Backup & disaster recovery policy

Backups are stored encrypted in a separate account and region from production — outside the blast radius of credential compromise or regional failure. Defaults tighten per system when your RPO/RTO targets demand it.

During onboarding we agree RPO (maximum acceptable data loss) and RTO (maximum acceptable downtime) per system, in writing. These numbers drive engineering choices — a 15-minute RPO implies streaming replication; a 24-hour RPO does not — so they are decisions about cost as much as risk, and they are yours to make with our recommendation.

Backups are tested by restoring them — quarterly at minimum, with timing measured against RTO and results in your quarterly report. The drill that fails in rehearsal is the one that would have failed for real; we consider every drill failure found a small disaster prevented.

Restores are powerful — a point-in-time recovery can undo hours of legitimate work along with the mistake — so they are gated deliberately: only named contacts on your side (designated at onboarding, usually 2–3 people) can request one, the request states the target time and scope in writing, and we confirm the blast radius back before executing. For partial restores (one table, one customer’s records) we restore into an isolated environment first and surgically copy back, rather than rolling the world back.