Backups and restore
What to back up, the repository's backup and restore procedure and what has been drilled, and why scheduled workspace backups inside the product are not built yet.
There are two different things people mean by a backup. They are separate here.
Your knowledge: export#
You can take a complete copy of your knowledge at any time with Export: Markdown, your original files, memory, decisions and the graph, with a checksum for every member. It is yours to keep anywhere and to read without Breno. See Export your knowledge.
The system: operator backups#
If you run Breno yourself (see Running Breno yourself), these stores matter:
| Store | Holds | Protection |
|---|---|---|
| PostgreSQL | Items, passages, embeddings, access control, audit, memory | Logical dumps; production adds write-ahead-log archiving for a recovery point in seconds. |
| Neo4j | The knowledge graph | A Cypher export. |
| Object storage | Original uploads, exports | Replicate the bucket, with provider-native versioning. |
| Nango's own database | Connection tokens for sources | Dumped hourly. Restoring it also needs the same Nango encryption key. |
| Redis | Rate limits and caches | Not backed up: it is derived and rebuilds from PostgreSQL. |
In Kubernetes, a scheduled job dumps PostgreSQL as a privileged role into object storage, encrypts it, prunes old ones, and a verify job reads the object back and restores it into a scratch database to prove it works.
Restore order#
- Provision fresh PostgreSQL (with pgvector) and Neo4j.
- Restore PostgreSQL from the latest dump.
- Restore Neo4j from its export.
- Restore Nango's database, with the same Nango encryption key.
- Deploy the API pointed at the restored stores. It applies any migrations newer than the backup and recovers in-flight work.
- Redis and caches warm on first use.
What has been drilled#
A restore drill has been executed for PostgreSQL and object storage, with counts matched and three failure paths confirmed to fail loudly; the record is in the repository's docs/runbooks/restore.md. The Neo4j and Nango steps are written but have not been drilled to the same standard, and a recovery time at production size has not been measured. Treat any procedure that has not been exercised against your own data as unproven, and drill it before you need it.
Recovery objectives#
The scheduled backup runs hourly, so the recovery point is up to one hour; write-ahead-log archiving reduces it to seconds. Recovery time depends on data size and should be measured at your size.