diff --git a/reports/remote-backup-retention-check-2026-05-20.md b/reports/remote-backup-retention-check-2026-05-20.md
new file mode 100644
index 0000000..936956b
--- /dev/null
+++ b/reports/remote-backup-retention-check-2026-05-20.md
@@ -0,0 +1,51 @@
+# IQON remote backup retention check
+
+Purpose: record the read-only remote backup directory check after creating the encrypted local DB archive.
+
+Created: 2026-05-20
+Updated: 2026-05-20
+
+## Status
+
+`VERIFIED`: live site health still passes and the remote backup directory contains one IQON DB archive.
+
+## Live health
+
+1. `scripts/iqon-phase1-verify.sh https://iqon.com` passed.
+2. `https://www.iqon.com/` still contains new-design markers: `theme-color`, `topbar`, `hero-cloud`.
+3. Git worktree was clean before this report was created.
+
+## Remote backup directory
+
+Read-only listing showed one file:
+
+```text
+/var/www/u0012812/data/backups/iqon-u0012812_iqon-20260520-231601.sql.gz
+```
+
+Observed size: approximately `469K`.
+
+## Interpretation
+
+1. Failed tiny dump attempts are no longer present in the matched `iqon-*.sql.gz` listing.
+2. A valid plaintext DB archive remains on the remote shared hosting account.
+3. A durable encrypted local artifact already exists at `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc`.
+4. The encryption key is stored in Vaultwarden item `IQON DB archive encryption key - 20260520-231601`.
+
+## Decision needed
+
+Deleting the remote plaintext DB archive is destructive. Do it only after explicit approval.
+
+Recommended if minimizing secret exposure on shared hosting:
+
+```bash
+rm /var/www/u0012812/data/backups/iqon-u0012812_iqon-20260520-231601.sql.gz
+```
+
+Expected post-delete verification:
+
+```bash
+ls -lh ~/backups/iqon-*.sql.gz 2>/dev/null || true
+```
+
+Expected signal: no plaintext IQON DB archive remains on the remote host.