BizBarrel Data Safety
User data is sacred. This page explains what protects your information today, and the Safety Launch Protocol we are building toward.
1. Core principle
No deployment, update, or maintenance action should proceed unless backup layers are healthy and recent. Production is a protected environment. The full protocol is documented for operators in Safety Launch Protocol.
2. What protects you today
- Account isolation — your trees, posts, and settings are tied to your signed-in account.
- Encrypted transit — TLS on live deployments where HTTPS is configured.
- Operator backups — before risky changes, operators snapshot the database and
uploads/(Forge Admin → Backup, or CLI). Off-host copies can be configured (external disk / NAS / optional cloud sync); automated restore drills and public backup SLAs remain target, not live guarantees. - No secrets in the repo — live DB/mail config stays in
live/, not committed source. - Staging discipline (process + gate) — operators promote via staging with a pre-deploy backup check; direct FTP surgery of production is prohibited by protocol. Full hosted staging locks remain target.
Guest (trial) Forge data stays in the browser until you sign in. Guest Photo Album uploads are capped, not stored on the server, and cleared when the guest session ends.
3. Version history available now
Partial product versioning already exists; universal restore for every item type is still phased.
- Photo Album — photo versions (prior image states).
- Blog — post revisions for the blog owner.
- Stash Box — put away / restore owned tree nodes from Archive and Research.
4. Safety Launch Protocol (target)
- Daily full DB snapshots off-server, retained ~30 days; hourly incrementals ~48 hours.
- Triple-copy redundancy — production, mirrored read-only, cloud archive (S3/B2/Wasabi).
- User-level versioning — chains, notes, feeds, Organizer items with restore; admin global restore.
- Pre-launch backup lock — deploy blocked until fresh DB/file snapshots and mirrors sync.
- Staging-first — promote from staging after automated checks; production write lock (manual unlock, auto-revert ~30 minutes).
- Shadow copies & point-in-time recovery; Disaster Recovery Mode (read-only mirror) if production is unavailable.
- Backup Health Dashboard — last backup, size, mirror sync, restore-test results, failure alerts.
- Weekly automated restore tests — spin up, restore, validate, destroy.
Full CPR text for operators and agents: docs/safety-launch-protocol.md.
5. Retention & recovery (honest)
Operators can run an automated restore drill into a throwaway database to verify snapshots. Until scheduled off-server copies and regular drills are habitual in production, there is no published point-in-time guarantee.
When the target layers ship, this page will state concrete schedules and what users can expect to restore.
6. Your controls
- Export my data — signed-in Settings offers a zip of your profile, settings, Archive notes, blog posts, and photo album metadata (paths only, not full image binaries). Full media packs and self-serve restore remain phased.
- Account and preference data follow the same safety rules as content; see Privacy Policy for collection and use.
7. Privacy & related
Data Safety covers protection and recovery discipline. Privacy Policy covers what we collect and how we use it. Terms of Use and Accessibility cover use of the service and access.