Business Continuity and Disaster Recovery

Recovery point

Up to 24 hours: the database is backed up in full once a day. Once continuous backup is on, this falls to minutes.

Recovery time

4 hours from the decision to restore. In the latest restore test the database itself came back in 8 seconds; the rest of the time is for checking it and pointing the service at it.

How far back

Daily copies for 7 days, Monday copies for 5 weeks and first-of-month copies for 190 days, so data damaged without anyone noticing can still be recovered from before it happened.

These are objectives, not a service level. Unless your Order Form sets one, the Terms don't guarantee uninterrupted availability (Terms, Section 16).

• Daily backups, kept up to 190 days

  The database is copied in full every day over a verified encrypted connection. Daily copies are kept 7 days, Monday copies 5 weeks and first-of-month copies 190 days, and each copy is checked to be complete before it is kept.

  Live
• Encrypted copies kept off-site

  Each day's backups are encrypted with AES-256 and copied to separate cloud storage, and every copy is reopened after upload to prove it restores.

  Live
• Point-in-time recovery

  Turns on continuous database backup, so data can be restored to any moment rather than to the last daily copy: from up to 24 hours of loss to minutes.

  Due: With the first paying agency

  Planned

Hosting outage

If Vercel's Tokyo region fails, we follow its recovery, post on our status page and tell the agencies affected. The application is standard and can be redeployed from our code repository.

Database outage or loss

We restore the latest backup into a new database in Tokyo, run the isolation test against it, and point the service at it only once that passes.

Data damaged or deleted by mistake

We restore a copy from before the mistake into a separate database and bring back only the rows affected, so nothing written since is lost.

A provider account lost or locked

Encrypted copies of the database are kept with a different provider from the one that runs it, and our code is kept in a private repository with another, so losing any one account doesn't lose the service.

Stolen credentials

We replace the affected keys and passwords, sign out sessions, and check the activity log and provider logs for what was done with them. Credentials are kept in a password manager.

A work computer lost or stolen

Its disk is encrypted and its screen locks. We sign it out of every account, replace any keys it held, and recover from the off-site copies.

A provider leaves or changes its terms

The database is standard PostgreSQL, and our first restore test was run outside Supabase entirely, so the data can move to another provider. The application is a standard web application that can be hosted elsewhere.

We can't act

We are appointing a trusted person who will hold sealed instructions to reach every agency, keep the service running, and help each agency export its data and move its domain if we can't act. Until then, this risk rests on the controls above and on what you can do yourselves.

• A written continuity and recovery plan

  Recovery objectives, and what we do about outages, data loss, a lost provider account, stolen credentials, a lost computer and our own unavailability, tested by the restore drills.

  Live
• A named person who can act if we can't

  A trusted person, named in our internal plan, holds sealed instructions to reach every agency, keep the service running and help each agency take its data and domain elsewhere.

  Due: November 2026

  In progress
• Work computers fully encrypted

  The computers used to run the service have full-disk encryption on and lock their screens after five minutes.

  Live
• Two-step sign-in on every operator account

  Two-step verification on every account that can reach the service: hosting, database, code, email and payments, with credentials kept in a password manager.

  Due: November 2026

  In progress

• A second copy of uploaded files

  Images, CVs and recordings are stored in Vercel Blob, apart from the database, and aren't in the daily database backup. This adds an encrypted copy of them alongside it.

  Due: Before the first live agency's candidate data

  Planned

• Restores tested, not assumed

  A backup is restored into a fresh database and compared with production table by table, at least once a quarter. The latest result is shown on this page.

  Live

• Export your content, settings and applications

  Owners can download the site's content, settings and applications at any time, free.

  Live
• Full export and offboarding with a deletion record

  Extends the export to every record and file an agency has, and adds an offboarding routine that deletes everything at the end of a contract and gives the agency a record of it.

  Live