Licensed to be used in conjunction with basebox, only.
// security
Backup
Applies to
Product: Cloud · Audience: Security / Compliance reviewer
Scope, frequency, retention and restore of backups for Cloud environments. In the Cloud, basebox backs up; you do not have to set anything up – but you should know what is backed up, how long backups live and what that means for deletion periods.
What is backed up
The same components as on a server (Backup & restore), for your environment:
| Component | Content | Personal data |
|---|---|---|
Application database (aisrv-db) |
Users, organization, apps, settings, audit log, connector credentials (write-only) | Yes |
Identity database (idp-db) |
Accounts, realm, clients | Yes |
| Store and RAG databases | Persistence; document passages and embeddings of the knowledge bases | Yes |
| Media | Uploaded files | Yes |
| Platform configuration and secrets | For restoring the environment | No |
Not backed up are recreatable artefacts: model weights, caches, container images.
Frequency, retention, location
basebox backs up the Cloud daily and retains the backups for 7 days. The retention period determines when deleted data finally disappears. 30-day retention, an encrypted copy in a second data center in Germany and regular restore tests are being set up; until then, basebox gives the current status on request.
basebox does not commit to fixed recovery times (RTO, RPO). basebox resolves disruptions with reasonable care, where necessary first with a workaround. High availability and an emergency data center are not part of the scope of services.
Not yet described in this documentation: whether WAL archiving for point-in-time recovery is active and how backups are separated per customer; ask for this if needed.
In addition, basebox backs up the application database before every upgrade because database migrations are forward-only (Updates).
What this means for deletions
What a user or administrator deletes is gone from the application immediately but remains in backups until their rotation. For deletion commitments towards data subjects, add the backup retention (Deletion). In the Cloud, deleted data disappears from the backups when they expire after 7 days. After contract end you can export your data for 30 days; then basebox deletes the environment, and the last backups expire 7 days later.
Restore
A restore is performed by basebox – on its own initiative after an infrastructure failure, at your request after a data loss in your organization (for example an accidentally deleted knowledge base). Note:
- A restore usually concerns the whole environment at the time of the backup, not individual records – all changes since the backup are lost. Whether individual objects can be restored, clarify with basebox.
- Requests come from a named person of your organization to support@basebox.ai; the restore appears in the audit log as a change.
What you should back up yourself
Independently of the platform's backups:
- Audit log exports for evidence needed longer than the configured retention (Audit Log).
- Knowledge base documents – the originals are with you; the knowledge base can be rebuilt from them at any time.
- App configurations and system prompt as a text copy if you must reproduce them.
- Users back up important chats themselves (Back up chats).
Next step: Server security → Dedicated hardware