Security, Infrastructure & OperationsBackup & Continuity
Business Continuity and Disaster Recovery Plan
BCP and DRP — scenarios, RTO/RPO objectives, communication and periodic testing
The business continuity plan (BCP) and disaster recovery plan (DRP) ensure the resumption of SSM.ro services within the defined recovery objectives. Procedures are documented in the Operational SOP (Backup, DR & Patching), v1.0 (2026-04-29), reviewed annually.
Recovery objectives
| Component | RPO | RTO |
|---|---|---|
| Relational data (Heroku Postgres) | ≤ 5 minutes | 4 hours |
| Documents (AWS S3) | ≤ 15 minutes | 8 hours |
Definitions and details: RTO and RPO.
Disaster scenarios and response
| Scenario | Recovery mechanism | RTO |
|---|---|---|
| Platform outage (Heroku / dedicated AWS) | Provider status monitoring; tenant notification; return to normal operation | 4 hours |
| Database corruption/loss (Postgres / RDS) | Restore from PITR or daily backup/snapshot | 4 hours |
| AWS region outage / S3 loss | Document recovery from CRR replica (another region) | 8 hours |
| Faulty release | Rollback to the previous release (one-click Heroku / ECS redeploy) | < 30 minutes |
| Credential compromise | Immediate rotation of all secrets | < 2 hours |
Step-by-step procedures are in the Data Recovery Procedure.
Continuity through external archive
Tenants using automatic daily export to an external archive have an additional recovery path, independent of platform availability (RPO ≤ 24 hours), as well as data portability.
Communication during incidents
- Affected tenants are notified by email upon identification of the event
- Status updates are issued as the situation progresses, until resolution
- Upon resolution: a final confirmation is sent to the affected tenants
Details: Incident Notification.
Plan testing
- Restore capability is validated through ad-hoc restores performed when operationally necessary, using the integrity guarantees of the managed services (Heroku Postgres backups, S3 versioning + CRR).
- The continuity and recovery SOP is reviewed annually or upon any significant change to the architecture.
- Lessons learned from real events are incorporated into procedures through the post-incident process.