IPFS Hot Retrieval with Arweave Permanence

Serve the same AES-256-GCM ciphertext from self-hosted kubo for fast reads while Arweave remains the permanent record.

Self-hosted kubo serves the working set in milliseconds with the same AES-256-GCM ciphertext as Arweave. Gateway and replica fallbacks stay available.

Self-hosted kubo serves the working set in milliseconds — same ciphertext as Arweave.

When ipfs-kubo is the primary or a replicate target, Evercore pins the encrypted payload at upload time. Content-addressed CIDs power sub-second reads; kubo gateway and public IPFS fallbacks cover cold paths without weakening the Arweave permanence guarantee.

Value

Sub-second working-set reads

Hot files resolve from your kubo node instead of waiting on public Arweave gateway round-trips.

Transactional pinning

pinContent runs in the upload pipeline — CIDs map to registerTx rows and optional Arweave replicas.

Locator-aware reconcile

POST /files/reconcile/:locator short-circuits to confirmed for CIDs while Arweave txs still poll gateways.

Use cases

Document viewers

Customer portals and internal viewers that cannot tolerate multi-second Arweave gateway latency.

Active matter workspaces

Legal and finance teams reviewing large working sets where only recent files need sub-second access.

Scenario C deployments

primary ipfs-kubo + replicate arweave + anchor hedera — CID for UX, txId for permanence, HCS for audit.

Security guarantees

No second source of truth

The kubo node only ever serves bytes that match the registered locator and encrypted payload hash.

Operational control

Self-host kubo or use Evercore-managed infrastructure with the same ContentPolicy surface.

Graceful cold fallback

Gateway and Arweave replica paths remain available if the hot node is unreachable.

For operators

  • Set primary: ipfs-kubo with replicate: ["arweave"] for the enterprise hot + permanence pattern.
  • mfsLinkContent surfaces pins under /evercore/<tenant>/ in the kubo Files tab.
  • Download routes by locator shape — 43-char txId vs Qm/baf* CID without client flags.

For buyers

  • Fix viewer latency without abandoning permanence or encryption semantics.
  • Keep data sovereignty on a kubo node you operate or on Evercore-managed kubo.
  • Enable IPFS only on Professional+ tiers where plan-gate allows ipfsHotStorageEnabled.

Is IPFS storing plaintext?

No. The node pins the same AES-256-GCM ciphertext written to Arweave. Keys never leave your trust boundary.

What happens if kubo is down?

Download flows fall back to a public IPFS gateway, then to the Arweave replica locator if policy.replicate includes arweave.

How does reconcile work for CIDs?

POST /files/reconcile/:locator returns confirmed immediately for ipfs-kubo — pins are durable the moment kubo accepts them.