Business continuity & disaster recovery
Recovery objectives, backup rotation, and the resilience testing that keeps both honest. Assembled from the substrate’s own continuous-portability doctrine — if the export path breaks, the deploy fails.
Recovery objectives
| Tier | RPO (max data loss) | RTO (max downtime) |
|---|---|---|
| Team | 15 minutes | 4 hours |
| Enterprise | 5 minutes | 1 hour |
RPO = Recovery Point Objective — the maximum acceptable time between the last usable backup and an incident. RTO = Recovery Time Objective — the maximum acceptable time between incident declaration and service restoration.
Backup rotation
- Continuous WAL streaming to a second-region replica. Standby replica lags the primary by seconds under normal load.
- Hourly logical snapshots retained for 7 days.
- Daily full backups retained for 30 days.
- Weekly full backups retained for 12 months, cold-stored in a separate cloud region.
- Every backup is signed at rest; the signature is part of the audit chain, so a tampered backup fails verification before it’s ever restored.
Failover procedure
The substrate’s failover is automated, not manual. Cross-region failover triggers automatically when the primary region fails five consecutive health checks over sixty seconds. Manual override exists for the on-call rotation but is not the first line of response.
Resilience testing cadence
- Monthly — automated failover drill against a scoped test tenant. If the drill fails, the on-call is paged.
- Quarterly — full-region failover under load. Operator-visible during the drill; announced 14 days ahead.
- Continuous — portability export runs on every production deploy. The export bundle IS the disaster-recovery artefact an operator can hold themselves.
The portability export is the strongest disaster-recovery primitive the platform provides. An operator with a recent export bundle holds every row, every audit entry, and every attachment scoped to their operator identity in a format that verifies independently of Nebbos infrastructure. Operators may execute an export at any time. See Portability & export.
What’s outside the plan
- Force-majeure events affecting the underlying cloud provider across multiple regions simultaneously. RTOs above assume a single-region incident.
- Operator-side identity provider outages. If the operator’s IdP is down, sessions cannot refresh; the platform’s data plane continues serving reads on existing sessions.
- Cradle-side outages. Cradles operate offline for reads; a Cradle unavailability does not trigger the substrate’s DR plan.
Documentation
- BCP full document is available under NDA at enterprise@nebbos.ai.
- Quarterly drill reports available to enterprise operators on request.
- Postmortems for all Sev-1 incidents published within 7 days at status.nebbos.ai .