Security and data
Backup and recovery
What the recovery objectives are (RPO and RTO), what is backed up, how often and for how long, and how information is restored after an incident.
Recovery objectives
LingoQuesto’s backup policy defines these objectives for the production environment.
| Objective | Value | What it means |
|---|---|---|
| Recovery point objective (RPO) | 24 hours | The maximum acceptable data loss in an incident. |
| Recovery time objective (RTO) | 4 hours | The maximum time to restore critical services. |
What is backed up
| What | How | Retention |
|---|---|---|
| Production database | Automatic full backup every day, handled by the managed database service, with recovery to any point within the retention period. | 7 days |
| Infrastructure and deployment configuration | Versioned in code repositories. | Full history |
| Credentials and secrets | In a managed vault (Azure Key Vault). | — |
When the retention period ends, database backups are deleted automatically.
The database contains accounts, classes, assignments, transcripts, grades and progress. Files (audio, images and documents) are stored in the provider’s object storage, encrypted at rest; the backup described here covers the database.
Backup protection
- Backups are stored encrypted.
- DigitalOcean manages them within its database service. LingoQuesto does not keep an additional copy in another region or with another provider.
- Only authorized technical staff can restore them.
Restore testing
The policy states that restores are tested at least once a year and after major infrastructure changes, in an environment separate from production.
For each test, the date, the time the recovery took, the issues found and the corrective actions are recorded.
Restore procedure
The procedure is triggered by data corruption or accidental deletion, critical infrastructure failures, deployment errors, security incidents or prolonged unavailability.
- Identify the incident. The date and time, the scope of the impact and the affected systems are recorded.
- Choose the backup. The most recent one that meets the recovery point is selected, and its integrity is verified.
- Approve. The technical lead authorizes the restore, and the decision is recorded.
- Restore. The affected systems are isolated if needed, the data and the associated configuration are restored, and the consistency of the information is validated.
- Verify. The services are confirmed to be available, and basic operational tests are run.
- Close. The cause, the total recovery time, whether the target time was met and the preventive actions are documented.
If the incident affects the availability of the service, LingoQuesto informs the affected institutions.
Deletion of data and backups
When the data of an account or an institution is deleted, that data remains in the database backups until the 7-day retention period ends.
Responsibilities
- Technology team. Oversees backup execution, verifies backup integrity and performs restores.
- Technical lead. Approves restores, coordinates communication during an incident and validates that the objectives are met.
The policy is reviewed at least once a year.