Home / Knowledge hub / Recovery point objective
Knowledge hub
Recovery point objective
The most data, measured in time, you can afford to lose.
What it means
The recovery point objective, or RPO, is the maximum amount of data you can lose, measured as time. An RPO of one hour means that after a failure you accept losing up to the last hour of changes, so you must have a good copy that is never more than an hour old.
It sets the rhythm of your backups and replication. Nightly backups give an RPO of up to a day. Continuous replication can bring it down to seconds, at higher cost and complexity. It is one half of a pair, alongside the recovery time objective, which covers how long you can be down.
Why it matters
Lost data is not just inconvenient. Orders, payments, messages and edits made since the last copy may be gone and cannot be re-created from memory. Customers notice missing records at once, and some data, such as financial transactions, carries legal duties to keep.
Choosing an RPO makes the cost visible. A short target needs more frequent copies and better tooling. A long one is cheap and puts customer data at risk. Putting the number in writing lets the business accept it knowingly, instead of finding out during an outage. It is a core input to disaster recovery planning.
How it shows up
Set an RPO per system, based on how quickly its data changes and how painful its loss would be. Match it to the technique: daily backups, hourly snapshots, point-in-time recovery for databases, or replication to another region. Check that each really runs at the interval you think.
Mistakes include assuming the database backup covers uploaded files, counting a copy that sits in the same account as protected, and never restoring one to see how recent it is. Read the timestamp on your latest restorable copy and compare it with your target. See backup integrity.
Questions people ask
Recovery point objective, answered
What is the difference between RPO and RTO?
RPO is about data: how much you can lose. RTO is about time: how long you can be down.
A system can have a strict RTO and a loose RPO, or the reverse. Set both.
How does the RPO relate to backup frequency?
Your backup interval is the upper limit on your RPO. If you back up every 24 hours, you can lose up to 24 hours of data.
For a smaller RPO, use more frequent snapshots or continuous replication.
Can replication replace backups?
No. Replication copies mistakes and corruption as quickly as it copies good data. A deleted table or an encrypted disk is replicated too.
Keep point-in-time backups alongside replication. Both are needed.
What is a zero RPO?
It means no data loss, usually achieved by writing to two places at once before confirming a change. It is expensive and adds delay.
Reserve it for the few systems that truly need it.
Who decides the RPO?
The business owner of the system, using advice from engineering about cost and options. Engineering alone cannot judge what loss is acceptable.
Record the decision and the date. Review it yearly.
Related
Terms that sit next to this one
Recovery time objective
The longest outage you can accept before a system must be back.
Backup integrity
Knowing your backups are complete, untouched and actually restorable.
Disaster recovery
The plan and tools for restoring systems and data after a major failure.
Business continuity
Keeping critical services running, or restoring them fast, through a disruption.
Data loss prevention
Tools and rules that stop sensitive data leaving where it should stay.
How much can you afford to lose?
Backups limit what you lose after a failure. Cyberlop looks for the flaws that cause data loss or exposure in the first place, and proves each with a request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.