Backup & DR: Can a 10K-Order Database Be Restored in 4 Hours?

Friday night, the POS freezes, your D1 partition is unreachable, and twelve hours of orders are nowhere to be found. How fast can you come back online? "Four hours" isn't a marketing number — it's the measured outcome of a real thMenu drill in which a 30,000-row order table was fully restored in 3 hours 28 minutes.

Backup architecture: Sunday 02:00 cron, R2, per-table objects

The thMenu cron dispatcher fires 0 2 * * SUN and takes a weekly full snapshot. Each D1 table becomes a separate R2 object streamed in 1,000-row batches, which keeps the 128 MB worker heap from blowing up even for 50K-row tables. Objects are stored under date-prefixed paths with 90-day retention.

RPO sits at 7 days in this model; RTO measured in the drill was 3h28m. Daily incremental WAL shipping is on the roadmap for Platinum customers who need tighter recovery points.

Restore drill: 30K rows, 3h28m

The drill ran at a six-location Istanbul chain. Scenario: Monday 09:00, partition unavailable. The restore script pulled the latest R2 object, hydrated a fresh D1 instance via 5,000-row INSERT batches, and walked the foreign-key order: restaurants → menus → categories → products → orders → order_items. While tables loaded, the admin panel displayed a read-only maintenance banner.

Menu reads came back at 12:28; full KDS resumed at 13:14. Data lost: a six-hour order window after Saturday 02:00 — the till report was rebuilt manually from paper tickets.

Article 12 of KVKK and the annual DR drill

KVKK Article 12 binds data controllers to "appropriate security measures," and the Turkish DPA's guidance explicitly names backup and DR planning. The administrative fine for a 2025 data-loss case reached TRY 1.8 million — not a risk to ignore.

Our recommendation: a Q1 drill every year — real restore, real stopwatch, results logged in ISO 27001 Annex A.17 format. thMenu coordinates this for Platinum tenants at no extra cost.

FAQ

Can we access our backups? Yes — Platinum tenants get signed R2 URLs for the last four weeks of dumps.

Single-table restore? Yes, point-in-table restore is supported; you can roll a single accidentally truncated category table back without touching orders.

Is the 4-hour RTO contractual? The SLA is 8 hours; the drill target is sub-4. Misses trigger a credit on the next invoice.

Found this helpful? Share it.