Zero-Knowledge Focus. High-Integrity Tasks.
The only task manager with a secure Web Worker enclave and an encrypted event lake. Productivity Sidekick keeps your vault invisible to the server while enabling seamless multi-device sync.
Productivity Sidekick
Built for what actually goes wrong
Traditional task managers storing your personal and professional TODOs in plaintext on their database.
Secure Web Worker enclave holds your master key in memory; the server only ever sees encrypted event blobs.
Losing focus or data when switching devices or experiencing intermittent network connectivity.
Offline-first IndexedDB event store with an append-only D1 Event Lake for high-integrity, multi-device sync.
What ships in the box
Secure Web Worker Enclave
Isolates the 600k-iteration PBKDF2 derivation and master key from the main thread heap, mitigating browser-extension and XSS-based key theft.
Encrypted Event Lake
CQRS-based architecture transforms task mutations into encrypted events, enabling deterministic projection rebuilds and conflict-free multi-device sync.
Intelligent Focus Engine
Includes subtask reversion debounce, unsaved-changes guards, and Smart-Runner migrations to ensure a seamless, high-integrity user experience.
Built on enterprise-grade infrastructure
Your master key never leaves the Web Worker. The server sees only encrypted event blobs — it cannot read your tasks, your tags, or even how many tasks you have. Cross-device sync happens via an append-only D1 Event Lake; projection rebuilds run client-side after decryption. Clerk handles auth without ever touching the vault key.
Cloudflare global edge — innate DDoS protection, zero cold-starts.
Clerk (SOC 2 Type II, GDPR) for multi-tenant fleets; PBKDF2 for single-tenant apps.
Cloudflare & Resend (SOC 2 Type II) · Stripe (PCI-DSS Level 1).
From foundation to fleet scale
- Phase 1Shipped
Foundation — The Enclave
- Secure Crypto Worker implementation (AES-GCM / 600k PBKDF2).
- Migration of legacy vaults to worker-isolated key management.
- Request-persistent-storage logic and lock-modal recovery.
- Phase 2Shipped
Local Event Store — CQRS
- IndexedDB event store with aggregate-type sequencing.
- Domain projection replay engine for real-time read models.
- Cross-tab invalidation via BroadcastChannel('ps-events').
- Phase 3In progress
Scale & Sync — The Lake
- Blind D1 Event Lake for append-only encrypted synchronization.
- Decrypt-on-startup event pulling and projection rebuilding.
- Micro-frontend decomposition and legacy crypto removal.
Ready to bring Productivity Sidekick into your stack?
Talk to our team about deployment, custom SLAs, and integration with your existing identity and observability stack.