Security, Infrastructure & OperationsBackup & Continuity
RTO and RPO
RPO ≤5 min (Postgres) / ≤15 min (S3) · RTO 4–8 hours depending on scenario
Definitions
- RPO (Recovery Point Objective) — the maximum acceptable data loss expressed in time; how old the restored data can be
- RTO (Recovery Time Objective) — the maximum acceptable time until normal operations resume after an incident
RPO — Recovery Point Objective
| Component | RPO | Mechanism |
|---|---|---|
| Relational data (Heroku Postgres / AWS RDS) | ≤ 5 minutes | Continuous PITR — every change is backed up near real-time |
| Documents (AWS S3) | ≤ 15 minutes | Versioning enabled + managed cross-region replication (CRR) |
RTO — Recovery Time Objective
RTO values are identical for both deployment models; only the infrastructure component involved differs (Heroku in Shared, dedicated AWS in Enterprise).
| Disaster Scenario | RTO |
|---|---|
| Application platform outage (Heroku / dedicated AWS ECS) | 4 hours |
| Database restore (Heroku Postgres / AWS RDS) | 4 hours |
| Document recovery from S3 replica | 8 hours |
Covered Scenarios
| Scenario | Recovery Mechanism | RTO |
|---|---|---|
| Platform outage (Heroku / dedicated AWS) | Provider status monitoring; tenant notification; return to normal upon provider recovery | 4 hours |
| Database corruption/loss (Postgres / RDS) | Restore from PITR or daily backup/snapshot | 4 hours |
| AWS region outage / S3 loss | Document recovery from CRR replica (passive backup, different region) | 8 hours |
| Faulty release | Rollback to the previous release (Heroku one-click / ECS redeploy on previous version) | < 30 minutes |
| Credential compromise | Immediate rotation of all secrets (Heroku config vars / AWS Secrets Manager, AWS keys, tokens) | < 2 hours |
Tenant External Archive — Additional RPO/RTO
Tenants who use the automatic daily export of documents to an external archive have an additional recovery path outside the platform, with:
- RPO: ≤ 24 hours (daily export)
- Total independence from SSM.ro platform availability
Operational Framework
Recovery procedures are documented in the SSM.ro Operational SOP (Backup, DR & Patching), version 1.0, approved 2026-04-29. The SOP is reviewed annually or upon any significant change.