How far back your data can be recovered
What happens to your data if something goes wrong, such as a mistaken deletion or a bad update on our side? This page, and the card it describes, answer that in the product so nobody has to answer it from memory.
Who this is for: Owner or Admin. Everyone else does not see the card.
Where to find it
Settings → Organization → Data, the Data safety card at the top. It only shows information. There is no restore button and no export on it, by design: a restore rolls back a whole database, not one gallery’s records, so it is not something we offer as a self-service button.
What it tells you
- How far back your data can be recovered. For example, “any moment in the last 6 hours”. Anything older than that cannot be recovered by us, because there is no older copy. The figure is read from our database provider each time you open the page, so if the plan changes the card changes with it. It is never a number typed into the product.
- How quickly. From a real restore test (not an estimate): nothing lost within the window, and about 3 seconds to restore the data. Pointing the application at the restored data and redeploying takes longer, and so does the decision to do it. The test date is shown.
- What a restore does not bring back. Uploaded images and documents (kept in file storage, not the database), Square payments, orders and catalog items (Square keeps what already happened), and email history (it lives with the email provider).
When it says it can’t read the figure
If the card says “We can’t read how far back your data can be recovered right now, so we are not showing a figure”, we could not reach our database provider at that moment, or the figure was not available to us. No number is shown, on purpose: a default or an old number could be quoted later and be wrong. Check again later, or contact support if you need the answer today.
The card never shows anything about other galleries or about our infrastructure.
For operators
The figure needs NEON_RECOVERY_API_KEY and NEON_RECOVERY_PROJECT_ID set on the environment (see the production configuration inventory). Without them the card shows the can’t-read state. The wording of the measured numbers and of the not-covered list mirrors docs/restore-runbook.md; a test fails if they drift apart.