Keep the keys safe

Save the exact system passphrase and every file and group key before using them. Include the APPX system, customer registration, database, application, file or group name, effective date, and key version in the record. Treat capitalization, punctuation, and every character as significant.

An organization-managed password manager such as 1Password Business is a reasonable place for these records. Use a restricted vault, individual accounts, and multifactor authentication. Give access to the people responsible for restoration, with enough coverage that one person's absence does not prevent recovery. See 1Password's vault access instructions.

Keep an independent recovery route for the password manager itself. Store the appropriate Emergency Kit or other approved recovery material securely outside the APPX server, and arrange account recovery before it is needed. Test that the designated administrators can regain access. See 1Password's organization recovery plan.

Use generated, unpredictable values that fit the APPX entry fields. Generated printable ASCII values are convenient when keys must be entered on systems with different keyboard layouts. APPX's Random Key button is also available. Save its result in the vault before leaving the screen.

Keep key records out of email, support tickets, screenshots, shell commands, scripts, and ordinary document folders. Retain old key versions for as long as a backup may require them. Keep a protected backup of System Administration as well as the application data. A backup of only the encrypted datafiles is not the complete restoration kit.

Do not change an existing system passphrase to try an exercise. It applies to the APPX system, including encrypted files in other databases. Use an isolated test system or retain the system's existing passphrase and follow its established key procedures.