Continuity & disaster recovery

How your encrypted data survives an outage — and what to expect.

Durability vs. availability #

Two different questions, solved differently:

• Durability (permanent loss) is effectively solved for every plan: 11-nines-class object storage, a point-in-time-recoverable control plane, and — most importantly — an offline-first client that holds a complete local copy of every vault. Losing all server-side data would still leave every user with a working local vault to re-sync from.
• Availability (a temporary outage) is the real design target, and where the region-specific machinery lives.

What every plan gets #

• Offline-first client — a backend outage is never a lockout. Reads come from the local vault; writes buffer locally and reconcile when the backend returns.
• Point-in-time recovery — the control plane supports 30-day restore.
• Platform redundancy — the default (global) storage is multi-region redundant, and the app runs across a global edge with no single region to fail.

For most organizations, redundancy is inherited — there is nothing to configure.

In-jurisdiction DR for pinned regions (Enterprise) #

Pinning data to a single country makes that storage durable but not region-redundant, and you cannot fail over across a border without breaking residency. For pinned zones, Veridenti adds an in-jurisdiction DR replica:

• Dual-write to a replica in the same jurisdiction (a second availability zone or in-country provider).
• Automatic read-failover if the primary is unreachable.
• Writes stay available during a primary outage and reconcile automatically on recovery.
• Cross-jurisdiction DR is refused — the residency guarantee can never be silently violated.

Replicas can even span providers within a region (for example a Cloudflare R2 primary with an AWS S3 replica in the EU), which removes any single provider as a point of failure.

Targets #

• Recovery point (RPO): near-zero for committed data.
• Recovery time — reads: immediate (offline-first + read-failover).
• Recovery time — writes: under 15 minutes for a region outage.

Seeing it in the console #

The Continuity & DR tab of Data Residency shows, per region: live status (healthy, failed over to DR, or unreachable), whether a DR replica is configured and healthy, your RTO/RPO targets, and the Break-Glass controls.

The honest limit #

A single-country region cannot be recovered outside the country without breaking residency, so a true country-wide event (a major cable cut or legal force) can pause that region's sync. Even then, offline-first keeps local access working and zero-knowledge means a seizure yields only ciphertext. Residency itself caps achievable availability — an informed sovereignty-versus-availability trade-off.

What if… #

• A region is briefly unavailable — reads fail over to the replica; writes stay available and reconcile on recovery.
• You want cross-provider or multi-datacenter DR for a pinned region — contact your account team to enable an in-jurisdiction replica.