Data Export & Backups

Data Export & Backups closes the loop on data durability claims so an auditor can be shown evidence rather than promises. Tenant export on demand queues an async job, packages all tenant documents and uploads, and produces a signed download URL that expires in seven days; the same machinery powers F21.05's tenant export and F21.13's GDPR fulfilment, but here it is exposed as a generic operator action. Platform-wide snapshots run as a scheduled daily job, retain the last 30 days, and write to the disaster-recovery storage account in a separate region.

Point-in-time restore at tenant scope is the surgical option: pick a tenant, pick a timestamp, and the operation restores that tenant only while preserving cross-tenant integrity (foreign keys to other tenants are reconciled rather than blindly overwritten). The weekly backup-verify job is the trust anchor for the backup contract: every Sunday it picks a recent snapshot, restores it into a clean sandbox tenant, runs a defined sanity-check suite (row counts, hash integrity on critical collections, a sample login, a sample read), and records the result. A failure pages security and opens a SEV2; a success appends to the integrity log that auditors can review.

Data-residency summary enumerates which collections live in which Azure region, with the regulatory rationale for each, so a federation asking `where is my data` gets a one-page answer instead of a guessing game. The summary is generated from infrastructure config rather than asserted by hand, so a region change in `infrastructure/` is automatically reflected.