Encryption turns the contents of one workspace into unreadable noise on disk. VanX seals each item with AES-256-GCM before writing it, using a key derived on this Mac that is never transmitted anywhere. Someone who copies your database file onto another machine gets nothing out of it.
It protects the file at rest — not your screen. While VanX is running and your keys are available, an encrypted workspace looks and behaves like any other. Encryption is what stands between your clipboard history and anyone who reaches the raw database: a stolen laptop, a synced backup folder, a forensic disk image.
Why it can only be switched on for an empty workspace
Encryption applies to items as they are written. It has no migration pass that walks back over items already saved, and adding one would be a lie of a different kind — for the minutes it ran, the workspace would report itself encrypted while most of its content still sat in plaintext, and a crash halfway through would leave it permanently mixed. So VanX refuses the switch on a workspace that already holds items. To protect existing content: create a new workspace, encrypt it while it is empty, then move the items across.
Why it can never be switched off
Every item written into an encrypted workspace was written under a promise. A switch that revokes that promise — one click, no key, no ceremony — means the promise was never worth much. So there is no decrypt button, no hidden command, and no support process that will do it for you. If you need this content unencrypted, move it to an unencrypted workspace; the items you move are rewritten there in the clear, and you make that choice item by item, deliberately.
What changes day to day
Search in an encrypted workspace gets slower and less clever: scrambled text cannot be indexed, so full-text and meaning-based search are switched off there and VanX falls back to matching plain words after decrypting in memory. Plaintext JSON and CSV exports leave the workspace out by default rather than writing your protected content back to disk unprotected — export an encrypted .vanxenc archive instead. Encrypted workspaces also never mirror their clips into your personal workspace.
Encryption is not the same as excluding from exports
The second switch on the Security pane, "Include in portable exports", is unrelated to workspace encryption and fully reversible. It controls JSON and CSV exports and encrypted .vanxenc archives only; it never deletes or encrypts content. VanX's encrypted on-device recovery snapshots are separate and always preserve the complete library database, including this workspace.