.. /*
    * This file is part of the SavaPage project <https://www.savapage.org>.
    * Copyright (c) 2026 Datraverse B.V.
    * Author: Rijk Ravestein.
    *
    * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. <info@datraverse.com>
    * SPDX-License-Identifier: CC-BY-SA-4.0
    *
    * For more information, please contact Datraverse B.V. at this
    * address: info@datraverse.com
    */

.. _ch-security-encrypted-secrets:

Encrypted Secrets
-----------------

Data in the database will not contain any explicit secret data. All
secret data is stored encrypted with encryption keys held in file
``/opt/savapage/server/data/encryption.properties``. This file is
generated by |PRODUCT_NAME| at initial installation and contains
randomized encryption keys unique for this particular installation
instance. Access to this file is restricted to the ``savapage`` user.

.. important::

   Make a backup of ``encryption.properties`` immediately after
   installation and store it at a secure place, so you can restore it in
   case of a server crash or when you need to
   :ref:`migrate to a new server <app-migrating>`.

.. caution::

   The ``encryption.properties`` file is *crucial* for decrypting secret
   data in the database and verifying the authenticity of 
   :ref:`document signatures <ch-security-document-signature>`. 
   So, if you restore a database backup on a different server, 
   be sure to also restore this file.

The following secret data is stored encrypted in the database:

-  Passwords.

-  PIN codes.

-  Authentication tokens.

-  API keys.