Operations runbook
By Rafael Duarte · created 10 Jan 2022, 09:30 UTC · last updated 13 Oct 2026, 09:20 UTC · version 14
operationsrunbookbackupsdisaster-recovery
How production is looked after day to day, region by region. Start here when something is about data, restores, certificates or a region.
| Page | Read it when |
|---|---|
| Backups | you need to know what is backed up, where, for how long, or how to restore |
| Restore drills | it is time for the quarterly drill, or someone asks when restores were last tested |
| Disaster recovery plan | a region, a provider or a database is gone |
| SAML certificates: expiry checks | a depot's certificate warning fires |
Ground rules
- Everything stays in the client's region. Data, backups, restores and copies for investigation. No exceptions for convenience. See Regions and environments.
- Production write access is per change. Open an OPS ticket; access expires after eight hours.
- Write it down as you go. Commands and times in the OPS ticket, so the next person can follow.
- Customer data never goes to staging or a laptop.
Regions at a glance
| Region | AWS | Backups bucket |
|---|---|---|
| EU | eu-central-1 (Frankfurt) | acme-backups-eu |
| UK | eu-west-2 (London) | acme-backups-uk |
| US | us-east-1 (Virginia) | acme-backups-us |
Change history
| Version | Date | Who | What |
|---|---|---|---|
| 11 | 19 Jan 2026 | Rafael | US region |
| 12 | 29 Jun 2026 | Oskar | Oskar owns it; per-change write access |
| 13 | 28 Sep 2026 | Oskar | Restore drill of 25 September |
| 14 | 13 Oct 2026 | Oskar | Backups stay in the region, for Halden's questionnaire |