Prove your backups restore

A drill is a rehearsal. A fire drill does not fight a real fire — it proves that when one happens, everyone knows the way out. A backup drill is the same idea for your data: rather than waiting for a real outage to discover whether your backups work, you rehearse the recovery on a schedule.

In practice, a backup drill takes a real backup — the dump your database produces every night — restores it into a clean, isolated environment, and checks that the data actually came back intact. When the restore fails, or the data is wrong, you learn it today, in a report — not at 3 a.m. during an incident.

A backup job that reports success tells you one thing only: a file was written. It does not tell you the file can be restored. Backups fail silently, in ways a success status never catches:

• A dump truncated when a disk filled up
• A missing database extension that makes the restore error out
• Schema drift that breaks your application against the restored data
• Expired credentials, leaving the dump effectively empty
• A backup of the wrong database entirely

Each of these passes the backup job and fails the restore. Teams routinely discover a broken backup at the worst possible moment — mid-outage, when that backup is the only thing between them and lost data. An untested backup is closer to a guess than a guarantee.

Every drill of your backup runs the same six steps in an isolated, single-use sandbox machine on its own private network — separate from Dokaz's app and database. A drill never connects to your production database:

Give Dokaz a read-only key to the bucket your backup job already writes to — AWS S3, Cloudflare R2, Backblaze B2 or MinIO — and choose one file or the newest backup under a prefix. Or have the backup job push each dump to Dokaz with one curl command or the API.

Click Test connection and Dokaz shows the exact backup a drill would use, or says precisely what to fix. Then add assertions and set a schedule. The secret key is encrypted for your account and never shown again.

A green checkmark in a dashboard is worth little to an auditor or an underwriter — they have only your word for it. Dokaz's evidence is different: every drill produces a Proof-of-Recovery PDF that is cryptographically signed, and that anyone can verify without trusting Dokaz at all.

• The PDF records the source, its SHA-256 hash, every assertion's expected-vs-actual result, the restore duration, and the operator.
• It carries a detached Ed25519 signature over the document's digest — change one byte and verification fails.
• The signing public key is published at a stable URL, and an open-source verifier (dokaz-verify) checks any PDF against it offline.
• Evidence is kept for a seven-year retention window to cover typical audit look-back periods.

To be precise about what this is: the signature proves the evidence is tamper-evident and was produced by Dokaz's key. It is not yet a third-party trusted timestamp (RFC 3161) or a certificate-authority document signature — those are on the roadmap, and we describe the current model plainly rather than overclaim it.

Doing all of this by hand is tedious — so it does not get done. Dokaz turns backup drilling into something that simply happens:

• On a schedule — drills run on the cadence you set, so a broken backup surfaces within days, not during a recovery.
• Away from production — every drill of your backup restores in an isolated, single-use sandbox that is destroyed when it finishes. Dokaz never connects to your production database.
• Measured recovery — each drill records how long the restore took (RTO) and how old the backup was (RPO), and fails when you set targets it misses.
• Real assertions — go past "it restored" — assert row counts, that key tables and columns exist, that critical columns contain no nulls and that the data is recent. Dokaz proposes checks from your restored schema after the first drill.
• Signed evidence — every drill produces a signed PDF and an audit-log entry, kept for a seven-year retention window and verifiable offline with dokaz-verify.
• In your workflow — a versioned JSON API and signed webhooks push drill results into your own alerting and dashboards.

Dokaz is built for engineering teams running managed PostgreSQL who cannot afford to learn their backups are broken the hard way. It is sharpest for two moments:

• A SOC 2 or ISO 27001 push — recovery testing is an expected control (ISO/IEC 27001:2022 Annex A 8.13; SOC 2 Availability A1.3), and Dokaz's report is built to be handed to your auditor as evidence for it.
• A cyber-insurance renewal — carriers increasingly ask for proof you restored from backup within the last 12 months; Dokaz produces a dated, signed record of each restore test.