Powermail Encryption for TYPO3
Automatic encryption of form data in the database — encryption at rest in accordance with Article 32 of the GDPR
Your contact forms collect personal data: first names, email addresses, telephone numbers and the content of enquiries. The standard Powermail plugin stores this data in a MySQL database as plain text — which is readable by anyone with access to the database. Our plugin automatically encrypts every record with each submission, without requiring any changes to the editor’s workflow.
One Composer command. One key in the .env file. The whole thing is up and running in under an hour.
What happens if someone gains access to your database?
Imagine the following scenario: an attacker gains access to a MySQL database — via an SQL injection, a compromised phpMyAdmin password, an attack on the hosting server, or the theft of a backup. Two different outcomes.
No plug – immediate leak
✗ The attacker can see the full personal details: Jan Kowalski, [email protected], 601-234-567
✗ The content of submissions is legible: complaints, enquiries, medical data, financial data ✗ Mandatory reporting of the breach to the UODO within 72 hours
✗ Notification to every individual whose data has been leaked
✗ Risk of a fine of up to €20 million or 4% of annual turnover
✗ Loss of customer trust and damage to the company’s reputation
With a plug – meaningless data
✓ The attacker sees: enc:v1:R3hJbkx5... — a random string of characters
✓ Without the encryption key, the data is unreadable
✓ The loss of encrypted data may not require notification (Recital 87 of the GDPR, EDPB position)
✓ Encryption is a ‘mitigating measure’ — it reduces the severity of the penalty (Article 83(2)(c))
✓ The company’s reputation is protected — ciphertexts were leaked, not the data itself ✓ The DPO has concrete evidence of preventive measures in the documentation
Before and after installation
Without a plug
✗ Data in the MySQL database in plaintext — readable by anyone with access
✗ Database backup = a complete copy of personal data in a readable format
✗ SQL injection = immediate data breach ✗ No encryption at rest = failure to comply with Article 32(1)(a) of the GDPR
✗ Dev/staging environments containing a copy of the production database = data circulating on developers’ laptops
With a plug
✓ Each record is encrypted using the ChaCha20-Poly1305 algorithm (AEAD, RFC 8439)
✓ The database backup contains only ciphertexts — which are meaningless without the key
✓ SQL injection = the attacker sees ‘enc:v1:...’ instead of personal data ✓ Encryption at rest = a strong argument for compliance with Article 32 of the GDPR ✓ Secure dev/staging environments — even with a copy of the database, the data remains encrypted
Who is the Powermail plug-in for?
Enterprise companiesLead generation, quotation forms, complaints, service requests — every contact form collects personal data. The more entries there are in the database, the greater the risk in the event of a data breach. Encryption at rest is the minimum security measure that every DPO should require.
The healthcare sectorPatient registration forms, health questionnaires and treatment programme applications — these constitute sensitive data (Article 9 of the GDPR, special categories of data). The penalties for medical data breaches are the highest. Encryption is not an option — it is an absolute requirement.
The public sector and institutionsPublic authority contact forms, citizen portals and online submissions are subject to the Digital Accessibility Act and the GDPR. The President of the Personal Data Protection Office (UODO) regularly inspects the public sector. Decision DKN.5131.8.2022 (a penalty for failing to encrypt a laptop at a local authority) demonstrates that a lack of encryption poses a real risk.
NGOs and foundationsData relating to beneficiaries, donors and volunteers — often people facing difficult life circumstances. A data breach would not only result in a fine from the UODO, but, above all, would cause harm to real people. Our plugin protects their data at a fraction of the cost of a bespoke solution.
E-commerceCustom order forms (outside the standard shopping basket), product configurators, B2B enquiries — payment and commercial data stored in plain text is a risk that customers are increasingly taking into account when choosing a supplier.
Any company preparing for an auditCustom order forms (outside the standard shopping basket), product configurators, B2B enquiries — payment and commercial data stored in plain text is a risk that customers are increasingly taking into account when choosing a supplier.
How does it work? A three-step process
InstallationA single Composer command installs the plugin in your TYPO3 13+ project. You generate a 256-bit encryption key and place it in the .env file on the server. You clear the TYPO3 cache. That’s it.
Automatic encryptionFrom now on, every new submission via the Powermail form is automatically encrypted in the database. The subject, body text, sender’s name, email address and every reply — everything is converted into an encrypted message in the format enc:v1:... Existing records remain unaffected — the plugin only encrypts new data.
Transparent readingThe editor opens the Powermail module in the backend — the data is clearly legible, as always. They export a CSV file — the data is decrypted. The customer clicks the confirmation link — it works. Emails are sent in plain text. Decryption takes place automatically, in the server’s memory, only whilst the email is being displayed.
The whole thing works via the TYPO3 event system — without modifying the Powermail classes (no XCLASS, no patches). Updating Powermail does not break the encryption.
What exactly do we encrypt?
Table tx_powermail_domain_model_mail
• subject — subject of the report
• body — message content • sender_name — sender’s first name and surname • sender_mail — sender’s email address
Table tx_powermail_domain_model_answer• value — the value of each form submission: first name, telephone number, text, list selection, JSON uploads, dates, checkboxes
Emails sent via Powermail (to the customer and to the company) remain in plain text — encryption applies only to the copies stored in the database (encryption at rest).
