How it works
- Daily encrypted backups — full database snapshot, age-encrypted before leaving the host, written to off-site EU-jurisdiction object storage
- Retention horizons — daily snapshots retained for 30 days, weekly for 90 days, monthly for 12 months
- Verify-restore drills — automated Sunday-night restore from the freshest backup to a throwaway database; restore failure pings the operations channel within minutes
- Documented disaster-recovery playbooks — RTO/RPO targets per data tier, bring-up dependency order, four named scenario playbooks (host loss, database loss, region loss, complete platform loss)
- Audit retention — access audit logs retained for 24 months, the substrate for retrospective forensic work
- Source-side retention mirrored — when an upstream public register removes a record, Ecology App tombstones its copy on the next nightly sync
What this means in practice
A worst-case host loss (catastrophic hardware failure with no chance of in-place recovery) restores from the most recent off-site backup. The verify-restore drill that runs weekly is the same restore path that would be used in an emergency, which means the procedure is exercised continuously rather than tested only when needed.
What you can ask for
If you operate a tenant on Ecology App, you can request a copy of your tenant's data at any time (see data access). The platform's backup story is operator-side insurance against catastrophic loss; the data-access story is your tenant-side insurance against dependence on the platform.