Context
A backup that has never been restored is a hope. Stackra’s data lives in managed Postgres, and silo tenants add databases (0045). The SOC 2 target expects evidence that recovery works. The database host is not finalised, so the mechanism is named by capability, not product.Decision
- Every production database has point-in-time recovery enabled, pool and silo alike.
- Retention window for recovery: TODO, to be set before the first production tenant.
- A restore drill runs every quarter. A production-shaped database is restored to a chosen point into a separate environment, and a smoke check confirms the data is readable.
- Each drill is recorded: date, restore point, time taken, result and who ran it. A failed drill opens an issue before the next one.
- A new silo database is not accepted into the registry until recovery is enabled on it.
Consequences
- A recurring chore with a written result, usable as SOC 2 evidence.
- Restore time becomes a known number instead of a guess.
- Drills cost a database for a few hours each quarter.