SOC 2 evidence
The two questions your auditor will ask about backups.
Are they stored off-site? And are they tested? A cron config and a screenshot of an S3 bucket answers neither. Firedrill answers both — automatically, for every backup, with a report your auditor can read without you in the room.
What most teams show the auditor
- A screenshot of the S3 bucket where dumps land
- The cron entry or provider setting that schedules them
- A policy document that says backups are "tested periodically"
- Silence, when asked for the last restore test's results
What Firedrill hands them instead
- Independent, encrypted, off-site backups on infrastructure your provider doesn't run
- A full restore of every backup onto a real, version-matched Postgres instance
- A per-backup evidence report — seven named checks, timestamped, immutable
- Measured recovery time, trended as your database grows
Seven checks, on every single backup.
Not a checksum. Not "the file exists." A real restore, interrogated:
| restore_exit | pg_restore completed cleanly on a real instance |
| schema_hash | restored schema hash matches the source exactly |
| table_presence | every table accounted for |
| row_counts | row counts within tolerance, per table |
| amcheck | btree index integrity verified |
| sample_queries | restored data actually readable |
| duration | recovery time measured, not estimated |
Each report carries an attestation — when the restore ran, on what infrastructure, with a verification ID — and is appended to an immutable record. Forward it to your auditor unedited, or attach it as evidence in Vanta, Drata, or Secureframe.
Where it fits in your audit
SOC 2's availability criteria expect you to demonstrate that data can actually be recovered — not that a backup job is configured. When the auditor samples your controls, "every backup is restore-tested automatically and here are the reports" closes the question in one exchange.
Because Firedrill stores backups on independent infrastructure with envelope encryption and connects through a read-only role it enforces at connection time, the same evidence also supports your vendor-independence and least-privilege stories. The details live on our security page.
And it keeps working after the audit: weekly drill summaries, alerts the moment a backup or restore fails, and a monthly compliance PDF — evidence that accumulates instead of a scramble every renewal.
See the report before your auditor asks for it.
Point the free drill at any pg_dump file and get the exact report format back in minutes — no signup for your database required.
Run a free drill →