Business continuity & disaster recovery

Published October 15, 2026. This public plan describes recovery responsibilities, targets and limitations. It is not a recovery guarantee or a service-level agreement. Operational credentials, account identifiers and break-glass instructions are not part of this public document.

Responsibilities and activation

The service owner coordinates recovery and communication with affected firms. Suspected compromise also activates incident response. Firms remain responsible for their own practice continuity and attorney review of any affected filing or deadline. BRON does not automatically change a legal deadline during an outage.

Recovery sources

Application recovery uses the last verified release and protected configuration backups. Database recovery uses an available, verified backup. Document recovery uses stored object versions, replicas or backup recovery points. Backup availability, age and integrity must be checked at the incident; the existence of a backup configuration is not proof that a particular record can be recovered.

The internal plan records nightly database copies and a weekly restore drill into a temporary database with ledger-chain verification. That is a narrower exercise than restoring the entire live service. This publication does not assert that a particular production backup or drill succeeded today.

Proposed recovery targets and untested limits

These values come from the internal draft plan. They are planning targets, not measured recovery capabilities or contractual commitments. RPO is the target maximum age of the recovery point; RTO is the target time to restore service.

There is no automatic regional failover for the database or application. A regional outage may therefore require manual recovery and exceed these targets. A ledger hash check or timestamp does not establish that every record was recovered or that nothing was withheld.

Recovery sequence

1. Identify the affected services, contain suspected compromise and preserve incident evidence. Communicate known impact and uncertainty to affected firms.
2. Select a known-good recovery point and the last verified application release. Establish replacement infrastructure and restore protected configuration through authorized operators. Rotate compromised credentials through incident response.
3. Restore database and document recovery sources. Compare recovered file hashes with recorded digests and run the ledger-chain verification functions.
4. Keep affected writes and externally consequential actions unavailable until their integrity and access controls have been checked. An unavailable store is not an empty record or evidence of absent permissions.
5. Disclose known missing intervals, failed checks and recovery limitations. Record removals through the existing disclosure mechanism; do not silently repair a chain or claim the recovered record is complete.
6. Check authentication, matter access and the existing attorney confirmation and citation gates before restoring normal service. Inform affected firms of the recovery point and any unresolved limits.

Testing and review

The internal plan calls for weekly database restore drills, quarterly file recovery exercises once built, and an annual full service recovery rehearsal. The latter two are not represented here as completed. After an exercise or incident, retain the measured recovery times, failed checks and corrective actions, and review the plan. Production rehearsal results require operator evidence, not source inspection.

Key-person risk and questions

The internal plan records a single-operator dependency. A designated backup operator and protected break-glass custody have not been established by this publication. Prospective firms should account for that limit in their continuity planning. Contact BRON through Support for continuity questions; do not send passwords, privileged records or client information in an initial inquiry.