Data Backup Retention and Recovery Policy

This Data Backup Retention and Recovery Policy explains how Pivot performs backups, retains backup data, and restores systems and data in the event of accidental deletion, corruption, outages, or disaster events. This policy is designed to support service continuity and resilience and follows commonly used contingency planning concepts such as business impact analysis, recovery strategies, and plan testing.

Table of Contents

1. Purpose
2. Scope
3. Key Definitions
4. Recovery Objectives (RPO/RTO)
5. Backup Coverage and Types
6. Backup Frequency and Retention
7. Backup Security and Access Controls
8. Restore and Recovery Procedures
9. Testing and Verification
10. Backup Failures and Monitoring
11. Third-Party and Sub-processor Considerations
12. Customer Requests and Limitations
13. Policy Exceptions
14. Changes

1. Purpose

Pivot maintains backups to:

• Support reliable recovery from operational incidents (e.g., accidental deletion, corruption, misconfiguration).
• Support disaster recovery scenarios (e.g., infrastructure outages).
• Reduce downtime and data loss risk by using defined recovery objectives.
• Maintain secure handling of backup data.

2. Scope

This policy applies to:

• Production data stores used to operate Pivot Services (databases, object/file storage, search indexes, and critical configuration).
• Systems and infrastructure necessary to restore core service functionality.
• Encrypted disaster recovery backups and snapshots. This policy does not guarantee restoration of individual records from backups on demand (see Section 12).

3. Key Definitions

• Backup: A copy of data or system state used to restore service after loss or corruption.
• Snapshot: A point-in-time backup of a database, volume, or storage bucket.
• Retention: How long backups are kept before expiring or being overwritten.
• Restore: The process of recovering data or systems from backups.
• RPO (Recovery Point Objective): The maximum targeted period of data loss measured in time (e.g., “up to 15 minutes of data”).
• RTO (Recovery Time Objective): The maximum targeted time to restore service to an acceptable level.
• BIA (Business Impact Analysis): A process used to determine recovery priorities and appropriate recovery strategies.

4. Recovery Objectives (RPO/RTO)

Pivot sets recovery objectives based on service criticality, operational needs, and the results of impact analysis and risk assessment, consistent with contingency planning guidance.

Recovery objectives may vary by system/component (for example, core databases vs. non-critical analytics), and may be updated as the Services evolve.

5. Backup Coverage and Types

Pivot maintains backups appropriate to its architecture, which may include:

• Database backups/snapshots: Point-in-time backups for core production databases.
• Object/file storage backups: Versioning, snapshots, or replicated storage for file uploads and attachments (where supported).
• Configuration backups: Backups of critical configuration needed to restore service (e.g., infrastructure configuration, secrets rotation processes, deployment artifacts).
• Disaster recovery copies: Encrypted copies stored separately to support restoration after a major outage event. Pivot may use a combination of automated scheduled backups, point-in-time recovery features, and replication depending on the system.

6. Backup Frequency and Retention

Pivot defines backup schedules to meet recovery objectives and operational needs. Retention is managed on rolling schedules and backups are overwritten/expired automatically.

• Operational backups (short-term): Support quick recovery from common incidents (accidental deletion, corruption).
• Disaster recovery backups (medium-term): Support restoration after broader outages. Backup retention should remain consistent with Pivot’s broader deletion and retention commitments for Customer Data where applicable (for example, encrypted backups that age out on rolling schedules rather than being edited record-by-record). If Pivot’s Data Deletion & Retention Policy specifies a maximum backup expiration window for Customer Data, this policy follows that principle for Customer Data stored in backups.

7. Backup Security and Access Controls

Pivot protects backups using layered controls, including:

• Encryption at rest for backup media and snapshots (using strong encryption managed by cloud providers or Pivot-managed key processes where applicable).
• Encryption in transit for backup transfers.
• Access controls and least privilege: Only authorized personnel can initiate restores or access backup systems.
• Logging: Backup and restore actions are logged for auditability.

8. Restore and Recovery Procedures

When restoration is required, Pivot follows documented runbooks to:

1. Identify the incident type (data corruption, deletion, outage).
2. Determine affected systems and recovery priority.
3. Select the appropriate recovery method (snapshot restore, point-in-time recovery, infrastructure redeploy).
4. Validate integrity after restore (data checks, service health checks, error monitoring).
5. Return service to normal operations with heightened monitoring. If recovery requires broader disaster recovery steps (e.g., alternate environment restoration), Pivot coordinates restoration through incident response procedures and communications.

9. Testing and Verification

Pivot verifies backup reliability through:

• Scheduled restore tests (e.g., periodic restores into test environments where feasible).
• Disaster recovery exercises and runbook reviews.
• Monitoring of backup job success/failure. Testing frequency is determined by system criticality and operational risk, consistent with contingency planning best practices that emphasize testing, training, and exercises.

10. Backup Failures and Monitoring

Pivot monitors backup processes and investigates failures promptly. When backup failures occur:

• Pivot assesses whether recovery objectives remain achievable.
• Pivot remediates job failures, permissions issues, capacity limits, or provider outages.
• Pivot documents corrective actions for recurring issues.

11. Third-Party and Sub-processor Considerations

Where Pivot relies on cloud providers or sub-processors for storage or backup functionality:

• Pivot evaluates backup and recovery capabilities relevant to system requirements.
• Pivot requires appropriate security controls and contractual obligations consistent with Pivot’s data protection commitments.
• Pivot coordinates recovery actions with providers where necessary.

12. Customer Requests and Limitations

Backups are primarily for disaster recovery and service restoration. As a result:

• Pivot generally does not restore individual Customer records from backup media unless technically feasible and operationally appropriate.
• If restoration is possible, Pivot may restore at an environment, dataset, or system level, subject to reasonable limits, security review, and verification steps. Customers should use available in-product controls (export, admin tools, retention settings where supported) for routine operational needs.

13. Policy Exceptions

Any deviations from this policy require documented approval with compensating controls and risk acceptance by appropriate stakeholders.

14. Changes

Pivot may update this policy to reflect changes in architecture, provider capabilities, or applicable obligations. Material changes will be communicated through appropriate channels and the “Last updated” date will be revised.