Backups¶
Point-in-time archives of everything your workspace owns — every data set plus uploaded files — downloadable and restorable.
Screenshot: Backup console — TODO
Open Backups (/admin/backups).
Backup types¶
| Type | Contains | Restore needs |
|---|---|---|
| Full | Everything | just this archive |
| Differential | Changes since the last full backup | the full + this archive |
| Incremental | Changes since the last backup of any type | the full + every incremental after it |
A differential/incremental with no earlier full automatically becomes a full backup — a delta with nothing to build on would be unrestorable.
Back up now¶
- Pick a type and click Back up now.
- The job runs in the background — the row shows progress and flips to Completed.
- Download streams the archive (
.zip); the sha256 checksum is shown on the button tooltip.
Each archive contains data/ (one CSV per data set, from a single database snapshot — so
accounting, payroll and clinical rows are always mutually consistent), documents/ (the actual
uploaded files) and manifest.json (type, snapshot time, chain parent, per-table row counts).
Verify a backup (restore dry-run)¶
The shield icon on any completed backup runs a read-only restore check — no data is touched:
- Checksum — the stored archive still matches its recorded sha256.
- Chain — a differential/incremental can walk back to a full backup whose archive still exists.
- Schema drift — data sets or columns that changed since the backup (anything that would be dropped on restore is flagged).
The verdict is Restorable, Restorable with warnings, or Not restorable with the exact reasons listed. Verify your latest backup after big schema upgrades — a backup you can't restore is not a backup.
Restore (disaster recovery)¶
Restore… on the dry-run report brings a purged or empty workspace back from the archive chain — every original id and relationship preserved. Safety gates, in order:
- Preflight re-checks the dry run, proves the workspace is empty, and proves no other workspace has claimed your ids or globally-unique values (emails, subdomains, document numbers) since the purge. Any failure blocks the restore.
- You must type the workspace id to confirm.
- The whole chain (full first, then each differential/incremental) applies in one transaction — any failure rolls everything back to empty, never half-restored.
Restore never merges into live data. Operational queues (pending emails/webhooks) are deliberately not restored — old side effects must not replay. Restoring into a different or occupied workspace (fresh ids) is not yet supported.
Automatic backups¶
Under Automatic backups → New schedule:
- One time — pick a date (AD/BS picker) and time; runs once, then the schedule pauses itself.
- Daily / Weekly / Monthly — pick the time (and weekday / day of month).
- Keep each backup (days) — archives auto-delete after this many days (7–365).
A good pattern: weekly Full + daily Differential. If a backup is already running when a schedule fires, that occurrence is skipped — the next one covers the same changes.
You get an email when each backup finishes — a summary on success, an alert on failure (manual backups go to whoever requested them; scheduled ones to the workspace admin).
Security
Login credentials and 2FA secrets are never included in archives. Every download is written to the audit log. Backup creation is rate-limited.