On this page
Package one organization's own data into an archive and reload it later, with a mandatory confirmation before any overwrite and an automatic safety snapshot taken first.
For: organization owners and admins, and super admins operating several organizations. Before you start: the platform's object storage must be configured; if it is not, the page says so rather than failing with an error. Scheduled backups are beta (status).
This is not disaster recovery. It packages one organization's own data at table scope — it is not a whole-platform copy, not a point-in-time restore, and not a substitute for the platform team's own rebuild process. Use it to move an organization's data, to rebuild an organization after a bad load, or to keep a checkpoint before a large change.
Steps#
- Choose what to package: a ready-made third-party market data profile, a ready-made first-party operating data profile (commerce, CRM, inventory, content performance, web analytics), or your own selection of data groups. Both profiles skip AI configuration, users and permissions, connections and secrets, and queue run state — a secret never travels with an archive.
- Organization admins run a backup at Settings > Backup & restore ("Cài đặt > Sao lưu & phục hồi") at
/settings/backup; super admins use Customers > Backup & restore ("Quản trị → Sao lưu và phục hồi") at/admin/orgs/<slug>/backupfor scheduled backups across organizations. - Download a completed backup, or request a restore of it.
- To restore into the same organization, type the organization's identifier to confirm — this is a destructive action. A safety snapshot is created automatically in the same transaction as the restore request, before any write; there is no way to skip it.
- Restoring into a new organization, or any mode other than restoring into the source organization, is available to super admins only.
Verify#
- A completed backup job shows its size and checksum.
- After a restore, the organization's data matches the archived scope, and the safety snapshot taken beforehand is available if something needs to be undone.
When something is wrong#
| Symptom | Likely cause | Fix |
|---|---|---|
| The page says object storage is not configured | The platform has not set up the backup store yet | Ask the platform operator; this is a platform-level prerequisite. |
| A restore request is refused | The requested mode is not available to your role | Only a super admin can restore into a different organization or use a broader mode. |
| A scheduled backup run failed and needs disk space | The staging area ran out of room | This is treated as a permanent failure, not a transient one, and will not retry on its own; free space and rerun. |
| A run failed for a reason described as temporary | A transient error occurred with retries remaining | The queue retries automatically once, after a fixed wait. |
| A run failed for a reason described as permanent, unrelated to disk space | A deterministic error, such as a missing environment tool | Report it; retrying the same run will not fix it. |
What is packaged#
Both bundled profiles skip AI provider settings, user accounts and role assignments, connector configuration and secrets, and any in-flight queue state. Every data group in the schema is listed on the scope screen, the same set for every organization; a group is only flagged as related when the organization's active data plane uses it or already holds rows there — that flag never hides a group, so a group holding real data cannot be missed by an out-of-date plane configuration.
Access and rate limits#
Both the organization and super-admin pages require an owner or admin of the organization; a super admin can always pass through. Backup and restore requests are each rate-limited per organization, with a tighter limit on restore.
Retention#
A scheduled backup keeps the newest runs its own schedule declares, deletes the file before the database record, and always skips a run that a restore receipt still references. A backup triggered by hand is never cleaned up automatically — whoever created it decides when to let it go.