> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Organization: Acme Inc

## Related Documents

- Disaster Recovery Plan (`DISASTERRECOVERYPLAN.md`)
- Business Continuity Plan (`BUSINESSCONTINUITYPLAN.md`)
- Encryption Policy (`ENCRYPTION_POLICY.md`)

This Backup Policy defines the backup schedules, retention periods, recovery procedures, and testing requirements for all data stores used by Acme Inc's nextjs-saas-example application. It supports compliance with GDPR Article 32 (availability and resilience), SOC 2 A1.2 (backup and recovery), and ISO 27001 Annex A.12.3 (information backup).

## 1. Backup Schedule per Data Store

Data Store | Backup Method | Schedule | Point-in-Time Recovery
--- | --- | --- | ---
Application configuration | Version control (Git) | On every change | Full history via Git
Secrets and credentials | Secrets manager snapshot | On every rotation | Via secrets manager versioning

## 2. Retention Periods

Data Store | Daily Backups | Weekly Backups | Monthly Backups | Annual Backups
--- | --- | --- | --- | ---
Audit logs | 90 days | 1 year | 1 year | 7 years

> PCI DSS Note: Payment-related data backups must comply with PCI DSS Requirement 3 retention limits. Do not retain cardholder data beyond business need. Encrypted backup media must be tracked and securely destroyed when retention period expires.

### 2.1 Retention Exceptions

- Legal hold: Backups may be retained beyond standard periods if required by legal proceedings
- Regulatory requirement: Industry-specific regulations may mandate longer retention (e.g., HIPAA 6 years, SOX 7 years)
- Data subject request: GDPR deletion requests apply to backups; establish a process to track and purge from backup rotations

## 3. Recovery Procedures

## 4. Recovery Testing Schedule

Regular recovery testing ensures that backups are viable and the team is prepared for data recovery scenarios.

Test Type | Frequency | Scope | Success Criteria
--- | --- | --- | ---
Backup integrity check | Daily (automated) | All data stores | Backup completes without errors; checksums valid
Single-table restore | Monthly | Each primary database | Table restored to staging; data matches source
Full database restore | Quarterly | Each primary database | Complete database restored to staging; application functional
Point-in-time recovery | Quarterly | Databases with PITR | Restore to specific timestamp; data consistent to that point
Cross-region restore | Semi-annually | All data stores | Restore from backup region; acceptable RTO achieved
Full disaster recovery | Annually | All data stores + application | Full application operational from backups; RTO/RPO met

### 4.1 Test Documentation

Each recovery test must document:

- Date and time of test
- Data store tested
- Backup used (ID / timestamp)
- Recovery time achieved (actual RTO)
- Data loss window (actual RPO)
- Pass/fail result
- Issues encountered and remediation
- Tester name and sign-off

## 5. Backup Security

Requirement | Standard
--- | ---
Encryption at rest | AES-256 for all backup data
Encryption in transit | TLS 1.2+ for backup transfers
Access control | Backup access limited to authorized personnel; MFA required
Backup separation | Backups stored in a separate account/region from production
Immutability | Object lock / WORM storage for compliance-critical backups
Monitoring | Alerting on backup failures, unexpected access, or deletion

## 6. Roles and Responsibilities

Role | Responsibility
--- | ---
Database Administrator / DevOps | Configure and monitor backup jobs; execute restores
Engineering Lead | Approve recovery procedures; validate test results
Security Team | Audit backup encryption and access controls
Compliance Officer | Verify retention periods meet regulatory requirements

## 7. Policy Review

This backup policy must be reviewed:

- At minimum quarterly
- When new data stores are added or removed
- After any data loss incident
- After each recovery test to incorporate lessons learned

For questions about this policy, contact legal@acme.com.

This Backup Policy was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. Backup schedules and retention periods should be reviewed and customized by your engineering and compliance teams based on actual infrastructure and regulatory requirements.