Backups
PLANA takes daily encrypted backups of your tenant. This page describes what gets backed up, how long it's retained, and how to request a restore.
What's backed up
Two artifacts per day:
| Artifact | What |
|---|---|
| PostgreSQL dump | Every row of every table in your tenant database |
| Filestore tarball | Every binary attachment (invoice PDFs, receipts, images on records) |
Together these are everything needed to fully reconstruct your tenant to a specific point in time.
When backups run
- Daily at approximately 02:00 EET / EEST — chosen because load is lowest
- The exact time may shift by a few minutes — the job is a Kubernetes CronJob, not a guaranteed-instant trigger
- Insurance backups are taken immediately before any destructive operation (cross-major upgrade, restore, fiscal year reopening) regardless of the daily schedule
Where backups are stored
| Storage | Location |
|---|---|
| Primary | Exoscale Simple Object Storage (SOS) bucket plana-pulse-backups, region bg-sof-1 (Sofia, BG) |
| Encryption at rest | Yes — both server-side encrypted by Exoscale AND client-side gzipped + age-encrypted by us |
| Replication | SOS provides multi-zone durability within bg-sof-1 |
| Network | Backups never leave EU jurisdiction; never touch US clouds |
Retention
Determined by your tier:
| Tier | Daily backups | Insurance backups |
|---|---|---|
| Starter | 30 days | 7 days minimum |
| Pro | 90 days | 7 days minimum |
| Enterprise | 1 year | 7 days minimum |
After the retention period:
- Daily backups are deleted automatically by a lifecycle policy on the SOS bucket
- Insurance backups are kept at least 7 days, often longer if linked to a specific operation that's still being soaked
Cost of restore
| Restore type | Cost |
|---|---|
| Side-by-side clone (verifying a point-in-time state without affecting production) | Included on Pro and Enterprise tiers |
| In-place restore (replace current state with a backup) | Included for any tier |
| Multiple restore attempts in a month | Talk to your account manager |
Requesting a restore
There's no self-service restore — for safety, all restores go through PLANA. Talk to your account manager via the workspace Matrix room.
What we need from you:
- Which workspace is affected
- Which backup — by date (and optionally time)
- What type of restore:
- Side-by-side clone — get a copy of the backup as a separate temporary tenant; useful for investigation without affecting production
- In-place restore — replace your production tenant with the backup
- Confirmation — for in-place restore, an unambiguous written "yes, replace prod" via Matrix
The procedure we use is documented at Platform → Operations → Restoring from backup.
Restore timing
For a typical tenant (Pro tier, ~1 GB DB + ~50 GB filestore):
| Step | Typical time |
|---|---|
| Pre-restore insurance backup of current state | 1–3 minutes |
| Side-by-side restore | 5–15 minutes (DB) + a few minutes per GB of filestore |
| In-place restore | Same + downtime for the duration |
Large tenants take longer; Enterprise tenants with > 100 GB filestore can take an hour or more.
What you should also do
PLANA's backup is the safety net but it shouldn't be your only copy of critical records. Best practices:
- Export reports periodically — month-end P&L, balance sheet, trial balance — to PDF or Excel, stored in your own document system
- Email yourself critical invoices — the customer's confirmation is also a record
- For very valuable attachments (signed contracts, legal docs), keep a copy outside PLANA too
This is defence in depth — PLANA's backups protect against PLANA-side issues; your own exports protect against any catastrophic event.
What's NOT in the backup
- PLANA platform state (Authentik users, Crossplane resources) — separately backed up at the platform level, not relevant to your data
- BOS chat history — separate retention; not in the daily PG dump
- Logs / telemetry — not in your tenant DB; in Loki with its own retention
- Cached / derived data — recomputed on restore
Where to read more
- Subscription and tier — which retention you get
- Support channel — how to reach us for a restore
- Platform → Restoring from backup — the operator-side procedure
- Data residency — where backups sit physically