Trust Center

Backups and Continuity Policy

How the platform is backed up and monitored, how we respond to a failure, and how a firm keeps its own copy of its records.

Effective

28 September 2026

Owner

Security Lead, RealEstAi Inc.

Questions

contactus@realestai.ca

1. Purpose and scope

To make sure RealEstAi can recover data after a failure or a mistake, to say plainly what the platform’s resilience is, and to give firms what they need to meet their own record-keeping obligations. This policy covers the production platform: the web application, the database, document storage, scheduled jobs and the deployment pipeline.

2. The platform

Component	How it runs
Region	Microsoft Azure, Canada Central.
Web application	Azure App Service. A failed instance is restarted or redeployed from the pipeline.
Database	Azure Database for PostgreSQL with automatic, encrypted backups and point-in-time restore to any moment in the previous seven days.
Documents	Azure Storage, in a private container, with redundant copies held within the data centre. The product never destroys a matter’s documents: deletion archives them under the ten-year hold.
Providers	The AI, email, SMS, e-signature and registry services listed in the Privacy Policy. An outage at a provider degrades the feature that uses it; none of them holds the only copy of anything.

3. Monitoring

Uptime checks every five minutes.
Request metrics, tracing and grouped error tracking across the platform.
Six hourly security detectors, with critical alerts emailed to a monitored mailbox.
Every deployment is checked against a health endpoint before it is treated as complete.

4. How we respond

Scenario	Response
A bad release	The previous release is redeployed from the pipeline. A database change that would destroy data cannot deploy in the first place.
An application failure	The service is restarted from Azure, or redeployed.
Data corrupted or wrongly changed	The database is restored to a point before the change, within the seven-day window, and the application is pointed at the restored copy; or the affected records are recovered from a restored copy.
A security incident that requires the service to be stopped	The application is stopped and the Incident Response Policy applies.
A regional outage at Azure	Service resumes when the region does. Affected firms are told.

A restore also brings back the platform’s encryption keys and secrets, which are held separately from the database; a restore is complete only when the application runs against the restored copy.

5. Telling firms

During an outage or a recovery, each affected firm’s administrator of record is told by email what has happened, what is affected and when the next update will come. Where the platform itself is in doubt, we do not rely on in-platform messages.

6. A firm’s own records

A law firm remains responsible for its own records. Law Society of Alberta Rule 119.35 requires a firm to keep and periodically test a backup of its prescribed financial records. To support that, a firm can take out of the platform at any time: the closing package for any matter as one PDF; accounting and trust exports in CSV, QuickBooks, Xero and CosmoLex formats; a trust-reconciliation export; any individual document; and a personal-information report for any one person. Bulk extracts are provided on request.

7. Review

This policy is reviewed on a regular cadence, after any incident that affects availability, and whenever the platform’s hosting configuration changes; the tables above are updated to match.

Trust Center