Backup and restore

Backup and restore produces a single serialised file containing the instance’s database, and loads one back. It is the tool for moving an instance to new infrastructure, cloning production into a staging environment, or keeping a recovery point before a risky change.

Where to find it

Extra → Backup & restore in the sidebar. It requires the backup permission, which is normally held only by administrators.

Export backup

Press Export database and the platform serialises the database and hands you the file. It contains the objects, the configuration, the users, and the role assignments and permissions that decide who can see what — so a restored instance comes back with its access control intact.

Caution

Evidence files and other uploaded attachments are not included. The backup records that an evidence exists and what it is attached to, but not the PDF behind it. Back up the file storage separately, on the same schedule, or a restore will come back with empty attachments.

Treat the file as highly sensitive. It contains your entire GRC record and your user table; store it encrypted and control who can retrieve it.

Import backup

Press Import backup, choose the file and press Upload. The platform asks you to confirm, because the operation:

• overwrites all existing data — every object, every setting;
• replaces users and credentials, including the account you are currently signed in with;
• cannot be undone.

After a restore the instance is exactly the state captured at export time. If the backup came from a different instance, the credentials that work afterwards are that instance’s credentials, not yours — make sure you know a valid login from the source system before you start.

A workable backup routine

• Schedule exports on a cadence that matches how fast your data changes: weekly for an active programme, monthly for a stable one. Take one on demand before any upgrade or bulk import.
• Pair every export with a file-storage backup so evidences and attachments stay in step with the database.
• Keep versions. A single rolling backup only protects you against hardware failure; several dated copies also protect you against a mistake nobody noticed for a fortnight.
• Test a restore into a disposable environment now and then. An untested backup is a hypothesis.
• Store copies off the instance, encrypted, with access limited to the people who would perform the recovery.

Tip

For moving a subset of data rather than a whole instance — an asset inventory, a control list — use the Data wizard instead. Backup and restore is all-or-nothing by design.

Related

• Data wizard — bulk import of individual models.
• Settings — the configuration a backup carries with it.
• Evidences — the attachments you must back up separately.