Back up

• Database

• config.json and related secrets

• data/uploads or object storage

• Installed release version and package

• Recovery procedure and ownership

3-2-1 principle

Keep at least three copies on two media types, with one copy outside the primary system. Backup encryption and access controls should match production sensitivity.

Rehearse restore

• Restore into an isolated environment

• Verify record and file counts

• Test login, uploads, email and scheduled work

• Record achieved RPO/RTO

• Securely remove the rehearsal copy