Business Continuity + Disaster Recovery Policy

Owner: Security + SRE. Review cadence: annual or on material change. Approver: CEO.

This is the company-level policy that ties MeterBox's continuity-of-service commitments to the constituent procedures already in place. It is short. The procedures it names (IR plan, DR restore drill, InfoSec policy, access review, backup mirror, reclaim sweeper) carry the operational detail. This policy is what an auditor reads to confirm that we have a coherent BCP/DR program, not the operational manual.

1 — Purpose + scope

Define how MeterBox preserves availability and recovers from disruptions to the production systems that handle tenant billing and metering. Covers: the control plane, every tenant's data plane, the off-cluster backup mirror, and the supporting Kubernetes + cloud-vendor infrastructure.

Does not cover: a tenant's own end-customer-facing systems (the tenant owns those — see the privacy page processor framing).

2 — Roles + responsibilities

CEO — owns this policy. Approves material changes. Declares a business-continuity event (Sev-0 with multi-day impact, prolonged staff outage, regulator engagement).
Security lead — drafts + maintains this policy. Owns the annual BCP tabletop. Coordinates with legal on regulator + customer notice when an event triggers statutory obligations.
SRE — runs the quarterly DR restore drill. Owns vendor-side failure containment (cloud, KMS, transport).
On-call — runs the incident response plan for the rotation week they hold; escalates to BCP scope when impact crosses the thresholds in § 4.

3 — Business-level recovery objectives

Per-tenant numerical targets live in the DR restore drill (RPO ≤ 24h, RTO ≤ 60m). The business-level commitments are:

Control plane (/cp/*): the company commits to restoring the control plane to a working state within 4 hours of a Sev-0 outage. Recovery uses the cluster's bundled Postgres + the reclaim backup PVC.
Tenant data plane (/v1/*): per-tenant restoration runs in parallel per the DR drill RTO (≤ 60m per tenant). All-tenant recovery is bounded by SRE capacity, not per-tenant RTO; the company commits to 8 hours for the median tenant on a multi-tenant Sev-0 event.
Billing close (the scripts/close.js month-end run): if it cannot complete during its normal window, it MUST complete within 5 calendar days of the affected period close. Bills are issued on the resumed run; no double-charging.
Email delivery (verification, MFA, alerts): degraded delivery tolerated for 2 hours; longer outages trigger the IR plan and a secondary transport configured via email.setTransport().

4 — Inventory of critical processes

Process	What it depends on	If it stops
Signup + login	Control plane, Postgres, Redis, email transport	New customers cannot onboard. MFA + password reset still work for existing customers if email is up.
`/cp/*` admin API	Control plane, Postgres, Redis	Tenants cannot manage plans, customers, settings, audit log review.
`/v1/*` data plane	Tenant data-plane pod, Postgres, Redis	Tenant cannot meter or look up entitlements. End-customer-facing serving in the tenant's app blocks.
Billing close	Stripe, ledger	Invoices not issued for the affected period.
Backup mirror sweep	Per-org `backup_target`, cloud bucket, KMS (if configured)	Backups age beyond the 24h RPO.
Reclaim sweeper	Backup mirror, deletion lifecycle	Reclaim backups for deleted environments not produced.
Audit log + integrity verification	Postgres, hash-chain	Compliance evidence gap; existing rows remain valid.
Alert notifications	Email transport + per-org webhook URL	High-severity security alerts not fanned out (rolled-up state still visible in SettingsPage).
SCIM provisioning	Control plane, identity provider	Enterprise IdP cannot create / disable accounts.

