Business Continuity and Disaster Recovery Plan

Last updated: October 22, 2026

The production service recovers from a zone outage automatically and can be restored from encrypted backups after data loss or a wider outage, and each customer’s data stays in its chosen region (EU or US) during recovery.

Scope

The production service in each GCP region, its data stores and backups, and the business functions needed to support customers.

Policy

1. Architecture. Production runs across multiple zones within each region. EU customer data is hosted in Google Cloud europe-west4 (Netherlands) and US customer data in Google Cloud us-central1 (Iowa).
2. Data residency in recovery. Backups and failover for EU customers stay in EU regions; for US customers in US regions. Data is not moved between EU and US to recover service.
3. Backups. Customer Data is backed up regularly. Backups are encrypted, stored within the customer’s hosting region, and protected with restricted delete permissions.
4. Restore testing. A restore from backup is tested at least once a year. Results, duration and issues are recorded.
5. Infrastructure as code. Infrastructure is defined as code so a region can be rebuilt from source control.
6. Activation. The CTO or Security Officer declares a disaster when an outage or data loss cannot be resolved through normal operations, and follows the runbook.
7. Communication. Customers are informed by email and in-app notices, or status page if available; internal coordination uses the company chat tool, with a fallback of phone if company tools are down.
8. Business continuity. Critical knowledge is documented, at least two people can administer GCP and the identity provider, and break-glass credentials are stored securely offline.
9. Review. This plan is reviewed yearly and after any activation or test that shows gaps.