Who it is for
A SaaS team on RDS or PostgreSQL with automated backups switched on, but nobody has ever restored one, and the recovery time promised in contracts is a guess.
The problem
- Backups that have never been restored are a hope, not a plan: jobs stop silently, tables go missing, restores take hours.
- RTO and RPO are guesses, even when customers or auditors ask for them.
- The same credentials can often delete the database and every backup, as an AI agent did to a company's production data in April 2026.
What I do
- A backup inventory and isolation report: retention, deletion protection, public or shared snapshots, cross-region and cross-account copies, locked vaults, and what your app's role could delete.
- A timed restore into a new sandbox instance (snapshot and point in time), never over production.
- 13 data checks against a manifest: row counts, checksums, broken relationships, business totals.
- A report with RTO and RPO against your targets, and a runbook your team can follow.
How it works
- 1Backup inventory and isolation check
- 2Restore into an isolated sandbox
- 313 data checks against a manifest
- 4Measure RTO and RPO
- 5Delete the sandbox
- 6Report and runbook
Day by day
- Day 1Agree targets and checks; you create a scoped role; isolation report.
- Day 2First drill from the latest snapshot, verified inside your network, sandbox deleted the same day.
- Day 3Point-in-time drill and comparison with your targets.
- Day 4Report, runbook and walkthrough.
Evidence from the demo
The evidence below comes from my own demo project with synthetic data. It shows exactly what you receive; it is not a story about a client.
- Every push to the kit's repository runs a real restore of 5,000 synthetic customers and all 13 checks.
- On AWS, the kit restores RDS from a snapshot or a point in time into a sandbox with its own security group, then deletes it.
- Isolation checks flag public snapshots, shared-but-not-copied snapshots, missing cross-region copies and app roles that could delete backups.
Demo project: Restore Drill kit
What you keep
- Isolation report with fixes
- Two timed drills (snapshot and point in time)
- RTO/RPO report against your targets
- A restore runbook
Not included
- Changes to production settings (quoted as drill + hardening)
- Application-level failover
Questions
Do you need access to my production systems?
No passwords, ever. Audits use a read-only role you create and can delete at any time; changes arrive as a pull request you review and merge yourself.
How long does a project take?
2 to 10 working days depending on the package. You get the timeline and the fixed price before we start.
What if you find nothing worth fixing?
Then you hear that early, with the evidence. For the AWS Bill Doctor on accounts above $1,000 a month: if I don't find at least my fee in yearly savings, you don't pay.
What happens to my data?
Reports stay between us. When the project ends I delete your data and confirm it in writing.
How do I pay?
Upwork, international bank transfer, or UPI / bank transfer in India. Direct clients pay 50% upfront and 50% on delivery.