Runbook — Backup

Backups protect PostgreSQL, which is the source of record for tenant data, consent state, audit logs, and outbox rows. Redis and NATS are operational dependencies, but durable recovery starts from PostgreSQL plus replay/reconciliation.

Non-dev deployments run PostgreSQL on a provider-managed database (managed-postgres) or a bring-your-own managed endpoint (external-postgres). Backups and point-in-time recovery are provided and operated by that managed service, not by an in-cluster backup job.

Preconditions

• The managed database has automated backups and point-in-time recovery enabled, with a retention window approved by the customer environment.
• Operator access to the cloud provider console or CLI for the managed database.
• Encryption keys and retention policy are approved by the customer environment.

Steps

1. Confirm automated backups and the retention window on the managed database in the cloud provider console or CLI for the deployed region.
2. Before high-risk maintenance, take an on-demand snapshot or note the current restore point through the managed database service.
3. Record the snapshot identifier or recovery point timestamp alongside the change record.
4. Confirm the snapshot or recovery point is available in the managed service with the expected timestamp and retention class.

Verification

• The managed database reports automated backups enabled and within the approved retention window.
• The on-demand snapshot or recovery point exists with the expected timestamp.
• Restore metadata includes database name, region, and source instance.
• At least one point-in-time restore drill has succeeded within the current quarter.