Business Continuity & Disaster Recovery Policy
| Owner | [Security Owner — to be named: founder/CTO] |
| Approved by | [signatory] |
| Effective date | [set on approval] |
| Review cadence | Annual; one DR restore drill per year |
| Version | 0.1 — DRAFT |
| TSC mapping | A1 (Availability), CC7.5 |
Scope note: Availability (A1) is in scope only if the Company commits to it in the audit. If the TSC scope is Security + Confidentiality only, this policy still governs recovery as a CC7.5 control but the formal RTO/RPO commitments are internal targets rather than audited criteria. See
../soc2-readiness.md§3.
1. Purpose
Section titled “1. Purpose”Ensure the Ordermatic platform can recover from infrastructure failure, data loss, or disruption within defined objectives.
2. Resilience primitives (already in place)
Section titled “2. Resilience primitives (already in place)”- Compute: Google Cloud Run autoscaling, multi-zone by default — no single zone is a single point of failure.
- Database: Neon serverless Postgres with point-in-time recovery (PITR).
- Object storage: Cloudflare R2 (durable, replicated) with server-side encryption.
- Processing integrity: order processing is idempotent; bronze data tables are append/merge-only, so a replay cannot destroy other tenants’ data.
3. Recovery objectives
Section titled “3. Recovery objectives”| Objective | Target |
|---|---|
| RTO (time to restore service) | [set on approval — proposed: 4 hours] |
| RPO (max acceptable data loss) | [set on approval — proposed: 1 hour] |
4. Recovery procedures
Section titled “4. Recovery procedures”- Service outage: redeploy the affected service from
mainvia the existing deploy workflows; Cloud Run shifts traffic to healthy revisions. - Data loss / corruption: restore the database from Neon PITR to the last good point; verify integrity before resuming writes.
- Region/provider disruption: documented in the runbook; severity-assessed per the Incident Response Policy.
5. Testing
Section titled “5. Testing”The Company performs at least one DR restore drill per year — a Neon PITR restore to a scratch environment — confirms data integrity, measures actual recovery time against RTO/RPO, and records the result. (This is the operating-instance evidence a Type II audit requires.)
6. Backups
Section titled “6. Backups”Database backups are provided by Neon’s managed PITR; R2 provides durable object storage. Backup configuration and retention are reviewed in the annual review.
7. Review
Section titled “7. Review”Reviewed at least annually by the Security Owner.