Backup and restore
Backup and restore policy
Operational backup expectations, restore drill requirements, and evidence buyers should request before go-live.
Last reviewed: 2026-09-24. Final contractual commitments must be reviewed before signature.
Production baseline
Production should use managed PostgreSQL with automated backups, SSL-required connections, and clear ownership for restore operations.
- Use managed PostgreSQL rather than a developer database for production.
- Enable automated backups and confirm retention in the cloud provider console.
- Store database credentials only in backend environment secrets.
Restore drill
A backup promise is not enough. Restore into a test database and prove the application can read the restored data safely. The last production drill (2026-09-13) brought a throwaway fork of the production database online and counted in 284 seconds.
- Restore to an isolated test database.
- Run migrations/current-head checks and critical tenant login checks.
- Smoke test invoice, inventory, sales order, user, and audit surfaces.
Customer commitments
Deletion on written request after termination (30 days) and backup expiry (a further 7 days) are set out in clause 3.6 of the published DPA. RPO and RTO targets, where a buyer needs them, belong in the signed agreement.
- State target RPO/RTO per plan or enterprise agreement.
- Document cancellation export window and deletion process.
- Keep restore evidence updated after infrastructure changes.
Buyer checks
Questions this document should help answer.
When was the last restore drill run?
Which database and object-storage backups are enabled?
Who can trigger a restore and who approves it?
What happens to customer data after cancellation?