# Business Continuity and Disaster Recovery Plan

Last updated: October 22, 2026

The production service recovers from a zone outage automatically and can be restored from encrypted backups after data loss or a wider outage, and each customer's data stays in its chosen region (EU or US) during recovery.

## Scope

The production service in each GCP region, its data stores and backups, and the business functions needed to support customers.

## Policy

1. **Architecture.** Production runs across multiple zones within each region. EU customer data is hosted in Google Cloud europe-west4 (Netherlands) and US customer data in Google Cloud us-central1 (Iowa).
2. **Data residency in recovery.** Backups and failover for EU customers stay in EU regions; for US customers in US regions. Data is not moved between EU and US to recover service.
3. **Backups.** Customer Data is backed up regularly. Backups are encrypted, stored within the customer's hosting region, and protected with restricted delete permissions.
4. **Restore testing.** A restore from backup is tested at least once a year. Results, duration and issues are recorded.
5. **Infrastructure as code.** Infrastructure is defined as code so a region can be rebuilt from source control.
6. **Activation.** The CTO or Security Officer declares a disaster when an outage or data loss cannot be resolved through normal operations, and follows the runbook.
7. **Communication.** Customers are informed by email and in-app notices, or status page if available; internal coordination uses the company chat tool, with a fallback of phone if company tools are down.
8. **Business continuity.** Critical knowledge is documented, at least two people can administer GCP and the identity provider, and break-glass credentials are stored securely offline.
9. **Review.** This plan is reviewed yearly and after any activation or test that shows gaps.