plan keyOne per plan, made on the device that shares it, and sealed for each person on the plan.
AES-256 - Plan rowsEvery task, link and resource, encrypted on its own and bound to its place in the plan.
AES-256-GCM
The Secure Enclave
Every iPad and Apple silicon Mac has a Secure Enclave: a separate, isolated part of the chip that Apple uses to protect Face ID, Touch ID and Apple Pay. When you first sign in, MPP Studio asks it to make a device key. The private half is created inside the Secure Enclave and can’t be exported, copied or read, not by other apps and not by MPP Studio. It can only be used, on that device, to unseal your account keys.
So even a full copy of our database isn’t enough to open a single plan.
Passkeys in the browser
A browser has no Secure Enclave of its own, so on the web MPP Studio uses a passkey. Sign in with it, and the same passkey unlocks your plans: the browser derives a secret from the passkey (the WebAuthn PRF extension) that seals your account keys, and that secret never leaves the browser. Passkeys can’t be phished or reused on another site, and they work with current Safari, Chrome and Edge.
Signing out of the web app removes everything from that browser: plans, keys and settings. The next sign-in unlocks again with your passkey.
Signing in isn’t unlocking
Your password gets you into your account. It doesn’t open your plans. Your keys come back to a new device in one of these ways:
- iCloud Keychain: your account keys sync to your other iPads and Macs through iCloud Keychain, which Apple end-to-end encrypts. A new device opens everything without asking.
- A passkey, in the browser.
- Your recovery key, shown once when your keys are made, for you to keep somewhere safe.
A password reset alone never opens a plan, so someone who takes over your email can’t read your programmes. The other side: if you lose every device and your recovery key, your copy can’t be opened by anyone, us included. The other people on a plan still have it and can share it with you again.
Where the data lives
MPP Studio Cloud runs on servers we operate ourselves in the EU, with encrypted backups in the EU. Organisations on Enterprise can have a dedicated server, in the country they choose, and a data processing agreement (DPA) on request. Enterprise
What this means day to day
- Support can’t look at your plan. If you want help with one, share it with support like you would with a colleague.
- AI is opt-in, and the agent’s rules apply. MPP Studio has no AI of its own. The built-in MCP server is off until you turn it on, and then talks straight to the agent you choose, so your organisation can use the AI provider it has approved. Once an agent reads a plan, it handles that data under its own and its provider’s terms, which we can’t control or guarantee. Connecting one is your decision. What that means
- Sign-ups are protected. New accounts from iPad are checked with Apple’s App Attest, and every sign-up is rate limited, to keep bots out without a CAPTCHA.
Questions people ask
Can MPP Studio staff read my plans?
No. Shared plans are encrypted on your devices with keys our servers never have. Support can only see a plan if you share it with them, like with anyone else.
What if I forget my password?
Reset it from the sign-in screen. That gets you back into your account. Your plans are unlocked by your keys, which come from another of your devices through iCloud Keychain, from a passkey in the browser, or from your recovery key.
What if I lose every device and my recovery key?
Then your copy of the encrypted data can’t be opened, by you or by us. The other people on a plan still have it and can share it with you again.
Which browsers support unlocking with a passkey?
Current versions of Safari, Chrome and Edge, which support the WebAuthn PRF extension. In other browsers, unlock with your recovery key.
Do plans that I don’t share leave my device?
No. Plans in Files, iCloud Drive, OneDrive or other folders are read and saved on your device. Only plans you share to MPP Studio Cloud are uploaded, and those are encrypted first.
Found a security issue?
Please tell us first, at support@mppstudio.com. We reply to every report.