Backups: RPO and RTO

Play this lesson

Two promises

Amazon's guide to reliable systems names two numbers a team decides in advance:

RPO, the recovery point objective: "the maximum acceptable amount of time since the last data recovery point." It is how much data the team can afford to lose.

RTO, the recovery time objective: "the maximum acceptable delay between the interruption of service and restoration of service." It is how long the game can be down.

On a timeline

The last good copy of the data is from 03:00. Disaster strikes at 14:20. The game is back at 16:20.

Everything players did between 03:00 and 14:20 is lost: 11 hours 20 minutes of data. The game was down for 2 hours.

Do the math

incident
last good copy  06:00disaster        09:30game back       10:15

How much data was lost, and how long was the game down?

  1. 3 h 30 min lost, 45 min down
  2. 45 min lost, 3 h 30 min down
  3. 4 h 15 min of each
Show the answer

3 h 30 min lost, 45 min down

Data from 06:00 to 09:30 is lost: 3 hours 30 minutes. The game was down from 09:30 to 10:15: 45 minutes.

Firestore's two tools

Point-in-time recovery (PITR) keeps "a single version per minute", "retained for 7 days". It is "disabled by default", so a team turns it on.

Scheduled backups run daily or weekly, and each can be kept for up to 14 weeks. A restore "writes the data from a backup to a new Cloud Firestore database."

Quick check

A bug quietly damaged gardens 10 days ago, and Remy only noticed today. Which tool can still help?

  1. A scheduled backup: PITR only reaches back 7 days
  2. PITR
  3. Neither
Show the answer

A scheduled backup: PITR only reaches back 7 days

PITR keeps 7 days. A backup kept for weeks still holds the gardens from before the bug.

A target, not an average

Amazon compares RTO with MTTR, mean time to recovery. MTTR is "a mean value taken over several" incidents. RTO is "a target, or maximum value allowed, for a single" one.

An average of 30 minutes can hide one 8-hour outage.

A backup nobody restored

Firestore warns that a restore "will take some time and must complete before the database is accessible." Nobody knows how long until they try.

Remy restores a backup into staging every month and times it, so the RTO is a measured number, not a hope.

Quick check

A backup that has never been restored still proves the team can meet its RTO.

Show the answer

False

Only a timed restore shows how long recovery takes, and that the backup actually works.

Pick the protection

Different protections restore to different moments.

Bolt says: Next: find the one that meets an RPO.

Fact-checked 12 October 2026