POL-11: Backup Policy

Purpose

This policy establishes the requirements for backing up data to ensure its availability and recoverability. It protects legal-medical knowledge and analysis services from data loss.

Scope

This policy applies to all data processed, stored, or transmitted by BluQube hosted, private, or self-managed deployments. It covers regulated data, proprietary information, and public data.

Policy Statements

Data shall be backed up regularly according to defined schedules. Backup copies must be stored securely and tested periodically. In self-managed deployments, customers are responsible for their own backups; BluQube provides the framework but not the enforcement. Regulated data backups require encryption and access controls. No data shall be excluded from backup without explicit justification.

Backup retention period (mandatory minimum)

Encrypted backups of regulated data are retained for a minimum of seven (7) years — 2555 days.

This is the same documentation-retention floor that governs audit events under POL-6 and NEXUS-SEC-028: 45 CFR §164.316(b)(2)(i) requires six years, and the additional year is a deliberate margin so the control does not sit exactly on the regulatory line. The decision was made by the Owner on 2026-10-11 under NEXUS-SEC-033, replacing the previous 30-day rolling window.

Two requirements follow from the way this retention is actually enforced:

recent" cap overrides any day-based window, because pruning discards backups once the count is exceeded regardless of age. A count cap may be used only where it does not bind below the seven-year floor, and the deployment default is no count cap.

code default and this policy are checked by the scripts/check_backup_retention.py release gate, which fails the build on drift. Shortening retention requires amending this policy, obtaining Owner approval, and updating the code default in the same change.

1. Time is the retention rule, not generation count. A "keep N most
2. The declared value and the enforced value may not diverge. Both the

Client contracts, BAAs, litigation holds, and court orders override this minimum upward. Nothing in this policy authorises deletion of a backup that is subject to a hold.

Post-termination expiry (mandatory maximum)

The seven-year figure is a minimum for a customer who is still under a signed BAA. It is not a licence to keep a departed customer's PHI.

BAA v3 §12.3 (restated by Governance §8.3) requires a business associate to return or destroy PHI within 90 days of termination of the agreement. For a terminated tenant the operative deadline is therefore terminated_at + ≤90 days, and the seven-year minimum does not extend it. The two clocks are independent: an archive is retained for seven years while its tenant is a customer, and destroyed within ninety days of the day that tenant's BAA was terminated.

Operational rules (enforced by lncnexus/backup/expiry.py):

may be shortened by configuration but never widened past 90 days.

fires. An archive shared with a still-active tenant is not destroyed — destroying it would destroy a live customer's only encrypted copy — and is instead recorded as pending, with the compensating controls and the date it becomes destroyable (once every tenant it covers has terminated).

tamper-evident audit trail.

1. Termination of a tenant's BAA starts its clock automatically; the window
2. An archive holding only that tenant's data is destroyed when the clock
3. A litigation hold outranks the clock: deletion is suspended and recorded.
4. Every scheduling, destruction, and hold-blocked decision is written to the

Per-tenant erasure inside one shared archive is not expressible in the current encrypted format (one AES-256-GCM payload, one content manifest, one SHA-256); closing that gap requires a format change to per-tenant data keys and is tracked as a decision, not assumed away.

Roles and Responsibilities

The Security Team defines backup standards and monitors compliance. System administrators implement backup procedures and test recovery. Data owners determine backup requirements for their data. Users follow backup procedures.

Evidence and Review

Backup logs, recovery test records, and audit reports serve as evidence of compliance. The Security Team conducts periodic reviews of backup practices and investigates anomalies. Deployment-specific configurations are treated as controlled material.

Exceptions

Exceptions to this policy require written approval from the Security & Compliance owner or delegated risk owner and must be documented with a risk acceptance statement. Exceptions are valid only for a defined period and must be re-evaluated before expiration.

Enforcement

Violations of this policy may result in disciplinary action, up to and including termination, and legal prosecution where applicable. Data access may be suspended immediately upon detection of a violation.

Related Policies

POL-6 (Data Retention and Disposal Policy), POL-12 (Business Continuity Policy), POL-7 (Encryption Policy).

Revision History