انتقل إلى المحتوى الرئيسي

Backups & Disaster Recovery

ORKSTRA backs up your tenant data multiple times a day. This page documents the backup cadence, retention, restore options, and our disaster-recovery commitments.

Backup cadence​

  • Continuous WAL streaming to a hot standby (Neon Postgres).
  • Point-in-time restore window: 30 days.
  • Nightly logical snapshot retained 90 days.
  • Weekly archive retained 1 year.
  • Premium / Enterprise can extend retention up to 7 years.

Restore options​

  • Point-in-time: restore the tenant to any second within the 30-day window.
  • Full restore: restore the entire tenant database from a nightly snapshot.
  • Selective restore: restore individual entities (e.g., a deleted project) from the audit log + nightly snapshot.

Restores are initiated by raising a ticket with support@orkstra.com. Premium and Enterprise plans have self-service point-in-time restore from Admin → Backups → Restore.

Data export​

You own your data and can export it at any time:

  • Admin → Data → Export tenant data — full ZIP of CSV/JSON.
  • Per-entity export — every report and most table views have Excel export.
  • API-based export — pull via the REST API.

RPO and RTO​

  • RPO (Recovery Point Objective): ≤ 5 minutes (WAL streaming).
  • RTO (Recovery Time Objective): ≤ 4 hours for catastrophic failure; ≤ 15 minutes for transparent failover.

Tenant offboarding​

If you terminate your subscription:

  1. 30-day read-only grace period during which you can export everything.
  2. 60-day soft-delete window during which we retain backups but you cannot access.
  3. At 90 days, data is hard-deleted from primary and backup stores.
  4. Audit trail of the deletion is preserved for 7 years (compliance requirement).

Tenants under legal hold are not deleted; data is retained until the hold is lifted.

Testing your restore plan​

We recommend tenants:

  1. Quarterly: run a tenant data export and verify integrity.
  2. Annually: request a restore-to-sandbox test from support to verify the restore path end-to-end.

DR architecture​

  • Primary region: UAE (Neon Postgres primary).
  • Standby region: EU (warm standby with continuous WAL streaming).
  • Active-passive failover — manual cutover by ORKSTRA SRE on declared incident.
  • Multi-region active-active available on Enterprise plans with custom SLA.

Common questions​

  • "Can I get my data after offboarding?" — Within the 90-day window, yes. After that, no — it has been securely destroyed.
  • "How fast can I restore a single deleted record?" — Within retention, soft-deleted records can be restored from the UI immediately. Hard-deleted records require an SRE restore (1-4 hours).
  • "Do you encrypt backups?" — Yes — same AES-256 encryption as primary.

See also: Security, Audit Log.