BACKUP & DISASTER RECOVERY
Guardian's architecture is local-first: the safety-critical path (camera ingestion, on-device AI inference, in-school PA, and alert acknowledgement) operates without internet connectivity. This page describes how cloud-side data is backed up, the targets we commit to, and the procedures we follow when things go wrong.
1. RECOVERY OBJECTIVES
| System / Data Class | RPO | RTO |
|---|---|---|
| In-school safety pipeline (local-first) | 0 (continues offline) | 0 (no cloud dependency) |
| Alert dispatch (PSAP, mass notification) | 15 minutes | 60 minutes |
| Compliance / audit logs (FERPA evidence) | 5 minutes | 4 hours |
| Visitor management | 1 hour | 4 hours |
| Drill records | 1 hour | 8 hours |
| Administrative dashboard | 1 hour | 8 hours |
RPO = Recovery Point Objective (max data loss window). RTO = Recovery Time Objective (max time to restore service).
2. BACKUP CADENCE
- Firestore (primary datastore): Native point-in-time recovery (PITR) with a 7-day rolling window. A scheduled Cloud Function exports a full snapshot to a separate project-scoped storage bucket nightly at 02:00 UTC.
- Cloud Storage (artifacts, photos, audio): Bucket-level versioning enabled; deleted objects retained for 30 days. Multi-region replication for buckets housing compliance artifacts.
- Auth identities: Firebase Auth identities are exported weekly via the Admin SDK and stored encrypted at rest in the same backup bucket.
- Configuration (Firestore Rules, Indexes, Functions): Source-controlled in Git; deployable from any commit via
firebase deploy. - In-school sidecar configuration: Generated from district records; can be regenerated in under 5 minutes for any school.
3. BACKUP TESTING
Backups are tested on a quarterly cycle. The drill executes a full restore of the most recent nightly snapshot to a throwaway environment, runs the compliance report generator against the restored data, and verifies row-count parity with the source. The most recent test result is available on request to district administrators.
4. INCIDENT RESPONSE
When a cloud-side incident triggers a Sev-1 declaration, the following sequence runs:
- Detection (≤5 min): Monitoring (Sentry + Cloud Logging alerts) pages the on-call engineer.
- Acknowledgement (≤5 min): On-call acknowledges and opens an incident channel.
- Containment (≤30 min): Isolate the affected component; in-school operations confirmed unaffected.
- Customer notification (≤60 min for Sev-1): Status page updated; district safety contacts emailed for anything affecting alert dispatch or PSAP integration.
- Recovery (per RTO): Restore from the most recent backup or roll forward from PITR.
- Post-incident review (≤5 business days): Blameless write-up published to affected districts.
5. LOCAL-FIRST DEGRADED MODE
Guardian's in-school sidecar runs the full safety pipeline locally. If cloud connectivity is severed (district ISP outage, cloud-side incident, etc.), the school retains:
- Camera ingestion + on-device AI inference.
- Local alarm panel, PA announcement, signage, and strobe integration (LAN-based, no internet required).
- Staff alert acknowledgement via the in-school admin tablet.
- Local visitor management with delayed cloud sync (queued and replayed when connectivity returns).
Cloud-dependent features that degrade during an outage: cross-school visibility, district dashboard, mass-notification to off-campus channels (SMS / email / voice), and PSAP dispatch via RapidSOS. The fallback for PSAP is the school's analog 911 plan — Guardian never replaces that.
6. DATA EGRESS
On contract termination or upon district request, a full export of district-owned data (Firestore snapshot + Cloud Storage artifacts) is delivered within 30 days at no charge. Standard formats:
- Firestore data: NDJSON, one file per collection, tar-gzipped.
- Cloud Storage: original encoding preserved; directory structure mirrors the production layout.
- Audit logs: CSV (one file per year), aligned with the compliance report schema.
Delivery method: signed URLs (7-day expiry) for download, or shipped on encrypted media at district expense.
This page is incorporated by reference into the Guardian SLA. It is reviewed quarterly and updated within 14 days of any material change. The current version always lives at this URL.