Security, backup and recovery
🏠The everyday picture
A bank's vault: strong door, staff with only the keys they need, a log of every opening, copies of records in another city, and regular drills to prove the copies work.
📘What it really is
Before calling the CRM finished, check:
- Access:
- the app connects as a least-privilege role; migrations and reporting use their own roles (Module 58);
- the API enforces permissions at every level (Module 48), and row-level security adds isolation if you have several organisations (Module 60);
- no SQL built from user input; sort and filter fields from allow-lists;
- connection strings and passwords only in environment variables;
- the database not reachable from the public internet except through what's necessary (managed services' network settings, or firewalls, Level 6).
- Personal data: only what's needed; who can see it; how a person's data can be exported or deleted on request.
- Backup and recovery:
- automated backups following 3-2-1, encrypted (Module 58);
- a demonstrated restore: restore the latest backup into a separate database, verify it with row counts and key queries, time it, and document the steps. This is required to pass Level 5.
- Integrity tests: automated tests showing the database refuses bad data and keeps transactions atomic (Module 61).
🖱️Try it
Go through the checklist above and record each item in SECURITY.md and admin.md. Perform and record a full restore
drill: back up, "lose" the database (drop it in a test environment), restore, verify, and write down how long it took.
✅Quick check
What must be shown to pass Level 5, besides working integration?
Show the answer
A demonstrated restore from backup.
Should your production database accept connections from any address on the internet?
Show the answer
No. Limit network access to the app servers and necessary admin access.