Continuity & bus-factor.

bsns.ccis run by a small team. That’s a feature for some of what we do (we move fast, we keep prices low) and a risk for others (what happens if the person running it is unreachable for a week?). This page is the honest answer.

Where your data lives

Production relational data lives in managed Cloud SQL PostgreSQL 17 in Google Cloud us-west1. Cloud SQL retains seven days of point-in-time recovery logs and 14 automated daily backups. A provider-independent nightly job exports both logical databases, age-encrypts them before upload, and stores ciphertext in Cloudflare R2. Target RPO is ≤ 1 hour through Cloud SQL, or ≤ 24 hours if GCP-native recovery is unavailable. Target RTO is ≤ 1 hour. On August 14, 2026, the current R2 artifacts were decrypted and restored into an isolated PostgreSQL 17 environment in a measured technical recovery sequence of under 10 minutes. That measurement excludes the human time to approve an incident and unlock escrow, so it is evidence for the technical path rather than a promise that every incident will be resolved in 10 minutes.

File artifacts (signed PDFs, attachments, executed contracts) live in managed object storage behind the suite’s storage adapter. Private artifacts are fetched through authorized app routes rather than by exposing an underlying storage-provider URL. Keeping the provider out of customer links lets storage move without changing the workflow or weakening the access check.

Encryption key escrow

Fields holding PII (DOB, EIN, SSN, tax ID, driver license number, telematics tokens, IdP private keys) are AES-256-GCM encrypted with app-scoped key-encryption keys. Those keys are mirrored into two independent escrows:

• 1Password— operator access via emergency-access grants. An authorized contact can recover keys after a configured waiting period without needing the operator’s master password.
• Bitwarden— secondary escrow with key-fingerprint verification. A maintained escrow-sync script compares each key’s fingerprint against the manifest, warns loudly on drift, and refuses to proceed when two keys collide; running it is part of the key-rotation runbook.

Neither escrow is on the critical path of normal operation; they exist so that a recovering team can always re-derive the keys from a documented chain of custody.

Application code

The source code is in a private Git repository with full commit history. It is replicated to multiple developer machines and to a remote Git host. A documented build runbook lets a competent full-stack engineer rebuild the production services from the repository and escrowed configuration. A full provider-loss rebuild is measured in days, not promised within one day. There are no hand-rolled binaries or undocumented build steps.

The “what if” runbook

The operational runbook for operator-unavailable scenarios is maintained internally. It covers 1Password emergency-access activation, key escrow recovery, Google Cloud and off-provider backup recovery, object-storage restoration, DNS/domain rotation, and customer communication templates. The runbook exists, but the named standby contact, access grant, and handoff rehearsal are not complete yet; until they are, this is a documented recovery plan rather than a fully transferred continuity capability.

The technical runbooks are on a quarterly review cadence. A full pre-migration backup-restore drill passed on May 25, 2026. The first post-GCP cross-vendor drill passed on August 14 against the current age-encrypted R2 artifacts, including restore, schema, row-count, privacy, tenant-isolation, and Gmail deletion-marker checks. The next technical drill is due by November 14; the end-to-end standby-contact tabletop remains pending.

Your data is portable

The deepest form of continuity is being able to leave at any time with your business records. See Trust for the export surfaces the tenant apps expose. Archives use ordinary JSON/CSV and are designed for migration; specially restricted fields require a documented authorization review rather than appearing in a routine self-serve archive.

Limits we are honest about

• We are not a SOC 2 audited shop yet. That engagement is on the roadmap; until then, we publish what we do and how we do it so you can evaluate it directly.
• We are not a HIPAA-eligible processor. Do not store PHI in the suite.
• We will notify affected users of a confirmed personal-data breach within 72 hours where applicable law requires it. We will tell you what we know, what we don’t, and what we’re doing about it.

Questions

If you need a longer continuity / portability commitment in writing for a procurement review or board meeting, contact us and we will share the operational runbook redacted of operator credentials.