Backup and Data Recovery

This document formalizes the backup and data recovery policy of the Torneyo platform (torneyo.com and app.torneyo.com): what is backed up, how often, how long it is retained, how restoration is tested, and which recovery objectives are committed to. It can be attached to proposals, contracts, and public procurement processes as a formal commitment, together with the Service Level Agreement, Privacy and Data Protection (LGPD), the Technical Specification, and Infrastructure and Data Location.

Backup scope

Asset	Where it resides	Protection mechanism
Database (records, competitions, results, billing, audit trail)	Managed PostgreSQL database (Amazon RDS), São Paulo region — see Infrastructure and Data Location	Automated daily backup (snapshot) + point-in-time recovery
Files (photos, scanned documents, match sheets, attachments)	Object storage service (Cloudflare R2)	Multiple redundancy maintained by the provider, with enterprise-grade durability; file references included in the database backup
Infrastructure configuration	Versioned code repository	Infrastructure described as code, rebuildable from the repository

Frequency and method

• Automated daily database backup: a full snapshot is taken automatically by the managed service, every day, with no manual intervention.
• Point-in-time recovery (PITR): in addition to the daily snapshot, the managed service continuously retains transaction logs, allowing the database to be restored to any moment within the retention period — not only to the last snapshot.
• On-demand snapshots: before maintenance with potential structural impact on data (significant schema migrations), an additional manual snapshot is taken.

Retention

• Automated database backups are retained for at least 7 days, during which point-in-time recovery is available.
• Contracts requiring longer retention (30 days or more, or long-term copies) can include it as a project-specific condition, formalized in a proposal.
• Data deleted at the request of the data subject or the controlling organization leaves the backups as rotation cycles expire, as described in the privacy policy.

Recovery objectives (RPO and RTO)

Objective	Commitment	Note
RPO (maximum data loss)	24 hours	Formal commitment based on the daily cycle; in practice, point-in-time recovery typically allows restoring the database with only a few minutes of loss
RTO (maximum time to restore)	4 business hours	Counted from the decision to restore, for the full database restoration scenario

The values above are honest, verifiable commitments for the platform’s current scale. Scenarios requiring more aggressive RPO/RTO (real-time replica, multi-zone high availability) can be addressed as project-specific conditions — see the infrastructure transparency note in the SLA.

Periodic restore testing

There is no reliable backup without tested restoration. Torneyo commits to performing, at least once per quarter, a database restore test in an isolated environment, recording:

• date and time of the test;
• backup used (snapshot or point-in-time);
• result (intact/with caveats) and total restoration time.

Test records can be presented to the contracting party upon request through the formal support channel (contato@torneyo.com).

Self-service logical backup (full data export)

Independently of infrastructure backups, the contracting organization can generate its own logical backup at any time, without depending on Torneyo: the organization area offers a full data export in open formats (CSV/JSON/XML, with a data dictionary), available under Organization → Data export in the app. This guarantees portability and eliminates vendor lock-in, as detailed in the privacy policy and in Organizations, members and permissions.

Responsibility

The execution of this policy is the responsibility of the Torneyo technical team, coordinated by the data protection officer named in the privacy policy. Incidents involving data loss follow the incident communication flow described there (notification to the controlling organization within 24 hours).

Revision history

Version	Date	Changes
2026.08.19	2026-08-19	Initial version of the document.