| Data | Location | Priority |
|---|---|---|
PostgreSQL database (all annlite-database tables) |
Production Postgres instance | Critical — includes donations, users, charity data |
| Authored content pending sync | annlite-content repository |
Already version-controlled via Git; no separate backup needed |
Uploaded media (if/when added to annlite-content or elsewhere) |
Not yet applicable — no media upload feature exists in the current build | N/A today |
- Automated, scheduled backups of the production PostgreSQL instance (frequency to be set once a hosting/database provider is chosen — see
environments/README.md's Open Decisions). - Backups must be encrypted at rest.
- Backup restoration must be tested periodically, not just configured — an untested backup is not a verified recovery capability. See
annlite-security/docs/PRE_PRODUCTION_CHECKLIST.md, which requires a tested restore before production launch.
- Identify the target restore point (timestamp or specific backup).
- Provision a recovery database instance separate from production.
- Restore the backup to the recovery instance.
- Verify data integrity (spot-check
Donation/Paymenttotals against expected values, checkAuditLogcontinuity). - Only after verification, cut over production traffic — never restore directly onto a live production instance without a verified copy first.
Destructive database migrations (per annlite-database/docs/MIGRATION_STRATEGY.md) require a fresh, verified backup immediately before applying — this is a migration-time backup, distinct from (and in addition to) the routine scheduled backups described above.
The specific backup tooling/provider and exact retention schedule are not yet chosen — tracked as open work alongside the platform decisions in environments/README.md.