AirGradient maintains backup and recovery practices to help restore important systems and data after infrastructure failure, vendor outage, data corruption, security incident, or other service disruption.

The recovery approach is designed to protect:

• Customer and user account data.
• Monitor configuration and calibration metadata.
• Air quality measurement history.
• Website, dashboard, API, app, and operational service configuration.

Recovery Principles

AirGradient's backup and recovery approach is based on the following principles:

• Backups should be protected from unauthorized access.
• Critical service data should have recoverable copies.
• Recovery should preserve data integrity rather than restoring misleading or incomplete data.
• Public data feeds should be paused or corrected if a data integrity issue is identified.
• Recovery processes should be documented so they do not depend on undocumented knowledge held by one person.
• Backup success should be checked through periodic restore or recovery testing.

Backup Coverage

Backup coverage may vary by system, provider, and deployment. AirGradient's backup scope is intended to cover important production data and configuration, including:

• Dashboard and application databases.
• Monitor metadata, configuration, calibration, and ownership records.
• Measurement history where stored by AirGradient.
• Website, documentation, and application source code.

Some data may also be retained by third-party providers, public data partners, customer exports, or customer-managed systems depending on the service and deployment.

See: AirGradient Subprocessors and Data Recipients

Backup Security

AirGradient protects backups using appropriate technical and organizational controls. These include:

• Encryption at rest where supported by the relevant provider or storage system.
• Encrypted transfer channels.
• Access controls for backup storage and recovery systems.
• Limited administrative access.
• Multi-factor authentication for administrative systems where supported.
• Separation of backup credentials from source code.
• Credential rotation after suspected compromise.
• Logging or monitoring of backup access where provider tooling supports it.

Recovery Testing

AirGradient performs recovery tests every few months to confirm that important backups can be used and that recovery procedures remain workable.

Recovery tests may include:

• Confirming that recent backups exist for critical systems.
• Restoring a database backup into an isolated environment.
• Checking sample records, counts, timestamps, schema, and application behavior.
• Restoring a sample file, support attachment, or configuration item.
• Reviewing whether recovery steps, owners, and access paths are still current.
• Recording issues found during testing and tracking follow-up actions.

The exact test scope may vary depending on infrastructure changes, customer requirements, risk, and the systems selected for each test cycle.

Recovery Process

If recovery is required, AirGradient's general process is to:

1. Open an incident or recovery ticket.
2. Assign a recovery owner.
3. Identify affected systems and the appropriate recovery point.
4. Preserve evidence where a security incident or data corruption may be involved.
5. Pause jobs or integrations that could overwrite affected data.
6. Restore into an isolated environment first where practical.
7. Validate data integrity, application behavior, public/private visibility settings, and measurement timelines.
8. Restore or fail over production services when validation is complete.
9. Monitor the service after recovery.
10. Document the recovery outcome and follow-up actions.

Disaster Scenarios

AirGradient's recovery planning considers scenarios such as:

• Accidental deletion or data corruption.
• Failed deployments or application changes.
• Hosting provider or infrastructure outage.
• Security incident affecting a host, account, credential, or service.
• Public data integrity issue.

For security incidents, AirGradient prioritizes containment, investigation, credential rotation where needed, recovery from known-good sources, and notification where legally or contractually required.

Customer Responsibilities

Customers are responsible for:

• Managing customer dashboard users and permissions.
• Choosing public or private monitor sharing settings.
• Keeping their own exported datasets or local copies where required by their governance rules.
• Protecting customer-managed networks, accounts, API tokens, and local systems.

Contact

Backup, recovery, reliability, or deployment questions can be sent to support@airgradient.com.