Backup Policy
This policy describes what Bunker backs up, how often, where copies are kept and how we verify that they restore. On the backup dimension, it implements the principles of our information security policy and covers control A.8.13 of the Statement of Applicability.
Our controls are self-assessed, aligned with ISO/IEC 27001, not certified by a third party to date. The status of each measure below reflects that self-assessment.
Purpose and scope
This policy covers backups of the components we operate (managed databases, persistent volumes of managed services and infrastructure configuration). The data you place inside your own instances is covered by your own backup plan; we provide object storage to send it off-site, described in the off-site backup guide.
Principles
- An untested backup is not a backup: the proof is the restore, not the job's success report.
- Absence of signal is a signal: the daily freshness check emits a heartbeat; if the check itself does not run, the alert fires anyway.
- Retry before waking a human: a missed or partially failed backup is replayed automatically before the next day's check.
- Off-site copy, always: a copy living on the same site as the data does not protect against losing the site.
- Consistent thresholds: the freshness threshold of the check and of the retry are the same, so that one mechanism never considers normal what the other flags as late.
Measures
| Area | Measure |
|---|---|
| Scope and frequency | Daily backup of managed databases and persistent volumes (A.8.13). |
| Retention | Retention configured per service: by default three weeks for volumes, thirty days for databases. |
| Off-site copy | Copied to dedicated object storage that is geographically separate from the production site (A.8.13, A.8.14). |
| Encryption | Backups encrypted at rest, on the storage side (a removed medium is unusable); application secrets are additionally protected by authenticated envelope encryption (A.7.10, A.8.24). |
| Freshness monitoring | Automated daily check of every backup's age (16-hour threshold), with a heartbeat: a check that does not run raises an alert of its own, routed to the on-call rotation (A.8.16). |
| Automatic retry | Automated daily replay of missing or partially failed backups, running before the freshness check. |
| Restore testing | Automated daily restore into a verification environment, covering databases and volumes: a backup counts as valid only if it actually restores (A.8.13). |
| Configuration | Infrastructure and application configuration declarative and versioned in Git, replayable to rebuild an environment (A.8.9). |
Responsibilities
- The CISO (François-Guillaume Ribreau) owns this policy and the freshness and retention thresholds.
- The on-call rotation handles missing-backup and failed-restore alerts as production incidents.
- Each service owner declares the backup scope of their component; a service with no declared backup is treated as a non-conformity.
- Customer restore requests go through [email protected] or support, and are recorded.
Status and roadmap
Backup, retention, freshness monitoring, automatic retry, restore testing and the off-site copy are in place and operational (A.8.13). Three items remain open and are declared as such. The organisation-wide retention policy is still to be formalised (A.5.33, partial), the customer data deletion workflow is still to be formalised (A.8.10, partial), and write-once (WORM) locking of the backup storage is not in place to date. We do not claim end-to-end encryption of backups. Encryption is applied at rest, on the storage side.
Review
This policy is reviewed at least once a year, after any observed restore failure and whenever our backup arrangements change significantly.
Last reviewed: 31 August 2026.
See also
- Statement of Applicability (the status of control A.8.13 and adjacent controls)
- Business Continuity Policy (the recovery these backups make possible)
- Logging and Monitoring Policy (the alerting that watches backup freshness)
- Security model (where backups sit in our defence in depth)