Owner: Matthew · Maintained by: Hermes (docs) + OpenCode (implementation)
Version: 1.2 (2026-08-16) · DSPT: Category 3 — technical controls (standards 7–10);
backup + tested restoration evidence is part of the platform's DSPT return.
| Domain | What it is | Who is responsible |
|---|---|---|
| VeriPath platform data | Our own stack: app DBs, wiki, Keycloak, Forgejo, code, configs, volumes | VeriPath |
| Client VPS data | Data on/for a client's VPS. Under SIAAS the VPS is the client's property; client data must not be held on VeriPath infrastructure | The client |
Client VPS data — VeriPath does NOT back it up, and does NOT hold it.
Under SIAAS the client VPS belongs to the client and VeriPath must not hold client data on
its own infrastructure. Data protection is the client's responsibility — but VeriPath
operates the backup pipeline as a managed service (Option C, decided 2026-08-16):
Platform data — VeriPath keeps its own backup strategy.
The platform backup chain (local dumps → GPG → borg vault on the backup VPS
77.68.112.126, plus volume snapshots) is retained, monitored daily, and restore-tested.
This is non-negotiable DSPT evidence.
Client backup mechanism — DECIDED (2026-08-16): Option C (client-owned box,
VeriPath-operated managed service; see §2.1). Implementation pending:
(a) clean scripts + onboarding runbook + heartbeat/alerting built by OpenCode,
(b) one real (even test) Hetzner Storage Box purchased to prove the pipeline end-to-end,
(c) restore-test procedure evidenced per client. When live: backup assurance (last
backup, age, restore-test date) folds into the daily check-in and dashboards.
Platform option still under review: use a separate VeriPath-owned Hetzner Storage Box
as a provider-independent off-site vault for PLATFORM backups (decision pending with
Matthew, 2026-08-16).
Build tracker: security/client-vps-backup-plan.
/opt/backup-client.py @02:30),ClientBackupLog monitoring for client tenants, and the practice-specific parts ofbackup-health / check-backup-status.py.security/security-check-in).Source: hetzner.com/storage/storage-box (viewed 2026-08-16). Self-managed online storage,
"secure & cheap online backup solution". Sizes 1 / 5 / 10 / 20 TB; unlimited traffic;
10 concurrent connections; sub-accounts. Protocols: FTP, FTPS, SFTP, SCP, Samba/CIFS,
BorgBackup, Restic, Rclone, rsync via SSH, HTTPS, WebDAV — usable as a network drive.
Storage location Germany (FSN1) or Finland (HEL1); GDPR Art 28 DPA available. Optional
automatic snapshots. Pricing (per research 2026-08-16): BX11 1 TB ≈ €3.20/month —
confirm at order (prices JS-loaded on site).
Relevance: native BorgBackup support means the existing platform borg vault pattern can
target a Storage Box directly as a second, provider-independent repository.
Sub-account caveat (decided design point, 2026-08-16): Hetzner states the MAIN user has
full access to all sub-account directories. For Option C the client must therefore be the
main user of their own box, and VeriPath the sub-account (backup directory only) — never
the reverse. The master-box/reseller model was rejected on this ground.
S3 API; ≈ €4.99/month for 1 TB (incl. 1 TB download). Only needed for continuous-archiving
tools (WAL-G, Barman). Not required at current scale — daily dumps + snapshots suffice;
revisit if/when point-in-time recovery becomes a requirement.
Evaluated 2026-08-16 (fasthosts.co.uk/package-selection/cyber-protect): three tiers
(Basic / Advanced Security / Advanced Management), per-month storage pricing 5GB–40TB,
Acronis Universal Restore, Active Protection (ransomware), CyberFit score. Set aside:
licensing complexity vs cheaper external-storage alternatives; PostgreSQL support not stated
on the product page.