Disaster Recovery
How Wytness protects your audit data, what happens when things go wrong, and our recovery commitments.
Defence in Depth
Every audit event passes through multiple independent storage layers. No single failure causes permanent data loss. The append-only archive is the ultimate source of truth — every verified event is stored with 7-year retention and a soft-delete recovery window, and every event is Ed25519-signed and hash-chained so any tampering is cryptographically detectable.
| Storage Layer | Purpose | Max Data Loss (RPO) | Recovery Time (RTO) |
|---|---|---|---|
| Operational database | Users, orgs, API keys, signing keys | < 5 minutes | < 1 hour |
| Analytics store (hot retention) | Queryable audit events and anomaly alerts | 0 (rebuildable from archive) | Minutes (restart) or hours (full rebuild) |
| Archive store (cold retention) | Append-only encrypted Azure Blob archive of every verified event (7-year retention with a soft-delete recovery window) | 0 | < 15 minutes |
| SDK offline buffer | Local fallback file when API is unreachable | 0 | Automatic on next successful call |
SDK Offline Resilience
If our API becomes unreachable, your agents don't stop working. The SDK has built-in offline buffering with automatic replay.
Your agent performs an action. The SDK signs the event locally with Ed25519.
SDK attempts to send the event. Connection fails.
Event is written to a local fallback file. No data is lost.
On the next successful call, the SDK automatically replays all buffered events in order.
Successfully replayed events are removed. Failures remain for the next attempt.
Both Python and TypeScript SDKs implement this pattern. Your agent code requires no changes — offline resilience is automatic.
What Happens When Things Go Wrong
| Scenario | Your Experience | Your Data |
|---|---|---|
| API outage | SDK buffers events locally; dashboard temporarily unavailable | No event loss — buffered events replay automatically |
| Analytics store down | Dashboard queries unavailable; ingest queues to SDK buffer | No event loss — archive is independent and rebuilds the analytics store on recovery |
| Archive store down | Ingest still writes the analytics store; events queue for archive retry | No event loss — events held in a dead-letter queue on persistent failure |
| Database outage | Login and dashboard unavailable | Point-in-time recovery within minutes |
| Full region outage | Platform temporarily unavailable | No permanent data loss — database backups are geo-replicated to a secondary region; the audit archive is preserved with a soft-delete recovery window |
Infrastructure SLAs
Built on cloud infrastructure with high-availability SLAs (99.95% / 99.99% depending on service). See Pricing for per-tier availability and support response commitments.