5 — Risk scenarios + planned response

Scenario	Severity	Response
Regional cloud outage	Sev-0	Activate IR plan; for the Managed tier with multi-region option enabled, fail over per the customer's region preference. Single-region tenants wait out the provider RTO. Status page update every 60m.
Control-plane Postgres loss	Sev-0	Restore from the bundled PVC backup + replay WAL since last snapshot. RTO target ≤ 4h (§ 3).
Tenant data-plane loss	Sev-1 (one tenant) / Sev-0 (many)	Per-tenant restore via the DR drill procedure. Tenant comms per the IR plan customer template.
Off-cluster backup mirror unreachable	Sev-2	RPO grows past 24h after one missed sweep; SRE investigates target adapter or KMS access. If sustained, opens Sev-1 because subsequent DR drill would fail.
Supply-chain compromise (npm package, base image)	Sev-1	Per vulnerability disclosure policy escalation: revoke affected secrets, pin lockfile, rebuild + redeploy from clean base, audit the affected window in the audit log.
Ransomware on operator workstation	Sev-1	Revoke all credentials issued to the workstation (production access, GitHub, cloud, KMS), rotate per operator-runbook § 1.5, workstation reimaged from gold image, post-mortem within 5 business days.
Key staff unavailability (≥ 5 business days)	Sev-2	Backup on-call assumes IR rotation per IR plan § on-call rotation. Quarterly DR drill rotation includes a backup runner.
Prolonged staff outage (> 30 days, multiple staff)	BCP event	CEO declares. Engagement of contractor pool for sustaining engineering, in scope only for stop-the-bleed work; new feature work paused.

6 — Constituent procedures

Incident Response Plan — operational triage, containment, post-mortem.
DR Restore Drill — per-tenant restore procedure
- measured RPO/RTO + quarterly cadence.
InfoSec Policy — access control, change management, secret management.
Vulnerability Disclosure Policy — external report intake + safe-harbor.
Penetration Testing — annual external pentest cadence.
Audit Trail Architecture — forensic evidence, hash chain, retention sweeper.
Operator Runbook — production access, key rotation, day-to-day drills.
GET /cp/access-review — quarterly access posture snapshot (CSV).

7 — Communications during a continuity event

Status page — updated within 60 minutes of a Sev-0 declaration and every 60 minutes thereafter until resolved. URL surfaced in outbound security-alert emails via METERBOX_STATUS_PAGE_URL (see .env.example).
Customer email — affected tenants notified per the IR plan customer template. Sev-0 all-tenant events go out via the email transport with a copy posted to the status page.
Internal channel — #inc-<yyyymmdd-name> per the IR plan.
Regulator + legal — when an event meets statutory notification thresholds (e.g. GDPR Art. 33 personal-data breach, 72-hour clock), Security lead engages legal within 24 hours of confirming the threshold is met.

8 — Vendor + subprocessor continuity

The public subprocessor list at /subprocessors names the operationally critical vendors. Per-vendor continuity:

Stripe — billing close + Stripe Checkout depend on it. Outage: billing close defers until Stripe is back; no double-charging on resume. No automated fail-over (Stripe is the system of record for invoices).
Auth0 — control-plane SSO. Outage: tenants using SSO cannot sign in; the password + MFA path keeps working as a fallback.
Resend — email transport. Outage: swap to a secondary transport via email.setTransport() (commit + redeploy or sealed-secret rotation).
Cloud hyperscalers (AWS, GCP, Azure) — backbone for the Managed tier. Outage: regional outage handled per the cloud's documented RTO; single-region tenants wait it out. Multi-region tenants fail over per region preference.

Vendor SOC 2 / ISO letters collected annually per the InfoSec policy vendor management section.

9 — Staff continuity

No critical role is held by exactly one person.
- On-call rotation has primary + secondary + engineering lead + Security lead escalation per IR plan.
- DR drill rotation: SRE primary + Security observer; a backup runner rotates in once a year so two people stay current.
- Production access is least-privilege but never single-person — at minimum the CEO + Security lead hold owner-level access to every production system.
Emergency contact list maintained by the Security lead and reviewed quarterly. Contact list lives in the company password manager.

10 — Testing + drill cadence

Quarterly — DR restore drill per dr-restore-drill.md. Logged under docs/compliance/dr-drills/<YYYY-Qn>.md.
Quarterly — IR tabletop per incident-response.md. Logged under docs/compliance/tabletops/<YYYY-Qn>.md.
Annual — full BCP tabletop exercising one of the § 5 scenarios end- to-end with the Security lead + SRE + CEO. Logged under docs/compliance/bcp-tabletops/<YYYY>.md.
Continuous — backup-mirror sweep nightly; reclaim sweeper hourly; access-review snapshot on demand via GET /cp/access-review.

11 — Review + version control

This policy is reviewed annually or on material change (new tier, new critical vendor, new region, regulator-driven requirement). Material changes go through PR review + CEO sign-off and a CHANGELOG entry.

Last reviewed: 2026-06-04