From "we lost a week of work" to "restored to 11:47 AM yesterday in two clicks."
Aegis is the platform-wide backup, recovery, and time-travel feature built into every Aeion deployment. Four defense layers — pre-destructive migration guard, continuous Postgres PITR (~30 second RPO), daily logical snapshots, per-row application time travel. Off-machine to your own S3 bucket. Object-lock immutability against ransomware. Monthly SOC 2 / ISO 27001 / GDPR compliance reports auto-generated.
Bring Your Own Bucket (BYOB)
Customer-Managed Keys (CMK) Optional
Object-Lock Immutability
Weekly Verified Restores
SOC 2 + ISO 27001 + GDPR Reports
Zero Per-Feature Lock-In (Standard pg_dump + pgBackRest)
~30 sec RPO on PITR
Per-Row Bulk Undo
Four Layers. Four Different Failure Modes.
Most "backup" products solve one problem. Aegis stacks four orthogonal defenses so every realistic failure mode has a matched recovery path.
Layer 1 — Pre-Destructive Migration Guard
Before any schema change applies, Aegis scans it for anything destructive — dropped tables, dropped columns, truncates. Each affected table is row-counted against your live data. If non-empty data would be lost, the change **refuses** and lists the rows × tables that would be wiped. Overriding requires an explicit confirmation, and an automatic snapshot is taken first — the exact failure mode most teams don't discover until it's too late. **RPO: prevents the loss. RTO: instant (block).**
Layer 2 — Continuous PITR via pgBackRest
pgBackRest streams Postgres WAL to your S3 bucket every 60 seconds. The Time Machine UI in `/admin/platform/aegis` lets operators scrub to any second in the retention window and one-click restore. Postgres replays the WAL to that exact moment — no manual SQL surgery, no engineering escalation. Catches `DROP TABLE`, `db:reset`, ransomware encryption, accidental `TRUNCATE`. **RPO: ~30 seconds. RTO: 10–30 minutes.**
Layer 3 — Daily Logical Snapshots
Compressed `pg_dump` shipped daily (or on-demand) to your S3 bucket. Restore the whole DB, a single schema, specific tables, or one collection. Pre-restore auto-snapshot captures the current state — **undo the undo** if a restore was a mistake. Cleanest path for "restore last night's prod to staging" or "give me the state from April 1." **RPO: 24 hours default. RTO: 5–15 minutes.**
Layer 4 — Application Time Travel
Every write to a temporal collection records a reverse JSON Patch in the Aegis Temporal log. Reconstruct any document at any past timestamp via the QueryBuilder's `.asOf(timestamp)` modifier. One-click Version History panel in the admin UI per collection record. **Bulk-undo** lets an admin reverse "agent X just deleted 50 customer records by accident" with a filter (user, time range, collection) — three seconds, no service interruption. **RPO: 0 (live). RTO: instant.**
Real-World Scenarios — and the Layer That Catches Them.
Marketing claims aren't worth much. Below: actual recovery paths for the failure modes operators have hit.
An employee deleted 50 customer records by accident
Layer 4 — Bulk Undo. One click in the admin UI, filtered by user / time / collection. 50 records back. ~3 seconds total. No service interruption.
Our database got `db:reset` during deployment
Layer 2 — PITR Time Machine. Click the timeline at 9:47 AM (before the reset ran). Postgres restarts replaying the WAL. Service back in ~12 minutes with zero data loss.
Ransomware encrypted the production VPS
Layers 2 + 3 + Object Lock. Both PITR and snapshots stored off-machine in your S3 bucket with Object Lock — even credentialed access can't delete them during the retention window. Restore on a fresh VPS in under an hour.
Auditor walks in, demands SOC 2 evidence
Phase 4 — Compliance Reports. Auto-generated monthly. SOC 2 (CC6.1, CC7.1, A1.2), ISO 27001 (A.12.3.1), GDPR (Article 32) control mappings included. Self-contained HTML — print to PDF, hand it over.
A schema migration would drop a column with 12,000 rows
Layer 1 — Migration Guard. Migration **refuses** and tells you exactly how many rows × which columns would be lost. `--force-destructive` requires explicit override + auto-snapshot first.
User edited a doc 5 times, wants version 2 back
Layer 4 — Version History. Per-document timeline panel in the admin UI. Pick the version. Restore. Other rows unaffected.
Internal mistake — an agent edited the wrong tenant
Layer 4 — Per-tenant + per-user undo. The Temporal log records `userId` + `tenantId` on every event. Filter the undo by both. Other tenants stay untouched.
Postgres minor-version upgrade failed
Layer 3 — Full-DB restore. Logical snapshot is engine-version-agnostic (plain `pg_dump`). Drop the bad upgrade, restore the snapshot, retry on a clean version.
What Makes Aegis Different — and Honest.
Backup vendors lie. This is what most of them won't tell you.
Bring Your Own Bucket — your data, your keys
Works with AWS S3, Cloudflare R2, Wasabi, Backblaze B2, MinIO, DigitalOcean Spaces, and any S3-compatible endpoint. Your bucket. Your access keys. Your compliance posture. We never see your data unbroken — the encryption layer happens before upload.
Customer-managed encryption (CMK)
Optional client-side AES-256 encryption before upload. Aeion **cannot decrypt your backups for you** — by design. Lose the key, lose the backups. Zero-trust posture: no Aeion-side compromise can leak your data.
Object-Lock immutability
Enable S3 Object Lock and even credentialed access can't delete backups during the retention window. Defeats ransomware that gets your S3 keys.
Zero per-feature lock-in
PITR uses pgBackRest — the same tool AWS RDS, Crunchy Bridge, and EDB use. Logical snapshots use plain `pg_dump`. The artifacts are standard Postgres formats. Restore on any Postgres host, with or without Aeion.
