1. Purpose
The purpose of this policy is to define the backup and offsite storage procedures for Speak AI Inc. to ensure data availability, integrity, and recoverability in the event of system failures, cyber incidents, or other unforeseen disruptions.
2. Scope
This policy applies to all critical business data, databases, and system configurations stored within Speak AI’s infrastructure, including cloud services and offsite storage solutions.
3. Backup Procedures- Backup Frequency: Databases are backed up by MongoDB Atlas automated cloud backup every 12 hours. Recordings and files in Amazon S3 are stored redundantly across multiple facilities in the region.
- Backup Retention: Backups are retained for 90 days, after which older backups are securely deleted unless required for compliance or legal purposes.
- Storage Location: Backups are securely stored in AWS cloud infrastructure within the designated data center (AWS Canada, ca-central-1).
- Backup Verification: Backup recoverability is verified by documented restore tests (see Restoration Procedures).
4. Offsite Storage- Cloud-Based Storage: Database backups are MongoDB Atlas automated cloud snapshots every 12 hours, replicated across AWS availability zones in Canada Central. Recordings and files are in Amazon S3, stored redundantly within the region.
- Encryption Standards: Backups are encrypted at rest using industry-standard AES encryption and in transit using TLS 1.2 or higher.
- Geographic Redundancy: Critical backups are replicated across multiple AWS availability zones to ensure resilience and accessibility in case of data center failures.
5. Access Control & Security- Restricted Access: Backup data access is strictly limited to authorized personnel and requires multi-factor authentication (MFA).
- Monitoring & Logging: Access to backup files is logged and monitored to detect unauthorized access attempts.
- Incident Response: In the event of unauthorized access or corruption of backup data, immediate action will be taken as per Speak AI’s Incident Response Policy.
6. Restoration Procedures- Recovery Objectives: Our recovery point objective (RPO) is 12 hours, matching the database snapshot cadence, and our recovery time objective (RTO) is 24 hours.
- Testing & Validation: The most recent documented restore test was 30 October 2024 (Atlas snapshot to an isolated test cluster, completed in about 7.5 minutes). The next test will be completed before the end of 2026; we share the outcome on request.
7. Compliance & Review- Regulatory Compliance: Speak AI ensures that backup storage and retention policies comply with industry standards and applicable privacy law such as PIPEDA and, where applicable, GDPR.
- Policy Review: This policy will be reviewed annually and updated as needed to incorporate best practices and emerging security threats.
8. Contact Information
For inquiries related to backup and offsite storage, contact Speak AI’s IT Security Team at success@speakai.co.