Business continuity summary

Dated 17 September 2026. Next review by 19 March 2027.

The current version is on our security page: https://barrierops.com/security#continuity.

• Automated backups of the production database are taken by the managed database provider, in the same account and the same region as the cluster.
• A second copy at a different provider is set up and not running yet: its bucket exists, in the US jurisdiction, and stays empty until the server that writes the nightly copy is deployed. Until it runs, a failure that took the provider account would take the backups with it, and we would rather you read that here than discover it in an incident.
• We publish no Recovery Time Objective (RTO) and no Recovery Point Objective (RPO), because we have not yet exercised a recovery against production. The restore test has run once, on a local copy, and that is not the same evidence. When the first production restore runs, the date, how long it took and what it recovered are published on this page — including the parts that did not go well.

A recovery target nobody has exercised is a number, not a control. If a vendor shows you one with no date beside it, that is a fair thing to ask them about — including us.