Recovery
Recovery is the work that brings a system and its data back after a loss. At the default restore rate of 100 Mbps, 500 GB takes about 11 hours to restore. Two targets measure it: how much data you can lose (RPO) and how long you can be down (RTO).
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Backup each hour and a slow restore | Backup every 4 min and a fast restore |
|---|---|---|---|
| Data lost (RPO) | under 300 s | 1,800 s Fail | 70 s Pass |
| Recovery time (RTO) | under 3,600 s | 8,200 s Fail | 2,000.14 s Pass |
| Monthly cost | 32 USD/mo | 54 USD/mo | |
| p99 latency | 91 ms | 92 ms | |
| Error rate | 82% | 20.1% | |
| Level rules | none broken | Board is not complete Fail | Pass |
Key numbers
| Number | Value |
|---|---|
| Time between database backups, default | 3,600 s |
| Restore rate, default | 100 Mbps |
| Time a database keeps its backups, default | 365 days |
| Object storage price for each GB | 0.015 USD/GB-mo |
Backup every 60 minutes · RPO 60 minutes · RTO 11 hours at 100 Mbps
How it works
Backups exist for the day when the data is gone: a bad migration deletes a table, a bug writes wrong values, or an attacker encrypts the disk. Replicas do not help here, because they copy the damage in a few milliseconds.
Two numbers define a recovery plan. The recovery point objective (RPO) is the most data that you accept to lose, measured in time. A backup each hour means that up to one hour of writes can be lost. The recovery time objective (RTO) is the longest time that you accept to be down. It includes the time to find the problem, to get the backup and to restore it.
Restore speed is often the hidden limit. Divide the data size by the restore rate. If the result is longer than the RTO, a backup on time is still not enough. A faster restore link, smaller units of data or a standby copy can close the gap.
A backup counts only if a restore works. Test restores on a schedule, from start to end, and measure the time. Keep copies in another region and under a separate account, so that one fault or one stolen key cannot remove all of them.
In the levels you set the backup interval and the restore speed so that both targets hold.