# Entea backup and disaster-recovery policy

Last updated: 18 September 2026  
Status: Published operating policy; contractual RTO and RPO pending

## Control-plane backups

Entea can schedule PostgreSQL custom-format backups for each organization. The worker streams the database dump through AES-256-GCM authenticated encryption, validates the encrypted archive, decrypts it in memory for `pg_restore --list` catalog verification, records a SHA-256 checksum, and removes failed partial archives.

Backup frequency and retention are administrator-controlled. Supported retention is 1 to 365 days. The local encrypted store is a development default; production copies should use durable, access-controlled object storage.

## Application database backups

Application database backups are separate from the control-plane backup. Current PostgreSQL policy defaults are:

- production: automatic backups with 30-day retention;
- non-production: automatic backups with 7-day retention;
- manual restore: explicit selection and exact application-name confirmation;
- customer-managed external databases: Entea will not overwrite them through its restore control.

## Recovery procedure

1. Identify the affected organization, system, and last known-good point.
2. Preserve the current state and relevant audit evidence.
3. Select a verified encrypted backup or retained application revision.
4. Restore into an isolated environment first.
5. Run migrations and tenant-isolation checks.
6. Exercise sign-in, one build, and one deployment where the incident affects the control plane.
7. Record elapsed time, recovery point, failures, owner, and approval before production restoration.

## Exercise evidence

The first encrypted control-plane backup was created on 15 September 2026 and its archive catalog was restored and verified in isolation. The retained reference application also completed an AWS rollback and cleanup certification exercise. Detailed evidence is available at https://entea.in/proof.

The isolated archive check is not equivalent to a complete regional disaster-recovery exercise.

## Current objectives

Entea does not yet publish a contractual recovery-time objective or recovery-point objective. Pilot agreements must define acceptable RTO, RPO, backup location, restoration authority, and exercise cadence before production workloads are accepted.

The operating target is at least one isolated recovery exercise each quarter; completion must be evidenced rather than assumed.