| Owner | Jonny Allum |
| Version | 1.0 · Effective 13/07/2026 · Review annually (July) and after any DR test |
| Applies to | The BizOS production service and the business's ability to operate |
1. What must survive
| Asset | Why | Where it lives |
|---|---|---|
| Tenant data | Customers' entire operations — the crown jewels | Supabase (managed Postgres, provider backups) — see SOP-06 |
| Source code + migrations | The platform can be rebuilt from repo + migrations alone | GitHub (jonnyallum/biz-os), local clones |
| Secrets | Rebuild is impossible without them | Password manager + VM env; register in SOP-09 |
| Billing state | Who pays what | Stripe (system of record for subscriptions) |
| DNS/domains | The front door | Registrar; records documented in SOP-06 §5 |
2. Objectives
- RPO (data loss tolerance): 24 hours — bounded by Supabase's daily backup tier; anything tighter is a paid upgrade decision recorded here.
- RTO (time to restore service): 1 working day for full service on a rebuilt VM; status communication to affected tenants within 4 hours (SOP-05 comms).
3. Continuity scenarios and stance
| Scenario | Stance |
|---|---|
| VM loss (GCP zone/instance failure) | Rebuild from scratch: new VM, clone repo, restore env from password manager, pnpm install && build, PM2 + Caddy, repoint DNS. Rehearsed via SOP-06 §4. |
| Supabase incident | Provider status page monitored; restore from provider backup into a new project if catastrophic; app repointed via env. |
| Key person unavailable (sole operator) | See §4 — the honest single point of failure. |
| Supplier exit (any of POL-09 register) | Every store is pluggable (local/Supabase behind one contract); code and data are exportable; no supplier holds the only copy of anything. |
| Loss of workstation | No unique state on the endpoint: repo on GitHub, secrets in password manager, docs in repo. Re-provision and revoke old sessions same day. |
4. The sole-operator contingency
The largest business continuity risk is the operator. Mitigations:
- Everything is written down — this governance pack,
BUILD_PLAN.md's RESUME HERE handover block, and SOPs are sufficient for a competent engineer to operate the platform cold. - A sealed continuity note (password-manager emergency access + instructions naming a trusted technical contact and next of kin) exists outside the business's own systems, so paying tenants are not stranded if the operator is incapacitated.
- Customer money is protected: subscriptions can be paused/refunded from Stripe by the emergency contact using the continuity note.
5. Testing
- Annual: one VM-rebuild rehearsal (SOP-06 §4) and one backup-restore drill.
- The result, duration and lessons are logged in the risk register (POL-11).