How do I back up and restore a self-hosted SaaS?
Back up three things: the database, the uploaded files, and the configuration including secrets. Store copies away from the server that runs the product, on a schedule set by how much data you can afford to lose. A backup you have never restored onto a blank machine is a hope, not a backup — do one full restore before launch.
Written by ZoopCoder, who build and sell SaaS source code. That makes us an interested party in this answer, so we have kept it to things you can verify yourself.
The numbers
3 things
Database, uploads, config
Missing any one leaves you with a product that will not start.
Off-server
At least one copy
A backup on the same disk dies with the disk.
1 restore drill
Before launch
The only test that proves the other steps worked.
What to back up and how often
Choose the schedule from one question: how many hours of customer activity can you afford to lose? That number is your recovery point objective, and the backup interval cannot be longer than it.
| Item | Typical method | Sensible interval | Easily forgotten detail |
|---|---|---|---|
| Database | A consistent dump (mysqldump --single-transaction, pg_dump) or a managed snapshot | Daily at minimum; hourly if customers enter data all day | Copying the live data folder of a running database gives a corrupt copy |
| Uploaded files | Incremental sync of the uploads folder or object-storage bucket | Daily | Invoices, avatars and attachments live here, not in the database |
| Configuration and secrets | The environment file and web-server config, stored encrypted | On every change | Without the application key, encrypted columns in a restored database are unreadable |
| The code itself | Your own git repository, including your customizations | On every change | The vendor's zip is not your modified version |
The 3-2-1 rule for one small server
- Three copies: the live data plus two backups.
- Two kinds of storage: for example the server's disk snapshot and a separate object-storage bucket, so one provider failure cannot take both.
- One copy off-site and out of reach of the server's own credentials, so that a compromised server cannot also delete its backups. Use write-only or versioned storage where the provider offers it.
Provider snapshots count as one copy, not a complete plan: they usually share an account, a billing relationship and a region with the server they protect.
The restore drill
Do this once before launch and again after any major upgrade.
- Start a fresh blank server from scratch, as if the original were gone.
- Install the runtime, restore the code, the configuration, the database and the uploads from your backups only.
- Log in, open an old record with an attachment, and send a test email. Write down how long it took: that is your real recovery time.
- Fix whatever was missing from the backups and repeat until the drill works without guessing.
Where to go next
These pages carry the detail this answer summarises.
Frequently asked questions
Are provider snapshots enough?
They are a good first layer and fast to restore, but they live inside the same provider account as the server. Add a logical database dump to separate storage so that one deleted account or billing problem cannot remove everything.
How long should I keep backups?
Keep daily copies for a few weeks and monthly copies for longer, so that a problem you only notice after a fortnight is still recoverable. If customers' personal data is involved, deletion requests may mean old backups must age out on a defined schedule; settle that before launch.
Do I need to encrypt backups?
Yes if they leave your server, since they contain every customer's data and your secrets. Encrypt before upload and keep the key somewhere that is not the backup bucket.
What does this cost?
Small. Storage for the database and uploads of an early-stage product is usually a few dollars a month; the real cost is the hour for the restore drill, which is why it gets skipped. It belongs on the list in <a href="/answers/hidden-costs-of-self-hosting/">hidden costs of self-hosting</a>.
Get a quote or a guided demo
Tell us your use case and we'll send pricing, a live demo walkthrough and licensing options for SaaS source code. Usually a reply within one business day (IST).