What happens to your data

Each workspace gets a daily backup of its BookStack database and files, including pages, attachments and images. Backups are encrypted with age and authenticated with an HMAC signature. We remove local backups older than seven days at the next daily retention run; with scheduled runs, this can add up to 24 hours. A first backup is triggered directly after a workspace is provisioned.

A restore returns the workspace to the state of its last nightly backup. Work saved after that run is not in the backup, so a recovery can cost up to a day of changes. If you are about to make a large change and want a fresh restore point beforehand, ask us and we will take one.

Since 10 September 2026, the nightly backup runs while the service stays running. We check database and file consistency around the backup. If consistency cannot be confirmed after three attempts, the process automatically falls back to the previous method, which briefly stops the service. The earlier nightly method caused around ten seconds of interruption per workspace each day.

We restore encrypted backups into isolated test instances on a private network. The HMAC is checked before decryption. We compare the restored data and files with the original and check the restored instance over HTTP.

9 September 2026 — demo restore: The restored database matched the original counts for 11 pages, three books and 17 page revisions. Roles, permissions, settings, and the hash of page titles and update times matched. This demo had no uploaded attachments or images. HTTP retrieval was not verified in this first test.

9 September 2026 — attachment and image restore: A separate temporary workspace supplied real test uploads. The restored attachment and image files matched byte-for-byte using SHA-256 comparisons; the upload manifest matched all 21 files, including generated image variants. Attachment and image database rows also matched. The restored login page, content page and image each returned HTTP 200; the page title and content, and the image content type, were checked.

11 September 2026 — checks on a schedule: Until this date a restore check ran when we started one. It is now scheduled nightly and picks the workspace whose last check is the oldest, so every workspace comes round in turn. That is a rotation, not a check of every backup of every workspace every night, and it does not change the limits above. The first two runs of that rotation, started by hand to verify it, restored a demo workspace of 16 pages in four books and a test workspace, each serving its login page and a content page over HTTP; the live instances kept running and the temporary resources were removed.

The live demo’s before-and-after fingerprints were identical in both tests. The isolated test resources were removed afterwards.

Monitoring runs every ten minutes. When a backup has stopped the service, we restart the workspace and check that it is running and ready to serve requests before reporting the backup as successful. A failed recovery is reported as an error.

For support or help restoring a backup, email info@productivity-boost.com.