Backup and recovery
What is backed up, what recovery looks like, and what cannot be recovered.
Database
Aurora provides continuous backup with point-in-time recovery. The recovery unit is the cluster, not an institution — restoring a single tenant’s data after an accidental deletion is a restore-and-extract operation, not a button.
Object storage
Uploaded syllabi, scanned scripts, recordings and generated media live in S3, versioned and lifecycle-managed. Objects are served through the application rather than from a public bucket, so a leaked URL is not a leaked file.
Infrastructure and code
Infrastructure is Terraform with remote state, so the environment is reproducible from version control. That is the real disaster-recovery story for everything except the data itself.
What is not recoverable
Deleting an institution removes its data. Rebuilding a tenant means re-creating it and re-seeding — courses can be re-cloned and re-generated, but student attempt history is gone. Treat tenant deletion as irreversible in practice, whatever the backup schedule says.
Generated content is reproducible, not free
Losing generated material is recoverable by regenerating — but regeneration costs the same as the original run. Backups matter more for cost than for possibility.