# IQON DB archive encrypted storage

Purpose: record durable encrypted storage of the verified IQON database archive without storing raw credentials or SQL dumps in git.

Created: 2026-05-20
Updated: 2026-05-20

## Status

`VERIFIED`: the database archive was encrypted, decryption was tested through `gzip -t`, the encryption key was stored in Vaultwarden, and plaintext temporary files were removed.

## Encrypted artifact

| Field | Value |
|---|---|
| Path | `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc` |
| Mode | `600` |
| Size | approximately `468K` |
| Algorithm | `openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000` |
| Source DB | `u0012812_iqon` |

## Vaultwarden key item

| Field | Value |
|---|---|
| Item name | `IQON DB archive encryption key - 20260520-231601` |
| Folder | `Client Infrastructure` |
| Stored secret | encryption passphrase |

## Checksums

| Artifact | SHA-256 |
|---|---|
| Source gzip before plaintext cleanup | `65625e331661df6fc1cff220f10e634b0afd8967aba2387764c0e9ea0698be56` |
| Encrypted artifact | `8f1244a5f9b4e9fb2c5d0491c6f92affbf12125437a67560af6ab774efd61083` |

## Verification

1. Source gzip passed `gzip -t` before encryption.
2. Encrypted artifact was created with PBKDF2 and AES-256-CBC.
3. Decryption was piped directly to `gzip -t` without writing plaintext SQL.
4. Vaultwarden key item was created successfully.
5. Temporary plaintext passphrase file was removed.
6. Temporary plaintext DB dump in `/private/tmp` was removed.
7. Encrypted artifact remains present at the durable local path.

## Safety

No database dump or password is stored in the git repository. This report contains only paths, metadata, and checksums.