# Production data and backups: prove you can recover without giving attackers a second copy

Source: https://www.web3sec.news/blog/production-data-backup-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Set explicit recovery-point and recovery-time objectives.
- [ ] Inventory databases, exports and backup identities.
- [ ] Separate backup deletion from production authority.
- [ ] Restore into isolation and validate application behavior.
- [ ] Test extraction visibility and denied deletion using synthetic data.

## References
- [PostgreSQL: backup and restore](https://www.postgresql.org/docs/current/backup.html)
- [AWS: Backup Vault Lock modes and limitations](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html)