Backup & Restore Rehearsal Runbook

Owner: EcoPowerHub AI LLC — Security & Compliance Cadence: at least annually, and after any major schema migration Last executed: not yet executed — schedule and record below

A backup that has never been restored is an assumption, not a control. This runbook turns it into evidence.

1. Scope

Item	In scope
Postgres database (all tenant tables, functions, policies)	Yes
Storage objects (job photos, signatures, uploaded documents)	Yes
Auth users and identities	Yes
Stripe / Mailgun / external provider state	No — reconciled, not restored

2. Pre-rehearsal record

Before starting, record:

Backup mechanism in use and its retention window
Timestamp of the most recent automatic backup
Target restore environment (a scratch project — never production)
Declared objectives: RTO (time to usable) and RPO (acceptable data loss)

3. Procedure

Trigger a fresh backup/snapshot and note the completion time.
Provision a scratch environment and restore the snapshot into it. Start a timer at the moment the restore is initiated.
Stop the timer when the restored database first answers queries. Record this as the observed RTO.
Run the verification checks in section 4 against the restored copy.
Tear the scratch environment down and confirm no restored customer data persists outside it.

4. Verification checks

Run each against the restored copy and record pass/fail:

Row counts — compare against production for: companies, customers, jobs, invoices, payments, estimates, warranties, audit_logs. Small drift is expected (writes after the snapshot); large gaps are a failure.
Referential integrity — no orphaned jobs.customer_id, invoice_line_items.invoice_id, or payments.invoice_id.
Audit chain — SELECT * FROM verify_audit_chain(<company_id>) returns ok = true for a sample of companies. A broken chain after restore means the tamper-evidence guarantee did not survive the backup.
RLS intact — run the existing suite in supabase/tests/ against the restored database; tenant isolation must still hold.
Storage — spot-check that job photos and signature files for a sample job are retrievable.
Auth — confirm user rows and identities restored, and that a test account can authenticate.

5. Recording the result

Append a row here after every rehearsal:

Date	Snapshot age	Observed RTO	Observed RPO	Checks passed	Issues found	Executed by
pending

Then update the "Backups & restore" row in SECURITY_AUDIT.md to point at the newest entry, and close out the corresponding item in the risk register.

6. Failure handling

Any failed check is an incident under the Incident Response Plan: open a finding, assign an owner, and re-run the full rehearsal after remediation. Do not mark the control satisfied on a partial pass.