Database backups
- Production database is hosted on managed cloud infrastructure with automated daily backups maintained by the platform provider.
- Backup frequency: daily automated snapshots.
- Retention: 7 days rolling on the current managed plan. Longer retention or point-in-time recovery (PITR) becomes available on higher infrastructure tiers and will be enabled as the platform scales.
- Backups are stored by the infrastructure provider, encrypted at rest, and are not directly downloadable by firm users.
File storage backups
- Uploaded documents live in private, per-firm storage folders served via short-lived signed URLs.
- Object storage is hosted on managed infrastructure with provider-side redundancy. Cross-region replication is not currently enabled.
- Firm admins can export document metadata at any time from
/app/export. Bulk file-byte export is not currently offered through the app.
Recovery process
- Restore of the full production database is performed by the platform operator using provider tooling. Firm users cannot self-initiate a full-database restore.
- For accidental deletions within a firm, contact support@taxagentportal.com.au as soon as possible. We will assess what can be recovered from the most recent snapshot.
- Expected recovery posture: best-effort restore from the most recent successful daily backup. Data written between the most recent backup and the incident may not be recoverable.
Firm data export (self-service)
- Firm admins can download CSV exports of their own firm's data from
/app/export: clients, jobs, invoices, payments, organizer assignments, missing-info requests, document metadata, message thread metadata, and recent audit logs. - Every export is scoped strictly to the caller's firm.
- Every export is written to the firm audit log.
- Client users and staff without admin permission cannot export firm data.
Incident response
Suspected data loss, security incidents, or restore requests: support@taxagentportal.com.au. Please include the firm name, the affected dataset, and the approximate time the issue occurred.
What we do not claim
We do not claim "guaranteed recovery", "zero data loss", "bank-level security", "ATO approved", or SOC 2 / ISO 27001 certification. We operate on managed cloud infrastructure and follow standard backup, access-control and audit-logging practices appropriate to the current stage of the platform.