Business Continuity & Disaster Recovery Plan

Mahlum Innovations LLC · Effective July 2026

This plan describes how Chronos continues or restores service after infrastructure failure, data loss, vendor outage, destructive security incident, or key-person unavailability.

Security incidents with a PHI-exposure path are governed first by our Incident Response & Breach Notification Plan. This plan supplies the recovery half.

1. Recovery objectives

2. Backup posture

These are verified facts about current infrastructure, not targets.

• Database backups: daily backups retained 30 days; monthly backups retained 12 months. 1-day point-in-time-recovery window. All backups encrypted AES-256 at rest. Maximum backup persistence for deleted data is 12 months.
• File storage: uploaded records and generated exports are stored in BAA-covered, US-resident cloud storage (Google Cloud Storage) with provider-level durability.
• Source code: version-controlled off-platform (GitHub). Available independently of the production environment.
• Secrets: recoverable only by re-issue from each provider. Never stored in plaintext anywhere. No "secrets backup" exists.

3. Recovery runbooks

Database loss or corruption

1. Restore via point-in-time recovery or the latest daily backup.
2. Identify every customer deletion that post-dates the restore point using the audit log (which records purge scope and timestamp).
3. Re-apply every such deletion BEFORE returning service to customers. This re-deletion step is a contractual commitment in our DPA and BAA, not a courtesy.
4. Resume service and issue incident report.

Application outage

1. Roll back the deploy to the last known-good version, or escalate to the hosting provider's BAA-covered support.
2. Update the status page within 1 hour of declaring an incident.
3. Issue SLA credits per the published SLA once service is restored.

Ransomware or destructive compromise

1. Incident response takes lead: engage insurer-panel forensics firm and independent breach counsel immediately.
2. Contain and isolate affected systems.
3. Recovery rebuilds from clean, version-controlled code and re-issued secrets. Never recover from a potentially compromised image.
4. Restore from backup depth of up to 12 months depending on the extent of the compromise.
5. Breach notification to affected customers within 72 hours as required by BAA and applicable law.

4. Vendor concentration risk

Our hosting provider (Aptible) is deliberately our dominant dependency in exchange for a single HITRUST-certified, BAA-covered control plane. This is a known, accepted, and documented concentration risk.

A documented exit sketch — portable containerized application, standard PostgreSQL dump/restore to another BAA-covered platform, storage and AI layers independently replaceable — is maintained and revisited annually. Portability is a design constraint, not an afterthought.

5. Operational continuity

Chronos is founder-operated. We state that honestly rather than describing redundant staffing we do not have. Continuity risk is mitigated by:

• Fail-closed automation — the service runs without daily operator action.
• Customer-exportable data at all times via PDF, DOCX, and CSV export.
• Independent 24/7 breach counsel and cyber insurer reachable without founder involvement.
• All credentials documented for recovery in an encrypted, off-platform credential store accessible to the founder's designated successor.

6. Plan testing and review

• Annual database restore test, timed against RPO/RTO objectives and documented.
• Annual tabletop walkthrough of the three primary runbooks.
• Quarterly verification that backup configuration is unchanged from documented posture.
• Plan reviewed annually and after every real incident or test that reveals a gap.

Results of testing are documented and retained for at least 12 months. See our HIPAA compliance page for the backup retention schedule and deletion commitments visible to customers.