One live view of how every system in the ecosystem is protected across six dimensions. Click any cell to update its status; your changes and notes save in this browser. This is your working control panel — review it, update it as you close gaps.
Live count — updates as you click cells in the matrix below.
Every critical system should satisfy all of these. It's the backbone the matrix measures against.
Rows = every system that holds data. Columns = the six protections it needs. Click a cell to cycle its status (Gap → Partial → Done). Tier badges show how critical each system is.
| System | Redundancy / Failover | Backup (RPO) | Offsite | Immutable | Per-client restore | Restore-tested |
|---|---|---|---|---|---|---|
| BOO TransactionsOrders, payments, payoutsTier 1 · Critical | ||||||
| SaaS Shared DB15 apps · Supabase PostgresTier 2 · Important | ||||||
| CodeAll repos · GitHubTier 3 · Rebuildable | ||||||
| User UploadsSupabase Storage bucketsTier 2 · Important | ||||||
| Video / MediaBunny StreamTier 3 · Rebuildable | ||||||
| Secrets / EnvDoppler provisioned, NOT yet wired — keys still in .env.localTier 1 · Critical |
Defaults reflect your stack as of 2026-07-09. Click to update; "Reset to defaults" restores this snapshot.
Match the protection (and cost) to what's actually at stake. Money data gets the works; rebuildable assets get the basics.
The crown jewels. Needs its own isolated database with HA failover, continuous WAL → PITR (RPO seconds), immutable B2 copy, and per-client restore. Plus app-level guards: append-only ledger, idempotency, Stripe reconciliation. Full design in the linked BOO DR doc — this is the biggest open work.
One shared Supabase Postgres backs all 15 apps → one hourly pg_dump covers every tenant. Wiring to Backblaze B2 now (offsite). To close: add immutability (Object Lock) and a tested restore. Single-node today = no failover; acceptable at Tier 2, revisit if an app goes truly mission-critical.
Already safe. Every repo in GitHub = versioned, redundant, offsite. Only refinement: protect the default branch and keep an occasional mirror so a GitHub account issue can't erase history.
Files in Supabase Storage buckets. Currently the weakest spot — not yet backed up offsite. Add a scheduled sync of storage buckets → B2 alongside the DB dump.
Client videos on Bunny Stream (globally replicated = redundant). Keep the source files archived (B2 or local) so anything can be re-uploaded. Otherwise low-risk — regenerable from Displayee templates.
Doppler is provisioned but NOT yet wired in (corrected 2026-07-14) — bm-vercel and boo-v2 still run on .env.local files, which are unversioned, unbacked-up, and sit in the Google Drive working copy. Until the import + Vercel/Coolify integrations are done (start with BOO), secrets remain the most exposed Tier-1 item. Then: periodic encrypted break-glass export to B2, and rotate anything ever pasted into a chat, doc, or ticket (incl. the Bunny API key shared 2026-07-14).
Ordered by risk. (Ticks save in this browser.)
Free space to jot decisions, owners, dates. Saved in this browser as you type.