Moving teams from Todoist to Vikunja in 2026

Teams migrating from Todoist or TickTick often seek data sovereignty and predictable costs. Todoist stores task data on US servers through Microsoft Azure and Amazon Web Services, which creates compliance hurdles for European teams. Vikunja allows you to host data on local German infrastructure or your own private servers. For a team of 15 people, Todoist Business incurs an annual cost of approximately 1,440 €, while self-hosting Vikunja costs nothing beyond the price of your own server infrastructure. This pricing model prevents the per-user cost spikes seen in Asana. You should use Vikunja if your workflow requires Kanban boards, Gantt charts, or table views. The software provides a responsive web interface for smartphones and community apps for native mobile experiences. You can import tasks from Todoist or Trello without manual CSV exports. Small teams of up to five people might prefer Todoist for its mature natural-language parsing and polished mobile apps. However, agencies tracking client projects or development teams using agile boards find the structured project work in Vikunja more useful. You should evaluate the setup by running it with your team for two weeks.

Technical deployment requirements

Deployment requires a hardened Linux host and a reverse proxy with valid TLS. Most users deploy via Docker Compose, but you must include the Nginx sidecar to fuse the Vue frontend and the Go API into one origin. If you omit the sidecar, the browser cannot see one origin and the application will fail. The stack requires a real domain name so Let’s Encrypt can issue certificates for CalDAV to function on mobile devices. You also need an SMTP relay for password resets and task reminders. Without a configured SMTP relay, password reset emails fail silently. A production setup for an agency-sized team runs on a Hetzner CX22 with 4GB of RAM. The Vikunja stack itself uses only 350MB of RAM in steady state. If you use the SQLite option, the stack uses as little as 50MB of RAM. You must create the MariaDB data directory and the files directory before bringing the stack up to prevent permission errors. You must also set the VIKUNJA_SERVICE_FRONTENDURL variable to your public URL with a trailing slash. If you move the domain later, you must update this variable and restart the API container to avoid breaking email links and CalDAV principals. You must also set the VIKUNJA_SERVICE_TIMEZONE to an IANA name like Europe/Berlin to ensure reminders fire correctly. You should also bump the Nginx client_max_body_size to 20M or higher to handle task attachments. The Docker Compose file mounts three host paths: the MariaDB data directory, the Vikunja files directory, and an Nginx configuration file.

Workflow versatility and API access

Vikunja provides CalDAV integration, which lets you sync due dates to Apple Calendar or Thunderbird. Developers can use the REST API or the MCP server from the 2.7.0 release to connect AI assistants to their task lists. The software supports importing tasks directly from Todoist or Trello. The 2.7.1 patch released on October 20, 2026, fixed 41 security issues following an automated audit. This followed the 2.7.0 release on October 2, 2026, which contained 62 new features and 58 dependency updates. The 2.6.0 release, which arrived a month after 2.7.0, contained 45 new features and fixed 18 security vulnerabilities. A security fix for share links that could act as another user appeared in the 2.5.0 release. The 2.4.0 release, which contained 1,093 commits and 156 dependency updates, included the first Vikunja Pro features and a brand-new version of the API. The 2.3.0 release added a plugin system and OAuth 2.0 provider support. The 2.2.2 release addressed nine security fixes, including a critical chain that could expose instance-wide data. In the 2.1.0 release, the team fixed a security issue where password reset tokens were not cleaned up, which allowed attackers to reuse tokens. The 1.1.0 release fixed an XSS vulnerability in the task glance feature. The 2.0.0 release involved a rebuilding of the session authentication infrastructure after a security report. Will the developers eventually add native time tracking to the free self-hosted version?