Operations, Security & Reliability
Backup, Restore, and Recovery Objectives
A backup strategy starts from business-defined recovery point and recovery time objectives, maps them to independent copies and restore procedures, and proves through drills that a recovered service is consistent, usable, secure, and recent enough.
- RPO limits tolerable data loss; RTO limits tolerable service disruption.
- Backup types solve different restore problems.
- A replica is not an independent backup.
- Retention must cover discovery delay and dependencies.
- Checksums prove bytes, not business usability.
- Restore drills produce the only credible RTO evidence.
| Workflow / failure | Impact and objective | Protection | Restore evidence |
|---|---|---|---|
| Order intake / accidental delete | RPO ≤ 5 min; RTO ≤ 60 min | daily physical base + continuous log archive; force/archive partially filled logs within a tested bound below 5 min, alert before the bound is consumed, and retain an immutable copy | restore to before delete; verify archived-log age/continuity and reconcile operation IDs |
| Reporting / bad deployment | RPO 24 h acceptable; RTO 4 h | nightly logical export + schema/version manifest | load clean instance; row/count and report checks |
| Region loss | business-set RPO/RTO | independent regional copy, keys/config/catalog | isolated regional exercise including DNS/clients |
| Credential/key compromise | contain immediately; recovery may need clean-room rebuild | separate backup and key administration | prove revoked identity cannot read restored system |
[ ] requested recovery target is present and unambiguous
[ ] backup pieces, manifests, checksums, and keys verified
[ ] engine starts without ignored recovery errors
[ ] schema/version and required extensions/configuration match
[ ] constraints and representative business invariants pass
[ ] newest durable operation IDs/timestamps establish achieved RPO
[ ] runtime roles, RLS, encryption, and audit export work
[ ] application smoke/read/write checks pass
[ ] elapsed time and every manual dependency recorded