Tested backups, not just taken
Weekly verification cron restores the latest backup into a temp DB, runs row-count anomaly checks, drops the temp DB. If verification fails, your auditors see `unmet` for the relevant SOC 2 controls — we won't lie about restorability.
Honest about what's deferred
We publish the list of capabilities still in design vs. shipped. You'll know if a feature is API-only without UI, or if a compliance report runs HTML-not-PDF. No surprises during an audit.
Measured Recovery — Real Numbers, Not Marketing
Aegis ships with verification metrics out of the box. These are observed values from the weekly verification cron on a 50 GB test database, not vendor promises.
| Scenario | RTO | RPO |
|---|---|---|
| Per-row undo via Version History | < 1 second | 0 |
| Bulk Undo (50 deleted records) | ~3 seconds | 0 |
| Application time-travel (`.asOf` query) | < 100 ms | 0 |
| Logical full-DB restore | 6 min 18 sec | 24 hours |
| PITR in-place restore to point-in-time | 14 min 42 sec | ~30 seconds |
| PITR sidecar selective restore (2 tables) | 22 min (incl. extract) | ~30 seconds |
| Verification cron (test restore) | 8 min 4 sec | n/a |
Compliance Control Mappings
Aegis-generated reports include explicit framework mappings. Drop the PDF in front of an auditor.
SOC 2
CC6.1 (logical access controls, encryption-at-rest), CC7.1 (system monitoring + verification metrics), A1.2 (availability + restore-tested commitments).
ISO 27001
A.12.3.1 (information backup procedures + verified restorability).
GDPR
Article 32 (security of processing, including backup encryption + access control + recovery procedures).
HIPAA
§ 164.308(a)(7)(ii)(A)–(D) (contingency plan + data backup + disaster recovery + emergency mode operation). Health-module-specific BAA available on request.
PCI-DSS
Requirement 9.5 (offsite backup storage with same level of security as production data).
Frequently Asked Questions
Hosting providers (AWS RDS, DigitalOcean Managed Databases, etc.) typically offer snapshot-based backups with limited point-in-time recovery and **no off-account immutability**. If your provider account is compromised, those backups can be deleted by the attacker. Aegis ships snapshots + WAL to **your** S3 bucket with **your** access keys — separate trust domain. Plus Aegis gives you per-row Bulk Undo and application time-travel, which no hosting provider offers.
PITR (Layer 2) gives you ~30 second RPO — you can rewind to almost any moment within the retention window. Snapshots (Layer 3) give you 24-hour granularity but are much faster to ship/store and engine-version-agnostic. Most teams want both: PITR for "I just typed the wrong thing," snapshots for "give me last week's data for analysis." Both are included with every Aeion deployment — Layer 3 works out of the box, Layer 2 needs a one-time BYOB PITR bootstrap.
You provide S3-compatible credentials in the admin Settings (access key + secret + endpoint URL + bucket name). Aegis uses those credentials to write snapshots + WAL. Your bucket. Your IAM. Your retention policy. You can rotate credentials at any time. Aeion doesn't have backup copies of your backups — we explicitly **don't** keep a Aeion-side mirror unless you also configure cross-region replication (included, off by default).
Your backups become **permanently unrecoverable**. This is by design — CMK is a zero-trust posture. We can't decrypt for you because we never have the key. For most teams, the right setup is: enable Aegis emergency-key escrow (included, opt-in) that holds the CMK in our HSM with a multi-party approval requirement. You control the recovery procedure; Aeion enforces it.
Weekly Verification Cron (included with every deployment). The cron picks the most recent snapshot, restores it into a temporary, isolated database, runs row-count anomaly checks, verifies foreign-key validity, and tears the temporary database down. The result — including measured RTO — is recorded automatically. Monthly compliance reports include the verification log. If verification fails, the relevant SOC 2 control flips to `unmet` in the report — we structurally won't lie about it.
pgBackRest streams WAL at the granularity of WAL segment switches (typically every few minutes under low write load) plus an `archive_timeout` setting that forces a switch at least every 60 seconds. So your effective RPO floor is ~30 seconds (the rolling average of "time since last segment switch"). Under heavy write load, segments switch more often and RPO drops further.
No. Aegis itself is stateless — the state lives in your bucket. If the Aeion control plane is unavailable, you can still run `pgbackrest restore` directly with the same credentials you configured. The artifacts are standard. If our facade dies you don't lose recovery — you lose the UI.
Aegis is included free with every Aeion deployment — the only cost is your S3 provider's storage + egress (typically $0.005–$0.023 / GB / month depending on provider; egress is free on Cloudflare R2 + Backblaze B2, ~$0.09 / GB on AWS S3). A typical 50 GB DB with 30-day PITR retention uses ~120 GB total — roughly $0.60–$2.80/month. Bring Your Own Bucket means you negotiate that directly with the cloud, no Aeion markup.
## Why we built Aegis instead of telling customers "use AWS Backup."
This is the failure pattern that ends careers: a routine schema change silently drops a table with real production data. If your WAL retention window is short and there's no off-machine backup, that data is gone for good — no undo, no recovery path, nothing to restore from. It happens more often than backup vendors like to admit, and it usually isn't caught until someone goes looking for data that's already gone.
Aegis was built so that customers running Aeion on their own VPS — without an in-house DBA — have all four defense layers operational by default. Layer 1 alone refuses the kind of migration that causes this exact failure. Layer 2 recovers from it even if it slips through. We didn't want to ship a backup product that couldn't have prevented the failure mode it was designed around.
Configure Aegis Before You Need It.
Aegis ships fully enabled with every Aeion deployment, no signup or upgrade required. Configure BYOB storage in `/admin/platform/aegis` to activate continuous PITR, weekly verification, and compliance reports.