From "we lost a week of work" to "restored to 11:47 AM yesterday in two clicks."
Aegis is the platform-wide backup, recovery, and time-travel feature built into every Aeion deployment. Four defense layers — pre-destructive migration guard, continuous Postgres PITR (~30 second RPO), daily logical snapshots, per-row application time travel. Off-machine to your own S3 bucket. Object-lock immutability against ransomware. Monthly SOC 2 / ISO 27001 / GDPR compliance reports auto-generated.
Four Layers. Four Different Failure Modes.
Layer 1 — Pre-Destructive Migration Guard
Before any schema change applies, Aegis scans it for anything destructive — dropped tables, dropped columns, truncates. Each affected table is row-counted against your live data. If non-empty data would be lost, the change **refuses** and lists the rows × tables that would be wiped. Overriding requires an explicit confirmation, and an automatic snapshot is taken first — the exact failure mode most teams don't discover until it's too late. **RPO: prevents the loss. RTO: instant (block).**
Layer 2 — Continuous PITR via pgBackRest
pgBackRest streams Postgres WAL to your S3 bucket every 60 seconds. The Time Machine UI in `/admin/platform/aegis` lets operators scrub to any second in the retention window and one-click restore. Postgres replays the WAL to that exact moment — no manual SQL surgery, no engineering escalation. Catches `DROP TABLE`, `db:reset`, ransomware encryption, accidental `TRUNCATE`. **RPO: ~30 seconds. RTO: 10–30 minutes.**
Layer 3 — Daily Logical Snapshots
Compressed `pg_dump` shipped daily (or on-demand) to your S3 bucket. Restore the whole DB, a single schema, specific tables, or one collection. Pre-restore auto-snapshot captures the current state — **undo the undo** if a restore was a mistake. Cleanest path for "restore last night's prod to staging" or "give me the state from April 1." **RPO: 24 hours default. RTO: 5–15 minutes.**
Layer 4 — Application Time Travel
Every write to a temporal collection records a reverse JSON Patch in the Aegis Temporal log. Reconstruct any document at any past timestamp via the QueryBuilder's `.asOf(timestamp)` modifier. One-click Version History panel in the admin UI per collection record. **Bulk-undo** lets an admin reverse "agent X just deleted 50 customer records by accident" with a filter (user, time range, collection) — three seconds, no service interruption. **RPO: 0 (live). RTO: instant.**
Real-World Scenarios — and the Layer That Catches Them.
An employee deleted 50 customer records by accident
Layer 4 — Bulk Undo. One click in the admin UI, filtered by user / time / collection. 50 records back. ~3 seconds total. No service interruption.
Our database got `db:reset` during deployment
Layer 2 — PITR Time Machine. Click the timeline at 9:47 AM (before the reset ran). Postgres restarts replaying the WAL. Service back in ~12 minutes with zero data loss.
Ransomware encrypted the production VPS
Layers 2 + 3 + Object Lock. Both PITR and snapshots stored off-machine in your S3 bucket with Object Lock — even credentialed access can't delete them during the retention window. Restore on a fresh VPS in under an hour.
Auditor walks in, demands SOC 2 evidence
Phase 4 — Compliance Reports. Auto-generated monthly. SOC 2 (CC6.1, CC7.1, A1.2), ISO 27001 (A.12.3.1), GDPR (Article 32) control mappings included. Self-contained HTML — print to PDF, hand it over.
A schema migration would drop a column with 12,000 rows
Layer 1 — Migration Guard. Migration **refuses** and tells you exactly how many rows × which columns would be lost. `--force-destructive` requires explicit override + auto-snapshot first.
User edited a doc 5 times, wants version 2 back
Layer 4 — Version History. Per-document timeline panel in the admin UI. Pick the version. Restore. Other rows unaffected.
Internal mistake — an agent edited the wrong tenant
Layer 4 — Per-tenant + per-user undo. The Temporal log records `userId` + `tenantId` on every event. Filter the undo by both. Other tenants stay untouched.
Postgres minor-version upgrade failed
Layer 3 — Full-DB restore. Logical snapshot is engine-version-agnostic (plain `pg_dump`). Drop the bad upgrade, restore the snapshot, retry on a clean version.
What Makes Aegis Different — and Honest.
Bring Your Own Bucket — your data, your keys
Works with AWS S3, Cloudflare R2, Wasabi, Backblaze B2, MinIO, DigitalOcean Spaces, and any S3-compatible endpoint. Your bucket. Your access keys. Your compliance posture. We never see your data unbroken — the encryption layer happens before upload.
Customer-managed encryption (CMK)
Optional client-side AES-256 encryption before upload. Aeion **cannot decrypt your backups for you** — by design. Lose the key, lose the backups. Zero-trust posture: no Aeion-side compromise can leak your data.
Object-Lock immutability
Enable S3 Object Lock and even credentialed access can't delete backups during the retention window. Defeats ransomware that gets your S3 keys.
