Availability, Backup & Recovery

Audience: IT/operations reviewers, procurement. Describes how HousingSurvey Pro stays available and how data is protected against loss. Items not yet formalised are marked planned / in progress — this page does not claim guarantees the platform has not yet committed to. Tracked on our internal roadmap.

Availability model

Serverless architecture on Google Cloud / Firebase: no customer-managed servers to fail or patch. Compute (Cloud Functions) and data (Firestore, Cloud Storage) scale on the managed platform.
Offline-first capture: the mobile app is not dependent on continuous connectivity. Surveyors capture offline; finalising (sealing) and the online lookups (AI wording, EPC, weather, soil) need a connection, and sealed evidence syncs when a connection returns, so field capture is unaffected by transient outages.
Static front-ends: the dashboard and website are static assets served via CDN, decoupling their availability from backend load.

Durability & backups

Managed durability: Firestore and Cloud Storage replicate data within the region (europe-west2) and encrypt it at rest by default.
Firestore point-in-time recovery (PITR): production has a seven-day PITR window and daily backups retained for 98 days. A nonprod drill recovered changed and deleted documents via point-in-time reads into an isolated database. The production-equivalent PITR bulk export/import and scheduled- backup restore paths remain untested, so recovery testing is partial.
Cloud Storage versioning / disaster recovery: object-versioning is enabled on Cloud Storage (evidence photos and files), with soft-delete retention and a nightly mirror to a separate versioned Archive bucket in London. The scheduled 15 July 2026 transfer succeeded. Keeping the backup in London preserves UK residency but means it is not protection against a whole-region outage; restore follows a documented internal runbook.
Evidence immutability aids recovery: because finalised records are append-only and hash-chained, a restore can be integrity-verified against the chain — corruption or gaps are detectable, not silent.

Recovery objectives

RPO/RTO: accidental object deletion/overwrite is recoverable from live bucket versioning/soft delete with effectively no scheduled-backup gap; separate-bucket recovery has up to a 24-hour RPO. Restore took minutes at today's tiny dataset, but production-scale RTO and a regional-outage target are not tested and are not promised.

Monitoring & incident response

Monitoring: managed platform metrics, web performance/error telemetry and integrity alerts exist. Native Crashlytics is coded but awaits the next store binary; automated nightly-backup failure alerting and a published SLO/uptime commitment are planned.
Integrity monitoring: the evidence chain verifier detects tampering or breakage and raises audit events + notifications (implemented).
Incident response: a documented internal incident procedure for evidence-tamper detections is in place, and a general incident-response plan (severity model, response lifecycle, and processor/controller breach duties) is now documented; the general-incident tabletop exercise remains planned.

Change safety

Every change is gated in CI before it can reach production — lint, unit tests with coverage floors, Firestore rules tests on the emulator, hash-canonicaliser parity checks, and full builds — reducing the risk of a change-induced outage. Release automation provides a consistent, revertible deployment path.

Business continuity

No single-app dependency for field work: offline capture means an outage of the dashboard/backend does not stop surveyors collecting evidence.
Data portability: organisation admins can export a signed, machine- readable ZIP of the full organisation dataset, including all survey versions.

Status: living document. Production PITR/backups, Storage versioning/soft delete/nightly UK backup and a limited point-in-time recovery drill are proven. Bulk/scheduled-backup recovery, production-scale RTO, regional-outage recovery, backup failure alerting and the SLO commitment remain open.