SECURITY REVIEWS / DATABASE BACKUPS

Security questionnaire answers for database backups

COPY-READY LANGUAGE · RESTORE EVIDENCE · RTO/RPO WITHOUT HAND-WAVING

Customer security reviews rarely ask whether you have a clever backup script. They ask for plain answers: are backups encrypted, off-site, access-controlled, retained, and tested? This page gives practical wording you can adapt, plus the evidence OffsiteDB generates when it runs your Postgres backup pipeline.

Shortcut: answer with a report, not a paragraph

OffsiteDB’s Restore Drill Report records backup cadence, retention, restore status, row counts, and observed restore time. That is the artifact you attach when the questionnaire asks whether backups are tested.

Common questions and usable answers

Are production databases backed up?
Yes. Production Postgres databases are backed up on a defined schedule to off-site object storage. Backups are encrypted before storage and retained according to the company backup policy.
Are backups tested?
Yes. Backups are restore-tested by restoring the artifact into a disposable Postgres environment, verifying the restore completed, capturing table and row counts, and recording restore duration and result evidence.
Where are backups stored?
Backups are stored in private object storage outside the primary database platform account. Storage buckets are not public, use least-privilege credentials, and are covered by retention/lifecycle rules.
How are backups encrypted?
Backup artifacts are encrypted before or during transfer using strong authenticated encryption. Credentials and destination secrets are encrypted at rest and are not stored alongside backup artifacts.
What is your RPO/RTO?
RPO is based on the configured backup cadence and any pre-deploy checkpoint policy. RTO is based on observed restore-drill duration, not an estimate; the latest report records measured restore times.
Who can access backup data?
Access is limited to authorized operators and service accounts required for backup and restore operations. Database backup credentials are read-only where possible, and storage credentials are scoped to the backup bucket.
Do you test backups before migrations?
For high-risk changes, a tagged restore-tested checkpoint is created before migration/deploy so recovery can target the moment immediately before the change.

What evidence to keep beside the answer

Where OffsiteDB fits

OffsiteDB does not make you SOC 2 compliant by itself, and it is not a substitute for a real security program. It handles one narrow evidence problem well: proving your Postgres backups exist, live off-site, are encrypted, and restore. The output is deliberately boring — the kind of boring PDF and ledger line that gets a security review unstuck.

See sample evidenceStart free trial