Collabora CODE does not have a setting that encrypts the stored copy of every document at rest. CODE is the online editor in a WOPI integration; the connected file platform or storage service is responsible for saving the document. To protect files after they are saved, configure encryption on that storage layer. If your WOPI host is Nextcloud, its server-side encryption is one option; if your concern is a stolen server disk, use block-device encryption on the host’s storage instead.
That distinction matters because CODE must process document contents while a user edits them. Collabora says documents are removed from memory when sessions end and are not persistently stored on Collabora Online servers, but at-rest encryption does not hide an open document from the editor or from an authorized storage application. The instructions below use Nextcloud as a concrete example; ownCloud, Seafile, and custom WOPI hosts have their own storage-encryption controls.
| Goal | Where to configure it | What it does not solve |
|---|---|---|
| Protect files written to a remote storage provider | Nextcloud server-side encryption or the storage provider’s own encryption, depending on your architecture | Nextcloud’s server-side keys are available to the server; it does not hide an open document from the server. |
| Protect local server disks if hardware is removed | Operating-system disk or block-device encryption, such as LUKS on Linux | Once the system is unlocked and running, authorized processes can read files. |
| Keep the storage provider or server administrator from reading file contents | A supported client-side or end-to-end encryption workflow | Online editing may require decrypted content to reach CODE; verify compatibility with your file platform before choosing this model. |
| Protect traffic between users, the WOPI host, and CODE | HTTPS/TLS on the relevant connections | TLS protects data in transit, not the copy stored on disk. |
Nextcloud’s current administration guidance describes server-side encryption as especially useful for external storage. It encrypts file contents, not filenames or directory structure, and its keys are kept on the Nextcloud server. It is not a substitute for end-to-end encryption when the goal is to prevent a Nextcloud administrator from reading files, and it is not a substitute for disk encryption when the goal is protection against physical theft.
occ.Open a test document through the Nextcloud Files interface and launch it in Collabora. In the typical WOPI setup, Nextcloud is the file host and CODE is the editor. CODE requests the document for editing and sends saved changes back to the host. Configure persistent-storage encryption in Nextcloud or the storage backend, not in a CODE editing menu.
Sign in as a Nextcloud administrator and open the Server-side encryption section of the Administration settings. Select Enable server-side encryption and follow the on-screen confirmation. Menu wording can vary by Nextcloud release. The encryption feature and the encryption module are separate: if the page reports that no module is loaded, continue to the Apps section.
Open Apps, find the Default encryption module (also referred to in the manual as the Nextcloud Default Encryption Module), and enable it. Return to the encryption settings and confirm that the module is selected. Nextcloud’s guide then instructs users to log out and back in to initialize their encryption keys.
Run the status command as the Nextcloud web-server account from the Nextcloud installation directory. On a typical Debian or Ubuntu archive installation, that may look like this:
cd /var/www/nextcloud
sudo -u www-data php occ encryption:statusUse your actual installation path and web-server user. For a container deployment, run occ inside the Nextcloud container using that installation’s documented command. A healthy status reports that encryption is enabled and identifies the default module. This confirms the server-side feature status; it does not by itself prove that every older file has been encrypted.
occ encryption:status output confirms that Nextcloud reports encryption as enabled and names the active default module.By default, Nextcloud encrypts files created or changed after server-side encryption is enabled. If you also need existing files encrypted, first take a fresh backup, plan a maintenance window, and prevent users from changing files during the operation. The Nextcloud command reference documents occ encryption:encrypt-all for encrypting files for all users. Follow the instructions for your installed Nextcloud version, run the command as the web-server account, and wait for it to finish before returning the service to normal use.
sudo -u www-data php occ encryption:encrypt-allDo not use occ encryption:disable as a rollback shortcut. Disabling the flag does not decrypt existing files. Nextcloud documents a separate decrypt-all procedure and warns that disabling encryption without decrypting files can cause unpredictable errors. Test the backup and recovery procedure before changing encryption state in production.
occ encryption:status and confirm the intended module is active.If your Nextcloud instance stores files only on its own local disk and your main concern is a stolen or retired drive, disk encryption at the operating-system layer is usually the more direct control. It encrypts the block device while powered off; after boot and unlock, Nextcloud and CODE can still read documents needed for editing. Configure it during server provisioning or through the operating system’s storage procedure, and retain recovery keys outside the server.
If your requirement is that administrators and storage providers must never see document contents, use a platform-supported end-to-end encryption design and verify its Collabora compatibility before deploying it. A browser editor needs document data available for the editing session, so at-rest encryption on the storage backend alone cannot provide that guarantee while a user is editing. CODE itself does not add a universal document-encryption-at-rest toggle.
Create an Outlook meeting invite, add required or optional attendees, choose a time, add Teams details, set recurrence, and check replies in new or classic Outlook.
Use Excel's Data Validation settings to set a maximum, minimum, exact length, or character range, then add clear prompts and error alerts.
Fix the Outlook “We can’t schedule the meeting” error by checking account support, refreshing Teams sign-in, and repairing the Classic Outlook add-in.
Change Office 365 menus, spelling and grammar settings, or keyboard input in desktop apps and Microsoft 365 for the web.
Learn how to auto-forward all or selected emails in Outlook 365 using Forwarding settings or Rules, plus how to stop forwarding and fix blocked external forwards.
Use Microsoft Editor in Word for Microsoft 365 to check spelling, grammar, clarity, and conciseness, review suggestions, and tune proofing settings.
Learn how to add an RSS feed to Outlook 365 in classic Outlook for Windows, find the correct feed URL, manage subscriptions, and fix common RSS issues.
Jump straight to any page in Word for Microsoft 365 with Ctrl+G or F5, relative page numbers, or the Navigation pane, with Windows and Mac shortcuts.
Learn how to add contacts to Outlook on the web, new Outlook, classic Outlook, and mobile, plus how contact syncing and CSV imports work.
Change a Word page color, add a picture background, remove either, and enable background printing on Windows or Mac with clear, current steps.
