Licensed to be used in conjunction with basebox, only.
// security
Backup
Applies to
Product: Cloud · Audience: Security / Compliance reviewer
Scope, frequency, retention and restore of backups for Cloud environments. In the Cloud, basebox backs up; you do not have to set anything up – but you should know what is backed up, how long backups live and what that means for deletion periods.
What is backed up
The same components as on a server (Backup & restore), for your environment:
| Component | Content | Personal data |
|---|---|---|
Application database (aisrv-db) |
Users, organization, apps, settings, audit log, connector credentials (write-only) | Yes |
Identity database (idp-db) |
Accounts, realm, clients | Yes |
| Store and RAG databases | Persistence; document passages and embeddings of the knowledge bases | Yes |
| Media | Uploaded files | Yes |
| Platform configuration and secrets | For restoring the environment | No |
Not backed up are recreatable artefacts: model weights, caches, container images.
Frequency, retention, location
basebox sets the values and tells you them for your environment; contractually they belong in the DPA or the service description:
- Frequency of database backups and whether WAL archiving for point-in-time recovery is active
- Retention period of the backups – it determines when deleted data finally disappears
- Storage location of the backups (in the Noris data center, separate fire compartment or second site) and whether it respects the jurisdictional boundaries your contract requires
- Encryption of the backups and separation per customer
- Recovery objectives (RPO/RTO) and whether restores are tested regularly
In addition, basebox backs up the application database before every upgrade because database migrations are forward-only (Updates).
What this means for deletions
What a user or administrator deletes is gone from the application immediately but remains in backups until their rotation. For deletion commitments towards data subjects, add the backup retention (Deletion). At contract end the environment and subsequently the backups are deleted; deadlines and confirmation are regulated by the DPA.
Restore
A restore is performed by basebox – on its own initiative after an infrastructure failure, at your request after a data loss in your organization (for example an accidentally deleted knowledge base). Note:
- A restore usually concerns the whole environment at the time of the backup, not individual records – all changes since the backup are lost. Whether individual objects can be restored, clarify with basebox.
- Requests come from a named person of your organization to support@basebox.ai; the restore appears in the audit log as a change.
What you should back up yourself
Independently of the platform's backups:
- Audit log exports for evidence needed longer than the configured retention (Exports).
- Knowledge base documents – the originals are with you; the knowledge base can be rebuilt from them at any time.
- App configurations and system prompt as a text copy if you must reproduce them quickly.
- Users back up important chats themselves (Back up chats).
Next step: Server security → Dedicated hardware