Backing Up Your Data

Production Data

Your data is in two categories:

Platform Data: The information you enter into the platform, such as any text, form selections etc.

Media Data: This information is the documents or other media you upload to the platform

Our backups are a point-in-time snapshot. We keep our snapshots for 12 months. This means whatever information is stored in on the operational database at the time the backup is taken is kept for 12 months.

N.B. Data retention on the platform is configured to meet your policies. Data will be retained for your policy length plus 12 months.

We store multiple copies of your data in geo-redundant locations and use a range of approaches appropriate to the type of data being backed up.

There are regular backups taken, the table below shows when the backups covers.

	Every Second	Every 6 hours	Daily	Weekly	Monthly
	_{for 7 days}	_{for 1 day}	_{for 7 days}	_{for 4 weeks}	_{for 12 months}
Platform	✅	✅	✅	✅	✅
Media		✅	✅	✅	✅

UAT Data

We do not take any backups of UAT data.

Recovery Objectives (RTO / RPO)

Expansive maintains defined recovery objectives to ensure client data and service availability can be restored within acceptable business timeframes in the unlikely event of disruption.

Recovery Time Objective (RTO)

The RTO represents the maximum target time to fully restore service availability following a disruption.

Target RTO: 4 hours for production systems, including application and API access.
During restoration, priority is given to restoring live client instances and dependent services in the primary hosting region.

Recovery Point Objective (RPO)

The RPO defines the maximum acceptable amount of data loss measured in time between the last valid backup and a restoration point.

Expansive operates continuous database replication and differential backup tiers to ensure minimal data loss in any scenario.

Timeframe	Database RPO Target	Description
Within the last 7 days	1 second (near real-time)	Continuous replication between primary and standby databases.
Older than 7 days	6 hours	Backup from encrypted snapshots retained in secure object storage.

Documents and other media have a 2 hour RPO target.

Backup & Verification Process

All production databases and media are tested for integrity at least annually.
Backup processes and restoration tests are monitored by the Platform Security Team under the ISO 27001 Information Security Management System (ISMS).

Disaster Recovery Alignment

These objectives align with ISO/IEC 27001:2022 controls A.5.29 – Information security during disruption and A.8.13 – Resilience of information processing facilities.