# Backup and Restore

> Status: **design/runbook**. The stack is not deployed yet; no restore has been
> performed. Do not treat these targets as verified until a drill passes.

## Scope and targets (proposed)

| Item | Method | Retention | RPO target |
| --- | --- | --- | --- |
| PostgreSQL | Provider-native PITR if available; else nightly `pg_dump -Fc`, encrypted at rest | 30 days | ≤ 24 h |
| Object storage (statement files) | Provider versioning/replication of the bucket | 30 days | ≤ 24 h |
| KEK / secrets | Secret-manager backup per provider policy | indefinite | ~0 (loss = data loss) |
| Redis | none — cache/queue only, rebuilt on restore | — | acceptable loss |
| Container images | registry retained per release tag | last 10 releases | — |

Statement files are envelope-encrypted (ADR 0004): restoring PostgreSQL without
the matching DEK rows **and** the KEK makes files permanently undecryptable. KEK
backup is therefore mandatory and must be tested like a restore.

## Restore procedure (draft)

1. Provision replacement PostgreSQL/Redis/S3 endpoints in the RF region.
2. Restore the latest PostgreSQL backup into the new instance; run `alembic upgrade head` to confirm schema state matches the deployed image.
3. Restore the object bucket from versioning/replica.
4. Restore secrets: KEK, `SESSION_SECRET`, DB/S3/SMTP credentials.
5. Deploy the last known-good image tags (API, worker, frontend proxy) with the restored endpoints configured.
6. **Re-apply the durable deletion ledger** for entries executed after the backup timestamp (see `deletion-ledger.md`): re-delete purged rows/objects and re-shred DEKs.
7. Smoke test: `/healthz` on API, queue consumer alive, one synthetic import end-to-end, login with an invited test user.
8. Reopen traffic at the edge.

## Restore drill

- Cadence: before beta launch, then quarterly.
- Record in this file: date, backup age, result, defects found.
- Drills performed: **none yet**.

A disaster test is a launch gate (plan §10): restore a backup, reapply the
completed deletion ledger, and prove purged spaces/keys remain inaccessible.