Backup and restore

There is nothing to turn on. Every project with a database gets a backup every hour.

runlot pg generations

epoch/seq   Time                  Size
  3/17      2026-09-05 14:00      41 MB
  3/16      2026-09-05 13:00      41 MB
  3/15      2026-09-05 12:00      40 MB
  …

Retention

Backups are taken once an hour, so the number of backups matches the retention window.

The most recent backup is never deleted, regardless of age or count. Even a project that has been idle for a long time keeps its last backup.

When the data has not changed

If nothing has changed since the previous backup, no new backup is created. A record of the backup check is still kept. This keeps unused projects from storing many copies of identical data.

Even a project that was stopped automatically because it had no requests is started briefly at backup time, backed up, and stopped again. Being stopped never means skipping a backup.

Encryption and storage location

Each backup is encrypted with a per-project key. That key is in turn encrypted with a master key, and the encrypted backup data is stored in object storage in another region.

Restoring

runlot pg restore 3/15
runlot pg restore latest

Before a restore begins, a backup of the current data is taken first. So even if you restore the wrong backup, you can get back to the state you were in before the restore.

The current data is backed up first, then restored from backup 3/15. Anything written after that point is lost.
Type the project name to continue: my-app

To restore, you must type the project name exactly. We do not accept a simple yes/no confirmation for an action that is hard to undo. This command requires the admin role.

Even with latest, the CLI lists the backups first and shows you the one it will actually restore, so that what you saw on screen and what gets restored cannot diverge.

Right after a restore

A restore stops the project and starts it again from the backup you chose. For up to 3 seconds after it starts, database requests may get a 57P03 error. See the reactivation window for details.

Which points in time you can restore to

Restoring to an arbitrary point in time is not offered. You can only choose one of the hourly backups. The reasoning behind this limit is explained in the 150 MB cap — it comes down to the cost of taking a single backup.

Diagnostic exports are not backups

runlot pg export

The file this command produces is not managed as a backup and cannot be used to restore. Use it to share your current state with a support request.