Point-in-time recovery (PITR) is available
Why it matters
Daily snapshot backups have a recovery point objective (RPO) of up to 24 hours — a catastrophic failure late in the day can erase a full day of transactions, orders, or user data. Point-in-time recovery compresses that window to minutes. ISO 25010 recoverability requires that the system can be restored to a recent-enough state to be operationally viable; for applications handling financial transactions, bookings, or communications, 24-hour data loss is not viable. Supabase Free tier provides only basic daily backups — many teams on free tier assume PITR is included until they need it.
Severity rationale
Medium because PITR absence means up to 24 hours of data loss in a disaster, which is tolerable only for applications with no financial or time-sensitive records.
Remediation
Verify your database platform plan includes PITR and document the recovery window. For Supabase, upgrade from Free to Pro. For self-hosted Postgres, enable WAL archiving.
# postgresql.conf — enable WAL archiving for self-hosted Postgres
wal_level = replica
archive_mode = on
archive_command = 'aws s3 cp %p s3://myapp-wal-archive/%f'
# Neon — branch from a specific timestamp (PITR via branching)
neon branches create --from-timestamp 2024-01-15T10:30:00Z
# AWS RDS — configure retention period
aws rds modify-db-instance \
--db-instance-identifier mydb \
--backup-retention-period 7
For Supabase: Pro plan ($25/month) enables daily PITR. Team plan ($599/month) enables per-minute PITR. Access PITR via Supabase Dashboard > Settings > Backups > Point in Time Recovery.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Database Design & Operations Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.recoverability — Recoverability
- soc2:2017 · A1.2 — Environmental protections, backup, and recovery infrastructure
- soc2:2017 · CC7.5 — Incident recovery
Taxons
History
- 2026-04-18·v1.0.0·Initial import from database-design-operations·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (A1.2, CC7.5) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2