A backup is only real once you have restored it. This policy describes what we back up for managed clients, where the copies live, how we test them, and how to ask for a restore.
What we back up
- Databases — a full logical dump every night, plus continuous transaction-log archiving where the database supports it.
- Uploaded files and object storage — versioned snapshots, so a deleted or overwritten file can be recovered.
- Configuration — infrastructure code lives in your repository; server configuration is snapshotted nightly.
- Secrets — environment files and keys, encrypted with a key that is stored separately from the backups themselves.
Three copies, two providers, one off-site
Every backup exists in three places: the production system, a primary backup copy and an off-site copy. The copies are held by two different storage providers, so a single provider’s outage, billing dispute or account lock cannot take all of them at once. All copies stay within the EU.
Schedule and retention
| Copy | Frequency | Kept for |
|---|---|---|
| Point-in-time | Continuous, where supported | 7 days |
| Daily | Every night, 02:00–04:00 CET | 14 days |
| Weekly | Sunday night | 8 weeks |
| Monthly | First Sunday of the month | 12 months |
Sanity checks
Every new backup is checked before it can replace an older one: the archive must be readable, and its size is compared with the previous copy. A copy that is suspiciously smaller is kept and flagged, but never rotates a good copy out. A failed check is a critical alert — see Monitoring alerts explained.
Restore drills
Once a month, automatically, the latest backup is restored into an isolated scratch environment. We compare row counts and checksums with production, record how long the restore took, and destroy the environment. Results appear in your monthly report. Once a year we run a full recovery exercise together with your team.
Recovery targets
| Target | Standard | Extended |
|---|---|---|
| Maximum data loss (RPO) | 24 hours | 15 minutes |
| Time to restore service (RTO) | 8 business hours | 2 hours, 24/7 |
Your agreement states which tier applies. Extended requires point-in-time recovery and the on-call add-on.
Requesting a restore
Write to your engineer with what should be restored, to which point in time, and where to. Unless you ask otherwise, we restore side by side first — into a separate database or folder — so you can check the result before anything in production is overwritten.
Erasure requests. Deleting data in production doesn’t remove it from backups until retention expires. If you need personal data removed from backups too, for example to answer a GDPR erasure request, tell us and we will document how it is handled.