Securing client files when everything is Markdown on your computer
Obsidian does not encrypt your vault: each note is a plain Markdown file that anyone who can open your session, or read a stolen disk, can read. Turn on disk encryption (FileVault on a Mac, BitLocker or device encryption on Windows), keep client passwords in a password manager, and leave identity documents and card numbers out of the vault.
What does Obsidian protect, and what is left to you?
ObsidianA free note-taking app for Windows, Mac, Linux, iPhone and Android. Your notes stay as Markdown files on your own computer. Brievora is a vault, a folder of notes and views that you open in Obsidian.obsidian.md encrypts what it sends over the network and leaves the files on your disk as they are. Its help page on Sync security says it plainly: “Obsidian doesn’t encrypt your local vaultIn Obsidian, a vault is a folder on your computer that Obsidian opens: your notes, their attachments and your settings. Brievora is a ready-made vault.help.obsidian.md.” Obsidian Sync encrypts the remote copy with AES-256, and with end-to-end encryption only your password can unlock it. The copy on your laptop stays a folder of text files.
Plain files stay readable for years, since any text editor opens them. Any program running under your account can read them too, and so can anyone who gets your unlocked laptop or pulls the disk out of a lost one. A client brief, the notes from a kickoff call, the amount of every invoice: all readable in Notepad.
Plugins are the second point. Obsidian’s page on plugin security states that community plugins can access files on your computer, connect to the internet and install additional programs, and that Obsidian cannot limit them to specific permissions. Restricted mode, on by default, blocks them until you turn it off. Install only the plugins you need, from authors you trust, and remove the ones you stopped using.
How do you turn on disk encryption on a Mac or a Windows PC?
Turn it on in the system settings: it takes a few minutes and covers the vault, your downloads and your email at once. Without the password or the recovery key, the disk of a lost laptop is unreadable. The table sums up the official pages from Apple and Microsoft (checked in October 2026).
| Mac | Windows Home | Windows Pro | |
|---|---|---|---|
| Feature | FileVault | Device encryption, on supported hardware | BitLocker, or device encryption |
| Where to turn it on | System Settings › Privacy & Security › FileVault | Settings › Privacy & security › Device encryption | Type BitLocker in Start search, then select Manage BitLocker |
| Recovery key | Your iCloud account can unlock the disk, or you create a recovery key and store it yourself | Attached to your Microsoft account, if you sign in with one | Saved where you choose when you turn it on |
| If you lose password and key | Apple: your files and settings “will be lost forever” | Microsoft support cannot recreate the key; a reset removes all files | Same as Windows Home |
On a Mac with Apple silicon or a T2 chip, the data is already encrypted, and FileVault adds the requirement to type your login password before it can be read. On Windows, device encryption does not turn on by itself if you use a local account: check the setting rather than assuming. Personal accounts find their BitLocker key at aka.ms/myrecoverykey.
What should never go into the vault?
Keep secrets and other people’s personal data out of the vault, and keep your notes about the work in it. A vault is built to be searched, synced and backed up, which is exactly what you do not want for a hosting password or a client’s customer list. This table is our working rule, to adapt to your contracts.
| Data | In the vault? | Where it goes instead |
|---|---|---|
| Briefs, meeting notes, decisions, feedback | Yes | - |
| Client contacts and billing details shown on invoices | Yes | - |
| Hosting, domain, CMS and email logins | No | A password manager, with the item name noted in the project |
| API keys, tokens, recovery codes | No | A password manager, or the client’s own secrets tool |
| Identity documents, card numbers | No | Nowhere on your side: ask the client to pay or verify through the payment provider |
| Data about the client’s customers or patients (exports, test databases) | No | The client’s systems, or anonymized samples you delete after use |
| Signed contracts with personal details | Your call | A folder outside the synced vault if your sync service is not end-to-end encrypted |
A project note can still say where the access lives. “Hosting: see the password manager, item Bakery hosting, received 5 Nov., revoke at handoff” gives you everything except the secret. If you plan to paste notes into an AI assistant, what to share from your vault with AI tools goes through that question note by note.
What do you do when a client sends a password?
Ask for your own account first, and store any shared password in a password manager the same day. A personal account on the client’s CMS or hosting panel can be removed at the end of the project without the client changing their password, and their logs show what you did.
- Ask for an invitation with your own email address rather than the owner’s login.
- If a password arrives by email or chat anyway, move it to your password manager and delete the message where you can.
- Turn on two-factor authentication on the accounts you use for the client, when the service offers it.
- Note in the project which accesses you hold, never the passwords themselves.
- At handoff, give the accesses back and ask the client to remove your account. The client handoff checklist has a line for each.
What else protects a vault on a laptop that travels?
Disk encryption protects a laptop that is switched off. Once your session is open, the files are readable, so the rest depends on the lock screen and on habits.
- Lock the screen automatically after a few minutes, and by hand when you leave the table.
- Put a passcode on the phone that opens the vault, and protect the sync account with a strong password and two-factor authentication. The guide to starting with Obsidian compares the sync options.
- Encrypt your backups too. Time Machine offers it when you choose a backup disk; an unencrypted external drive undoes the work done on the laptop.
- Keep the system and Obsidian up to date.
If you work with clients in the European Union, the GDPR lists encryption among the security measures expected of anyone who handles personal data (Article 32). This article is not legal advice: your contracts and your local rules decide what applies to you.
Questions
Can I password-protect a single note in Obsidian?
Obsidian has no core feature for that. Community plugins exist, but they add code with access to your files, so a password manager is the safer place for anything secret.
Is my vault encrypted if I use Obsidian Sync?
The copy on Obsidian’s servers is, and with end-to-end encryption only your password unlocks it. The copies on your computer and phone are plain files, protected only by the device’s own encryption.
My recent Mac is encrypted by default. Do I still need FileVault?
Yes. Apple describes FileVault as an extra layer of security that requires your login password before the encrypted data can be read. Without it, that password is not required to access the data.