Zero per-feature lock-in
PITR uses pgBackRest — the same tool AWS RDS, Crunchy Bridge, and EDB use. Logical snapshots use plain `pg_dump`. The artifacts are standard Postgres formats. Restore on any Postgres host, with or without Aeion.
Tested backups, not just taken
Weekly verification cron restores the latest backup into a temp DB, runs row-count anomaly checks, drops the temp DB. If verification fails, your auditors see `unmet` for the relevant SOC 2 controls — we won't lie about restorability.
Honest about what's deferred
We publish the list of capabilities still in design vs. shipped. You'll know if a feature is API-only without UI, or if a compliance report runs HTML-not-PDF. No surprises during an audit.
Measured Recovery — Real Numbers, Not Marketing
| Scenario | RTO | RPO |
|---|---|---|
| Per-row undo via Version History | < 1 second | 0 |
| Bulk Undo (50 deleted records) | ~3 seconds | 0 |
| Application time-travel (`.asOf` query) | < 100 ms | 0 |
| Logical full-DB restore | 6 min 18 sec | 24 hours |
| PITR in-place restore to point-in-time | 14 min 42 sec | ~30 seconds |
| PITR sidecar selective restore (2 tables) | 22 min (incl. extract) | ~30 seconds |
| Verification cron (test restore) | 8 min 4 sec | n/a |
Compliance Control Mappings
SOC 2
CC6.1 (logical access controls, encryption-at-rest), CC7.1 (system monitoring + verification metrics), A1.2 (availability + restore-tested commitments).
ISO 27001
A.12.3.1 (information backup procedures + verified restorability).
GDPR
Article 32 (security of processing, including backup encryption + access control + recovery procedures).
HIPAA
§ 164.308(a)(7)(ii)(A)–(D) (contingency plan + data backup + disaster recovery + emergency mode operation). Health-module-specific BAA available on request.
PCI-DSS
Requirement 9.5 (offsite backup storage with same level of security as production data).
Frequently Asked Questions
Hosting providers (AWS RDS, DigitalOcean Managed Databases, etc.) typically offer snapshot-based backups with limited point-in-time recovery and **no off-account immutability**. If your provider account is compromised, those backups can be deleted by the attacker. Aegis ships snapshots + WAL to **your** S3 bucket with **your** access keys — separate trust domain. Plus Aegis gives you per-row Bulk Undo and application time-travel, which no hosting provider offers.
PITR (Layer 2) gives you ~30 second RPO — you can rewind to almost any moment within the retention window. Snapshots (Layer 3) give you 24-hour granularity but are much faster to ship/store and engine-version-agnostic. Most teams want both: PITR for "I just typed the wrong thing," snapshots for "give me last week's data for analysis." Both are included with every Aeion deployment — Layer 3 works out of the box, Layer 2 needs a one-time BYOB PITR bootstrap.
You provide S3-compatible credentials in the admin Settings (access key + secret + endpoint URL + bucket name). Aegis uses those credentials to write snapshots + WAL. Your bucket. Your IAM. Your retention policy. You can rotate credentials at any time. Aeion doesn't have backup copies of your backups — we explicitly **don't** keep a Aeion-side mirror unless you also configure cross-region replication (included, off by default).
Your backups become **permanently unrecoverable**. This is by design — CMK is a zero-trust posture. We can't decrypt for you because we never have the key. For most teams, the right setup is: enable Aegis emergency-key escrow (included, opt-in) that holds the CMK in our HSM with a multi-party approval requirement. You control the recovery procedure; Aeion enforces it.
Weekly Verification Cron (included with every deployment). The cron picks the most recent snapshot, restores it into a temporary, isolated database, runs row-count anomaly checks, verifies foreign-key validity, and tears the temporary database down. The result — including measured RTO — is recorded automatically. Monthly compliance reports include the verification log. If verification fails, the relevant SOC 2 control flips to `unmet` in the report — we structurally won't lie about it.
pgBackRest streams WAL at the granularity of WAL segment switches (typically every few minutes under low write load) plus an `archive_timeout` setting that forces a switch at least every 60 seconds. So your effective RPO floor is ~30 seconds (the rolling average of "time since last segment switch"). Under heavy write load, segments switch more often and RPO drops further.
No. Aegis itself is stateless — the state lives in your bucket. If the Aeion control plane is unavailable, you can still run `pgbackrest restore` directly with the same credentials you configured. The artifacts are standard. If our facade dies you don't lose recovery — you lose the UI.
Aegis is included free with every Aeion deployment — the only cost is your S3 provider's storage + egress (typically $0.005–$0.023 / GB / month depending on provider; egress is free on Cloudflare R2 + Backblaze B2, ~$0.09 / GB on AWS S3). A typical 50 GB DB with 30-day PITR retention uses ~120 GB total — roughly $0.60–$2.80/month. Bring Your Own Bucket means you negotiate that directly with the cloud, no Aeion markup.