Trigger: monthly check; any restore need; annual DR drill. Owner: Jonny Allum. Policy anchors: POL-07, POL-10.
1. What is backed up, and by whom
| Asset | Mechanism | Check |
|---|---|---|
| Supabase Postgres (all tenant data) | Provider automated backups on the project's plan tier (defines the real RPO — POL-07 says 24h; verify the plan delivers it) | Monthly: confirm backups exist and are recent in the dashboard |
| Source + migrations + this manual | GitHub + local clones | Continuous (push discipline) |
| Secrets/env | Password manager (+ VM env) | Monthly: register vs reality (SOP-09 §3) |
| Stripe (billing state) | Stripe is the system of record | Nothing to do; exportable any time |
| VM | Not backed up — rebuildable by design from repo + env + this SOP | Annual rebuild drill |
| DNS records | Documented in §5 | On change |
2. Monthly backup check (first Monday, 10 minutes)
- ☐Supabase dashboard: latest backup timestamp within 24h
- ☐Point-in-time/renewal settings unchanged
- ☐
.data/local dev fixtures contain no real tenant data - ☐Password manager emergency access (POL-07 §4) still configured
3. Restore: single-tenant / single-table mistake
Prefer surgical repair over full restore: restore the backup into a new Supabase project (never over the top of production), extract the affected rows, apply targeted fixes to production as a logged support action (SOP-04 §Direct data fixes). Full project restore is a last resort — it loses every other tenant's writes since the backup point.
4. Restore: full disaster (VM or project loss)
- New VM: clone repo → env from password manager →
pnpm install→ build → PM2 → Caddy + certs → repoint DNS (TTL is why §5 keeps records short). - New Supabase project (if needed): restore provider backup → apply any migrations newer than the backup (idempotency makes this safe) → new keys into env → verify RLS active before opening traffic.
- Smoke test per SOP-03, plus one authenticated pass on a care-vertical tenant (highest-sensitivity data proves isolation survived).
- Status comms per SOP-05 §3.
5. DNS register
Keep the authoritative record list (registrar, A/AAAA to the static IP, Resend SPF/DKIM/DMARC records, any white-label client domains) in the password manager alongside the registrar credentials — one place, current.
6. Annual drill (July)
Time a full §4 rehearsal to a throwaway VM + branch project. Log duration and lessons in the risk register. If the drill exceeds the 1-working-day RTO, that's a POL-07 review trigger.