1. Storage per tenant
A workspace points at one S3 (or S3-compatible) target: bucket, region, optional prefix, discovery strategy. Credentials are encrypted at rest and never rendered after save. IAM roles are preferred.
Platform
A control plane for backups that already live in S3.
The product does not store dump files. It indexes them, attributes them to a tenant and a database, and lets the right people see health, history, and recovery — without opening the AWS console every morning.
2. Discovery that matches real dumps
Folder, prefix, filename, metadata, or hybrid. New company databases appear after sync instead of a manual inventory.
3. Operations without copying bytes
Celery paginates list_objects_v2. PostgreSQL holds users, RBAC, cached metadata, jobs, and audit — not the backups themselves.
What each role is for
| Role | View | Download | Delete | Sync | Users / S3 | Audit |
|---|---|---|---|---|---|---|
| Super Administrator | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Backup Administrator | ✓ | ✓ | ✓ | ✓ | ||
| Backup Viewer | ✓ | ✓ | ||||
| Auditor | ✓ | ✓ |
Health is freshness, not a green light from S3.
Thresholds are configurable. A database is healthy when its latest dump is inside the window, warning when it slips, critical when it is missing or too old. That view lives in the private console — we do not publish anyone’s health on this site.
- Healthy — latest dump within the agreed hours.
- Warning — still present, but aging past the first window.
- Critical — missing, failed, or beyond the outer window.