Your app data and its onion identity answer different recovery questions. An app backup can restore supported files and data. The Tor identity determines the onion address people use. Restoring the first does not automatically restore or move the second.
Prepare an eligible deployment
Use agent 0.6.19+ with onion-custody-v1 on a deployment owned by your account. The portal, REST API and hosted MCP provide custody operations; local MCP requires 0.41.0+. Export and one-time retrieval require manage. Update existing agents explicitly before relying on new capabilities.
Inventory the current onion address, app deployment and completed data backups. Keep identifiers and recovery instructions together, but store private keys in protected storage rather than public notes or source control.
Export to a recipient key you control
Generate an X25519 recipient key locally. Keep its private half and submit only its public half for the export. Impreza encrypts the identity bundle to that recipient. Losing the recipient private key makes the export unusable.
Use the custody controls in the customer portal over Tor or impreza_export_onion_key, confirm the target and wait for the command to succeed. Hosted MCP adds an argument-bound confirmation. Retrieve the completed encrypted result with impreza_fetch_onion_key_export and save it securely.
Retrieval is one-time. If the response is lost, request a new export; the previous ciphertext cannot be fetched again. Do not treat a command ID by itself as a saved backup.
Verify what you saved
Decrypt the sealed bundle locally using the recipient key. It contains the onion address and both C Tor identity files. Keep both files: the secret file is 96 bytes and the public file is 64 bytes. They are not a concatenated seed and public key.
Use the documented format and cryptographic tooling rather than editing key bytes by hand. Check that the bundle identifies the intended onion service, then protect the decrypted material. Avoid placing private material in an AI prompt or diagnostic transcript. The custody reference defines the sealed format and import fields.
Plan recovery before creating a replacement
Import is a separate deployment operation using both identity files. Pending imports reserve an address, and an address already held by another deployment cannot simply be imported again.
Reservations remain after failure, uninstall or rotation. Contact support before moving an already-used identity to another deployment. Deleting an app does not automatically release the reservation. A timeout does not prove that the previous service stopped; avoid competing instances of the same identity.
After an approved recovery, verify the resulting address, command outcome, app data and visitor access through Tor. Recheck client authorization and protection settings. Keep the original recovery material until the replacement is validated.
Rotation is a different operation
Rotating an identity changes the onion URL and breaks existing links. It is not a way to retain your existing address. Review the exact current address before confirming rotation, and plan how clients will receive the replacement.
For the data side of a move, follow app migration. For visitor restrictions, use Tor client authorization. Keep these operations explicit so a data restore is never mistaken for complete identity recovery.