Data protection is an extremely high priority at Zanda. This article gives background on the infrastructure and systems behind it, answering common questions about backups, security, and what happens if something goes wrong, including what backup, high availability, and disaster recovery each do and how they work together to keep your data safe.
How your data is protected against loss
The backups Zanda creates are point-in-time backups: rather than a single snapshot frozen at the moment the backup was taken, they let Zanda restore your data to almost any point in time within the retention window. Zanda creates these continuously as the system runs, and keeps them for 35 days, stored in a completely separate, secured area of Amazon Web Services (AWS) from your live production data.
Your data is stored and processed in the geographic region closest to your jurisdiction. Zanda runs complete, independent systems in Australia, the UK, and the US, and your data, including your backups, stays within your own region.
Your database is automatically mirrored across three separate locations within your region, so if one location has a problem, your data stays available with no manual intervention. Each of those three locations mirrors its own data again internally, so in practice your data exists in six places within your region at once. Files and attachments you upload get the same protection: they’re stored separately, in a system built specifically for file storage, with the same high durability and multi-region replication.
How Zanda knows backups actually work
Zanda is ISO 27001 certified, which requires regular, audited disaster recovery testing, including annual checks by external auditors. Beyond that requirement, Zanda also runs an automated weekly test: every weekend, a backup is restored onto an entirely new database system. A restore is only considered successful once a full set of checks confirms the restored data exactly matches what’s expected, including the most recent updates made to the database before the backup was taken. At most, the last test restore was conducted six days ago.
What happens if there’s a major system failure
If a major system failure occurred, Zanda would restore the databases first, using engineers experienced in this exact process. If the underlying servers were lost as well, Zanda would rebuild them from infrastructure as code: the entire server setup is defined in code, and new environments are created from it routinely (in fact, a fresh full environment is created for testing with every code change, taking just a few minutes).
The scope of recovery could potentially be all of the data held in your databases. That’s also the same scope Zanda already validates every week through the full-backup restore test, and audits as part of its ISO 27001 certification, so it isn’t an untested worst case.
Recovery time depends on how much data and infrastructure was affected, but a realistic estimate for restoring data and reconfiguring infrastructure is around 2 hours.
What backup and recovery processes protect against
- Accidental deletion - deleted items are marked for removal rather than deleted immediately, giving a window to restore them, backed further by point-in-time backup restores.
- Database and infrastructure failures - if one physical site has a power or hardware issue, traffic fails over automatically to one of the other two sites in the region, with no impact to you.
- Software errors - database-level rules reject data that isn’t saved or updated correctly, preventing a code mistake from corrupting your data.
- An AWS regional availability issue - because each region’s database is replicated across three physically separate sites, any one or two sites can go down and the system keeps running normally.
- Loss of an entire region - disaster recovery processes can rebuild databases and provision new infrastructure entirely from code.
Backup vs. high availability vs. disaster recovery
These three terms are often used interchangeably, but they mean different things:
| Concept | What it protects against | How it works |
|---|---|---|
| Backup | Needing to go back to an earlier state, such as an accidental edit or deletion | A copy of your data kept off to the side as a last resort, letting Zanda recover it to a point in time |
| High availability | A site-level problem causing visible downtime | Replication across three physical sites per region, each itself mirrored |
| Disaster recovery | A catastrophic incident affecting an entire region | Rebuilding databases and provisioning new infrastructure from code, validated by a weekly full restore test |
Note: For account-specific evidence such as a signed attestation, the exact date of the most recent restore test, or recovery time/recovery point objectives (RTO/RPO), see Responding to Security and Data Residency Audits. General certifications, hosting, and security documentation are also available on the Healthcare Data Security at Zanda page.
These systems and processes have been in place at Zanda for many years, and are continuously reviewed and improved over time.
Frequently Asked Questions
What type of backups does Zanda create?
Point-in-time backups. Rather than a single snapshot frozen at the moment the backup was taken, they let Zanda restore your data to almost any point in time within the retention window.
How long does Zanda keep backups?
Backups are kept for 35 days, stored in a separate, secured area of AWS from live production data.
Are files and attachments backed up the same way as database records?
Files and attachments are stored in a separate system built specifically for file storage, with the same high durability and multi-region replication as database backups.
How often is the backup and restore process tested?
An automated full restore test runs every weekend, in addition to the disaster recovery testing required for the ISO 27001 certification Zanda holds. At most, the last test restore was conducted six days ago.
What does Zanda check before considering a restore successful?
A full set of checks confirms the restored data exactly matches what’s expected, including the most recent updates made to the database before the backup was taken.
How much data could potentially need to be recovered?
Potentially all of the data held in your databases. That’s the same scope validated every week through the full-backup restore test, and audited as part of the ISO 27001 certification Zanda holds.
How quickly could Zanda restore service after a major failure?
A realistic estimate for restoring data and reconfiguring infrastructure is around 2 hours, though the actual time depends on how much data and infrastructure was affected.
Where is my data physically stored?
In the region closest to your jurisdiction. Zanda runs independent systems in Australia, the UK, and the US, and data, including backups, stays within your own region.