diff --git a/docs/ipam.md b/docs/ipam.md
index d8fcb1e3..e11954a5 100644
--- a/docs/ipam.md
+++ b/docs/ipam.md
@@ -210,11 +210,3 @@ reached the peer that does the `rmpeer`, then we get an inconsistent
 ring.  We could make it safe, up to partitions, by inquiring of every
 live peer what its view of the dead peer is, and making sure we use
 the latest info.)
-
-## Limitations
-
-Nothing is persisted. If one peer restarts it should receive gossip
-from other peers showing what it used to own, and in that case it can
-recover quite well. If, however, there are no peers left alive, or
-this peer cannot establish network communication with those that are,
-then it cannot recover.
diff --git a/site/ipam.md b/site/ipam.md
index 49884fc9..d0414e55 100644
--- a/site/ipam.md
+++ b/site/ipam.md
@@ -175,6 +175,18 @@ the rest (a partition), they can continue to work with the address
 ranges they had before isolation, and can subsequently be re-connected
 to the rest of the network without any conflicts arising.
 
+### <a name="persistence"></a>Data persistence
+
+Key IPAM data is saved to disk, so that it is immediately available
+when the peer restarts:
+
+* The division of the IP allocation range amongst peers
+* Allocation of addresses to containers on the local peer
+
+A [data volume
+container](https://docs.docker.com/engine/userguide/containers/dockervolumes/#creating-and-mounting-a-data-volume-container)
+named `weavedb` is used to store this data.
+
  **See Also**
 
  * [Automatic Allocation Across Multiple Subnets](/site/ipam/allocation-multi-ipam.md)