Time-Travel Your Database. Survive Any Mistake.
Every CTO has a "we lost a week of work" story. Aeion built Aegis specifically to make sure you don't. Continuous point-in-time recovery (~30s RPO) via pgBackRest. Per-document version history that undoes any miskey. Bulk-undo for AI-generated batch edits gone wrong. Weekly automated verification + monthly compliance reports. Object-lock immutability against ransomware. Aegis ships on every Aeion deployment from day one, not as an upgrade.
The 4 Layers of Aegis Data Protection
Layer 1 — Pre-Destructive Migration Guard
The cheapest, fastest defense. Before any schema change that would drop a table or column holding real data, Aeion checks the live row count and refuses to apply it. An explicit override exists for when you really mean it — and even then, Aeion takes an automatic snapshot first, just in case. Built in direct response to a real incident (see below).
Layer 2 — Continuous PITR via pgBackRest
~30s RPO continuous backup. Full base backups every 6 hours, WAL streaming continuous. Restore to any second within retention window (Starter 7d / Professional 30d / Enterprise 90d+, configurable). The "I dropped a prod table" recovery path.
Layer 3 — Logical Snapshots → BYOB S3
Daily + weekly + on-demand pg_dump compressed to S3. Full / table / collection-level restore. Customer-controlled bucket, customer-managed encryption keys, S3 object-lock for ransomware resistance.
Layer 4 — Application Time Travel
Per-document version history means `QueryBuilder.asOf(timestamp)` can read any document exactly as it existed at any past moment. Bulk-undo via Temporal DB rolls back AI-generated batch edits in one action. A version-history panel shows up automatically on every collection's detail view — no separate tool required.
Verification — Weekly Automated
Cron spins up temp Postgres, restores latest backup, runs integrity checks (row counts, FK validity, sample queries, schema-hash match), drops temp DB. Records pass/fail + measured RTO. Untested backups aren't backups.
Compliance Reports — Monthly Auto-Generated
PDF + JSON listing 90 days of backups, verification tests, retention policy, encryption mode, mappings to SOC 2 / ISO 27001 / HIPAA. Auto-published for customer self-service download.
Aegis Hub UI
Self-serve restore wizard. Pick backup → choose mode (full / tables / collection / point-in-time) → preview diff → confirm. No shell access required. Operations team can restore without engineering.
22-Event Notification Fan-Out
Backup completed, backup failed, verification passed, verification failed, archive lag high, encryption key rotation due — all surface via Notifications + Slack + email + webhook.
The Incident That Triggered Aegis
Aegis exists because Aeion experienced the failure mode it now prevents.
What Each Layer Catches
Real failure modes mapped to the Aegis layer that prevents/recovers.
Customer-Owned Backup Sovereignty
BYOB S3
Point Aegis at your own bucket — AWS S3, Cloudflare R2, Wasabi, Backblaze B2, DigitalOcean Spaces, or MinIO — and your backups never leave storage you control.
Customer-managed AES-256 keys
Encrypt with keys only you hold, so even Aeion staff can't decrypt your backups without your authorization.
S3 object-lock immutability
Backups become undeletable for their retention window, so ransomware can't wipe them even with compromised credentials.
Off-vendor portability
Backups are stored in standard pg_dump and WAL formats, restorable anywhere — never proprietary lock-in.
Cross-region replication
Enterprise tier writes to multiple repos at once — primary S3, secondary S3, and on-prem — for true geographic redundancy.
Air-gapped deployment
Enterprise tier runs fully offline, with backups landing on local NAS or your own on-prem object store.
Aeion-managed vault
An opt-in convenience for smaller teams — a per-tenant bucket in Aeion's own storage, no setup required.
Three encryption modes
Choose S3-SSE by default, bring your own customer-managed key, or opt into emergency-key escrow.
The Compliance Story Aegis Enables
Aegis isn't just data protection — it's the compliance evidence layer.
CTO + ops + compliance questions
Your bucket. BYOB S3 (AWS, R2, Wasabi, Backblaze, DO Spaces, MinIO). Customer-managed AES-256 encryption keys. Even Aeion staff cannot decrypt without your authorization. Aeion-managed vault available as opt-in SMB convenience.
Measured per Aegis tier by the automated weekly verification run. Typical: full-DB restore ~5-15 min, selective table restore ~2-5 min, per-document restore <1 min. Every run is logged for audit evidence.
Yes — Enterprise tier supports multi-repo backups. Primary S3 (e.g. AWS us-east-1) + secondary S3 (eu-west-1) + on-prem NAS. Customer chooses geographies; Aegis writes to all configured repos in parallel.
S3 object-lock (compliance mode) makes backup objects unmodifiable + undeletable for configured retention period. Even compromised VPS credentials cannot wipe backups. Off-default for Starter, on-default for Enterprise.
Enterprise air-gapped tier supports local-NAS backup destinations + on-prem MinIO + customer-owned object stores. No internet egress required. Verification runs on the same air-gapped infrastructure.
Yes — Aegis Hub restore wizard supports "restore to staging tenant." Spin up a sidecar Postgres, restore to it, point your staging environment, run tests, discard the sidecar.
Temporal DB watches every create, update, and delete across your collections and stores a reverse patch for each change. `QueryBuilder.asOf(timestamp)` replays those reverse patches to reconstruct any document exactly as it looked at a past moment. Bulk-undo applies the same replay across a whole batch — e.g., "undo all AI-generated edits from the last 4 hours."
Yes — Files module uploads are versioned. Aegis Phase 1 + Phase 2 snapshot the file-metadata DB; the underlying S3 object versions remain accessible via the version-history API.
Aegis Hub has a "Verify Now" button on the Verification tab. Spins up a temp Postgres, restores the latest backup, runs the integrity-check suite, records the result. Self-service drill testing for your compliance officer.