Backups on each plan
| What you get | Starter | Business | Enterprise |
|---|---|---|---|
| Daily encrypted backups at a second site | Yes | Yes | Yes |
| Backup before every change | Yes | Yes | Yes |
| Retention | Standard | Longer | Longer |
| Point-in-time recovery for databases | – | Yes | Yes |
| Monthly restore test, recorded in the console | – | – | Yes |
| RPO and RTO per app, in the contract | – | – | Yes |
The pricing page has the rest of each plan. Retention longer than your plan’s can be added on request.
What a restore test checks
A restore test is not a check that a backup file exists. On Enterprise, once a month, an engineer restores each app from its latest backup into an isolated environment with no path to production, then works through the same checks every time:
- the app starts on the version recorded in the backup;
- a user can sign in through your directory;
- the newest records and files match the time the backup was taken;
- the time the restore took, set against the recovery time objective in your contract.
The date, the backup used, the duration and the result of each check go into the console. Your auditors read the record rather than take our word for it, and a failed check is treated as an incident, not a footnote.
Setting recovery objectives app by app
A wiki and a finance system rarely need the same answer, so on Enterprise the recovery point objective and the recovery time objective are set per app. Two questions decide them: how much recent work could you afford to type in again, and how long can people do without the app before work stops. Some examples of what teams agree:
| App | Recovery point | Recovery time | Why |
|---|---|---|---|
| Single sign-on | Last daily backup | One hour | Every other app depends on it |
| ERP or accounting | Minutes, by point-in-time recovery | Four hours | Orders and invoices cannot be re-keyed from memory |
| Team chat | Last daily backup | Four hours | Messages lost are an annoyance; no chat for a day is not |
| Wiki | Last daily backup | Next working day | People can read yesterday’s copy elsewhere |
A shorter objective costs more to meet, in standby capacity and in people ready to act at any hour, which is why it is agreed rather than assumed. Managed operations covers the on-call engineers who run a restore when you need one, and the SLA sets the availability commitment that sits beside these objectives.