Technical Specifications
Cryptography
• Algorithm: ChaCha20-Poly1305 (IETF, RFC 8439) — authenticated AEAD encryption • Key: 256-bit, base64, stored in .env (POWERMAIL_ENC_KEY)
• Nonce: 96-bit, randomised for each write (random_bytes) — even identical data produces different ciphertexts
• Integrity: Poly1305 tag — detects any modification to the ciphertext (Article 5(1)(f) of the GDPR)
• Implementation: native PHP libsodium (PHP 7.2+, no external dependencies)
• Storage format: enc:v1:<base64 ciphertext> </base64>
Why ChaCha20-Poly1305
• The same algorithm as Google Chrome (TLS 1.3), Cloudflare, WireGuard and Signal
• Faster than AES-GCM on servers without hardware-accelerated AES-NI (common VPS and Docker containers)
• More resistant to timing side-channel attacks than AES
• No catastrophic nonce-reuse issue (unlike AES-GCM)
• Recommended by the PHP core team as the default algorithm in libsodium
Architecture
• Integration via the TYPO3 event system only — no XCLASS, no patches, no forks
• Powermail updates require no plugin modifications • Automatic encryption on write, automatic decryption on read
• Covers: Backend, CSV/XLSX export, confirmation links, finishers, custom Extbase code • Gradual migration — the ‘enc:v1:’ prefix allows encrypted and unencrypted records to coexist • Prepared for key rotation — the version prefix (v1, v2...) allows for a seamless change of algorithm in the future
System requirements
•TYPO3 CMS 13 or later
• Powermail (version compatible with TYPO3 13+)
• PHP 7.2+ with the libsodium extension (available by default)
• Access to the .env file on the production server
What is changing in an editor’s day-to-day work?
Nothing. Absolutely nothing. The Powermail module in the Backend displays data as before. CSV and XLSX exports contain legible data. Emails are sent in plain text. Confirmation links work. Powermail finishers work.
The only visible change: anyone viewing the table directly in phpMyAdmin, Adminer or another SQL client will see ‘enc:v1:R3hJbkx5...’ instead of readable values. And that is precisely the point — the database is not an editorial interface. Personal data should not be stored there in plaintext.
Guarantees
✓ Full source code — no obfuscation, no minification, no licence server. Your encryption will still work even if our company ceases to exist.
✓ The encryption key is held solely by you — we have no access to it, we do not store a copy, and we do not send it to any external service.
✓ No ‘phone-home’ — the plugin does not communicate with our servers. Everything runs locally on your infrastructure.
✓ Upgrade-safe — the plugin operates via the TYPO3 event system, without XCLASS. Updating Powermail requires no intervention from us.
✓Future migration — the version prefix (enc:v1:) prepares the system for key rotation and algorithm changes without data loss.
Price and availability
Powermail Encryption is available for TYPO3 12, 13 and 14 for a one-off fee of 499 EUR. Once you have purchased it, you will gain access to a private repository and can integrate and configure the plugin yourself.
Compliance with the GDPR
• Article 32(1)(a) — encryption of personal data as a technical security measure
• Article 5(1)(f) — protection of data integrity (the Poly1305 tag detects any modification)
• Article 25(1) — data protection by design and data protection by default
• Article 83(2)(c) — encryption as a ‘mitigating factor’ reducing the severity of the penalty
• Key in .env — never in the database, never in the code repository, never in logs
• No data transmission to external sources — the entire system operates locally
For GDPR auditors and Data Protection Officers (DPOs), we prepare technical documentation describing the algorithm used, the key model, the scope of encrypted data and the solution’s architecture — ready for inclusion in the record of processing activities and the risk assessment.
Frequently Asked Questions
No. ChaCha20-Poly1305 adds less than 1 millisecond to each write and read operation. With a typical form, the user won’t notice any difference. Even bulk exports of thousands of records run smoothly.
Without the key, the data cannot be recovered — this is a fundamental feature of strong encryption. We therefore recommend keeping an offline backup of the key: a printed copy stored in a safe, separate from your database backups. On the Business and Enterprise plans, we help you set up a key management procedure.
Yes. The Business plan includes a one-off migration of historical data as part of the price. In the Solo plan, we offer this as a separate service. The ‘enc:v1:’ prefix allows encrypted and unencrypted records to coexist — the migration can be carried out in stages.
Yes. The plugin encrypts data from all Powermail forms across the entire TYPO3 installation. It does not require configuration on a per-form basis — it works globally once installed.
The current version of the plugin is designed for Powermail. If you require encryption for EXT:form or another extension, please contact us. As part of our Enterprise plan, we offer support for other tables and TYPO3 extensions.
The GDPR does not define a single sufficient measure — it requires a holistic approach. However, encryption at rest using a state-of-the-art AEAD algorithm is one of the strongest arguments in a risk analysis. When determining the level of a fine, the UODO takes into account measures to minimise harm. What is more, the loss of encrypted data may not require a data breach notification at all — this is a tangible benefit for your DPO.
Yes — during the online consultation, we’ll demonstrate how the plugin works in a test environment: the form, data saving, the backend view, and the view in phpMyAdmin (database query). Book a demo via the contact form or by phone.
The licence is valid for one year. We’ll send you a reminder before the end of the term. Once you’ve renewed, you’ll have access to new versions and support for a further 12 months. If you do not renew, the plugin will continue to work (encryption will not stop working), but you will lose access to updates and support.
Why us?
Dr Blitz-Weblab is a TYPO3 Silver Member with 8 years’ experience, specialising exclusively in TYPO3. We serve enterprise clients, public institutions, the healthcare sector and NGOs in Poland, Germany and Austria. We know TYPO3, Powermail, Extbase and the GDPR inside out.
Our clients include: Universitätsmedizin Mannheim (medical portal, 25,000+ subpages), the German Historical Institute in Warsaw (research institution), RED NOSES International (international NGO), and the Nadzieja w Nas Foundation (integration with Tpay). Each of these clients processes personal data via TYPO3 forms — we know how to secure this.
This plugin is not an academic experiment. It was developed in response to a real need from our clients and is currently in production.