Reference

The recovery targets we commit to, and the drill that proves each one

Every recovery promise is a number attached to a workload, written down before the bad day. This page shows how we choose the numbers with the team, how we test them without touching production data, and what we do when a drill fails.

The four numbers we ask a team to agree

We write four numbers per workload with the team: how much data you accept losing, how long the service may be down, how both get tested, and how often the test runs. A number without a test is a hope, so the test is part of the commitment.

Recovery point and recovery time targets per workload, with the drill that verifies each one.
Workload	RPO target	RTO target	How the target is tested	Test frequency
Order database	5 min	30 min	Restore the last full dump into a scratch instance and replay the binlog	Monthly
Media and object storage	24 h	4 h	Rebuild the bucket from versioned objects and compare object counts	Weekly
Configuration and code	1 h	15 min	Rebuild the environment from the repository and rerun the smoke test	Every deploy
Admin and reporting tools	60 min	2 h	Restore the analytics snapshot and rerun the overnight job	Monthly

Choosing the RPO

The recovery point objective follows from what a lost record costs. An order that a customer has already paid for is worth minutes of replication lag; a derived media file can be regenerated overnight, so a day of loss is acceptable. Write down which records are irreplaceable, because only those records decide the worst case.

Recovery point against recovery time for four workloads, in minutes. Orders sit in the tight corner because a lost order is a lost sale; media sits far out because the files can be rebuilt from source.

Testing without production data

Drills run against a copy, in an isolated network, on a schedule. Restore the last full dump into a scratch instance, replay the transaction log from the dump to the drill point, and measure how long both steps take. The number that matters is the drill duration, because it is the number you will be quoting when the real restore happens under pressure.

If a drill fails, fix the drill before fixing the target. A target that the drill cannot reproduce is a target you will not meet in production either.