Backup and recovery
This article covers backup and recovery for both SaaS and on-premises deployments.
SaaS: platform-managed backups
VaultPAM manages backups automatically for SaaS customers. You do not need to configure or schedule anything.
| Property | Value |
|---|---|
| Frequency | Daily encrypted snapshots |
| Retention | 30 days |
| RPO | 24 hours |
| RTO | 4 hours |
| Encryption | AES-256 at rest; backups stored in GCP europe-central2 |
To request a restore (for example, after accidental bulk deletion), email support@vaultpam.com with your organisation name, the date to restore to, and the data scope (full tenant or specific resource).
On-premises: manual backup procedure
For on-premises deployments, you are responsible for scheduling and verifying backups.
Backing up your deployment
- Stop any write-heavy workloads or schedule backups during a low-traffic window.
- Back up the PostgreSQL database by connecting to your PostgreSQL host and running a pg_dump to a secure off-host location.
- Export session recordings from MinIO using the MinIO client to sync the recordings bucket to your backup storage.
- Export connector configuration: in the VaultPAM console, go to Admin > Connectors and export the connector inventory.
- Verify the backup files are readable and not empty.
- Store backups in at least two geographically separate locations.
Restoring your deployment
Restoring from backup will overwrite all data created after the backup timestamp. Session recordings, audit log entries, credentials, and configuration changes made after the backup date will be permanently lost. This action cannot be undone.
- Stop the VaultPAM control-plane services before starting the restore.
- Restore the PostgreSQL database from the dump file.
- Restore MinIO recordings from your backup storage.
- Restart the control-plane services.
- Log in as Org Admin and verify that resources, Safes, and audit log entries are present.
- Test a session launch against a known resource to confirm connectivity.
Schedule quarterly restore tests using a staging environment. A backup you have never tested is not a backup you can rely on.