Backup, recovery and deletion
What we back up each night, what a restore returns, and what happens to your data when you delete an account.
Read this first
- Backups stay on the machine they protect. We do not copy them off it.
- We have not tested a restore with real data.
- A restore returns the data as of the last nightly backup. There is no point-in-time recovery.
- Deleting an account deletes its realm, which is the account's own sign-in space. There is no soft-delete window.
What we back up each night
Every night we back up five things.
- The RealmSSO database.
- The sign-in service's database.
- The cluster state.
- The host configuration.
- The cluster manifests.
We keep each backup 30 days. We last verified the backup timer live on 2026-08-03. No one has recorded a check of the timer since.
The backups stay on the machine they protect. We do not yet copy them off it. A backup on the machine does not protect you if the machine is lost. We make no claim about backup encryption.
What a restore returns
A restore returns the data as of the last nightly backup. Changes made after that backup are lost. There is no point-in-time recovery. We publish no recovery-time figure and no recovery-point figure.
We have not tested a restore with real data. We ran one drill, on 2026-08-02. It used the RealmSSO database, and 19 of its 20 tables were empty. We have never restored the sign-in service's database.
We have not rebuilt the machine from a backup. Our restore procedure restores the sign-in service's database first, and then the RealmSSO database. We have not run that procedure against these backups.
Where your data is stored
RealmSSO's database holds these records.
- Accounts and connections.
- Each connection's encrypted OIDC client secret and SAML signing certificate.
- Hashed API keys, SCIM tokens and sign-in tokens.
- Webhook signing secrets, which are stored readable.
- The audit log.
- Observability events, which RealmSSO purges after 90 days by default.
See Encryption and secrets for what is encrypted and what is hashed.
Each account's realm holds that customer's clients, identity provider (IdP) links and signing keys. RealmSSO's database does not hold the realm itself. It holds the account's connection settings and the name of the realm.
The sign-in service holds the realms in its own database. The nightly backup covers that database. A restore of RealmSSO's database alone does not recover a realm. The two databases must be restored together.
When you delete an account
Deleting an account deletes its realm in the sign-in service. There is no soft-delete window. RealmSSO also deletes the account's configuration and its audit log. Some other records stay, as the table shows.
RealmSSO removes the realm after it commits the database change. This step can fail. If it fails, RealmSSO records the failure.
| What | What happens when you delete the account |
|---|---|
| The account’s realm | Deleted. There is no soft-delete window. |
| The account’s configuration and audit log in RealmSSO’s database | Deleted with the account. |
| Sign-in and sync events | Kept until the purge. The default is 90 days. They carry an email address and an IP address. |
| A record that the account was deleted, and an internal audit log of platform-level actions | Kept after the deletion. A customer cannot read either. |
| Nightly backups | A deleted account can stay in the backups until each backup reaches 30 days. |
RealmSSO documents no export procedure for an account's data.
The encryption key ring
RealmSSO encrypts two connection fields. Each stored value names the key that sealed it. A restore needs every key that stored values name. A value whose key is missing stays unreadable.
The key ring sits in the platform's secret store. It has no copy off the machine. See How we run your instance for the list of what we do not have yet.