# Backup & restore runbook

## Daily backup

Automated via `bin/cron.php` at 03:00 (server local time hour 3).

Manual: `php bin/backup.php`

Artifacts: `storage/backups/*.sql.gz` (and R2 when configured).

## Quarterly restore verification

1. Platform admin → **Platform Ops** → Backups → **Verify** on latest backup.
2. Or CLI: `php bin/verify-backup.php <backup_id>`

Target: verified restore at least once per 90 days.

## Restore (disaster recovery)

```bash
gunzip -c storage/backups/karobari-YYYYMMDD-HHMMSS.sql.gz | mysql -h HOST -u USER -p DATABASE
```

Verify application health and spot-check tenant data.

## RPO / RTO targets

| Metric | Target |
|--------|--------|
| RPO | 24 hours (daily backup) |
| RTO | 4 hours (manual restore runbook) |