Skip to content
Adrythm
Websites, domains and hosting

Recovery point objective

RPO / RPO and RTO / acceptable data loss

In short

A recovery point objective, or RPO, is the most data a business will accept losing after an outage, measured as time since the last point it can recover to. It sets how often backups must run, and how many hours of orders, bookings or form entries a failure could erase.

NIST defines the recovery point objective as the point in time to which data must be recovered after an outage. AWS states it as the maximum acceptable time after the last data recovery point. Microsoft notes that it is measured in units of time, such as 30 minutes of data.

Its partner is the recovery time objective, or RTO. AWS defines that as the maximum acceptable delay between the interruption of service and restoration of service. The RPO covers how much recent work can be lost. The RTO covers how long the business can wait to be running again.

The RPO turns directly into a backup schedule. Microsoft advises making sure the RPO is aligned with the backup interval. It also warns that backups are typically taken infrequently, so restoring from one usually involves data loss. Backups kept for disaster recovery should be stored separately from the main data.

Microsoft publishes these figures for its Azure SQL Database service. It lists an RPO of 0 when zone redundancy handles a failure. When a database is recovered with geo-restore, the RPO is typically minutes or hours. That service takes transaction log backups every 5 to 10 minutes and keeps backups for seven days by default.

A tighter target carries a cost. AWS lists zero data loss as an unrealistic objective that may be out of reach for a given setup. It also warns that targets stricter than the business needs force costlier and more complicated recovery.

In practice

A contractor runs a booking app whose database is backed up once a night at 2 in the morning. The database fails at 5 in the afternoon, so the newest backup is 15 hours old. Every booking and change made in those 15 hours is gone. If the business can accept losing 1 hour at most, backups or replication must run at least hourly. The figures are a worked example.

Why it matters to you

Leads, orders and appointment changes entered since the last backup may be impossible to rebuild. AWS suggests asking whether lost data can be recreated from other sources. The right target can also change with the calendar, and AWS names holiday shopping seasons and special sales as examples. A backup that has never been restored is untested. AWS advises validating the RPO by performing a recovery test. It lists assuming a backup exists as a common mistake, along with restoring one without checking that the data is usable.

What to ask or check

  1. 01How often is your website or app database backed up, and how many hours of data could be lost between backups?
  2. 02Where are your backups stored, and are they kept separate from the main site and database?
  3. 03When did the business last restore a backup and check the data, and how long did the restore take?
  4. 04Does your hosting or database provider publish an RPO for your plan, and how long are backups kept?

What people get wrong

That having backups means the target is met. AWS lists assuming a backup exists, and restoring one without checking the data is usable, as common mistakes. A test restore is how the RPO gets confirmed.

Red flags

  • A hosting or software quote that mentions backups but gives no backup frequency, retention period or record of a tested restore.

Uptime guarantee

An uptime guarantee is a provider's promise that a service will be available for a stated share of each month, such as 99.9%. In the published terms of large cloud providers, the remedy for a miss is a credit on future bills that the customer has to claim, and that credit is the only remedy.

Version control

Version control is the permanent record of software as it changes. Microsoft describes it as taking a snapshot of the files and saving it so it can be recalled later. For a business paying for the work, it is where the asset lives, and access to it is a separate question from owning it.

Account ownership

Account ownership decides who keeps the advertising account and its history when an agency relationship ends. Google lets anyone with administrative access unlink from a manager account at any time. Microsoft names the fix when the account was created in the wrong place, and lists what cannot be moved.

301 redirect

A 301 redirect is a server instruction saying a page has permanently moved to a new address. Google treats it as a signal that the new address is the real one and should be the version shown in search results. A 302 says the move is temporary, so Google keeps showing the old address instead.

DNS

DNS is the system that turns a domain name into the address of the machine that answers for it. Your records live on an authoritative server named in the domain's NS record. Changes are not broadcast; old answers simply sit in caches until the TTL you set expires.

SSL certificate

An SSL or TLS certificate is the file that lets a browser confirm it is really connected to your domain, and it turns on encryption for the connection. It binds your keys to your domain name. It says nothing about whether the business behind the domain is trustworthy, and it is usually free.

Want this explained against your own numbers?

Twenty minutes, a straight answer, and no follow-up sequence if you decide not to work with us.