Plan and verify backups
Protect the database, evidence objects and encryption material as separate recovery dependencies for a customer-owned installation.
Inventory the recovery set
| Component | Retain |
|---|---|
| D1 | Schema, migrations, application records, audit history and integrity checkpoints. |
| R2 | Evidence, snapshots, policy files, audit packages and archived integrity leaves. |
| KV and secrets | Sealed provider data where used, encryption keys, key identifiers and deployment configuration. |
| Identity | A protected authenticator backup and a second administrator. |
A D1 export does not include R2 objects or Worker secrets. Retain the API Worker's MASTER_KEY, its MASTER_KEY_ID and any other release-specific encryption material in the approved secret store. Losing these keys can make encrypted material unrecoverable.
Configure the backup job
Installation alone does not establish a backup schedule. Assign an operator, storage destination, encryption recipients, retention policy and monitoring.
The source repository includes an age-encrypted D1 backup workflow with configurable recipients and a 90-day lifecycle. It must be configured against the actual installation and its environment; do not assume it runs in a customer account automatically.
Verify recovery
Retain owner-controlled decryption keys offline. Rehearse decryption and restore into an isolated database. Check application records, audit history, integrity leaves and access after recovery.
Restore from backup describes the safe sequence. A successful upload or scheduled job is not evidence that the full installation can be recovered.
Operate an Access-mode installation
Distinguish legacy Cloudflare Access authentication from managed accounts and preserve private API and public publication boundaries during migration.
Restore a workspace safely
Rehearse recovery into an isolated database, verify the evidence history and switch bindings only after the restored state has been checked.