Policy Objective
The objective of this policy is to provide set of written rules revolving around backing up and restoring of the applications hosted on Scopic's Application Hosting environment.
Policy Scope
This policy applies to data hosted on the resources (servers, volumes, databases) that are part of the Application Hosting service.
Policy Statement
From backup perspective this policy recognized two type of applications:
- Development/Staging Applications
Development Applicatoins are used by development teams during development. It should, by definition, NOT HAVE any data that cannot be lost without any consequences.
Staging Applications are resources used to do Quality Assurance and confirm that application is working according to the design. They might have the same data/configs/settings as the production applications but this is NOT the main source of truth, meaning that this data/settings/configs can be lost without any consequences. Production Applications
Production Applications are applications that are used by real end-users. As such they are the main source for applications data and Scopic will make efforts to protect and secure this data as it cannot be lost.
Backup Policy
All applications hosted on Scopic's Application Hosting environment must be backed up according to this policy, and data needs to be preserved throughout reboots, restarts and hazards.
Backup policy is different depending on the application type as defined above.
- Development/Staging Applications
Data should not be backed up by default. If data needs to be backed up, that needs to be explicitly requested.
Any possible backups that might be needed, will be backed up daily for the last 7 days.
Backups will have a maximum retention period of 2 months after the resource is deleted. After 2 months, expired backups will be permanently deleted. This retention period is there in case we need to quickly get resource back up online.
- Production Applications
Data MUST have backups. No exception to this rule.
The location of the backup is determined by the type of backup:
In case of a regular backup, we will be backing up using the backup option provided by the cloud provider (i.e. RDS backups, EBS snapshots, etc).
In case of On-Site Ransomware Protection backup, we will be copying all data to an AWS S3 immutable bucket. In case of Off-Site Ransomware Protection backup, we will be copying all data to a Wassabi immutable bucket.
The retention period of the backup is determined by the type of backup:
In case of a regular backup, we should have daily backups with retention period of 7 days and monhtly backups with the retention period of 6 months.
In case of On-Site Ransomware Protection backup, we should have daily backups with retention period of 30 days.
In case of Off-Site Ransomware Protection backup, we should have daily backups with retention period of 30 days.
When possible the latest monthly backup should also be copied to another region for safekeeping. This other region should store only one copy of the backup.
The latest daily backup should be kept for six months after the cancelation of the service. All other backups will be removed immediately. Immutable backups will remain until the retention period is over and client will be charged for that.
There will be two yearly validity checkup of backups for production applications. The validity check will be scheduled on a Scopic level, not per application, meaning that Scopic will have two dates during the year when the checkups will be done.
IMPORTANT: Backups are a good way to limit the data loss, but in case of a hazard there might be some loss of data generated during the time between the last daily backup and the time of hazard.
Restore Policy
Backup restoration is a manual process and can be invoked based on the specific needs, but it can be either Automatic Restore Request or Manual Restore Request. In either case, restoring the backup is a manual process that will be done by Scopic’s IT Department.
- Automatic Restore Request will be done in case of any hazard that requires Scopic to get the applications back online. This will be done using the latest created backup. Automatic restore is free of charge to the client.
- Manual Restore Request will be done upon specific request by the customer via the support portal. Manual restore can be done using any specific backup available in the system. Manual restore might be charged to the client in case the request is not caused by infrastructure problems.
Note: Clients will submit any requests via Scopic's Support Portal.