Skip to content
orangecheck
Get started

Recovery

If something breaks, here is what survives.

orangecheck runs on one database. The parts that hold money and identity are copied to a second one every day at 04:00 UTC. Every signed receipt is timestamped on Bitcoin every hour, so it can be checked without us.

On this page

The backup

Where it lives
Upstash Redis
Copied
Every day at 04:00 UTC, into Postgres
Covers
92 kinds of money and identity records. Any that carry secrets are encrypted first, or left out.
Kept for
30 days
Last snapshot
2026-10-15 04:00 UTC · 102 keys
Worst-case loss
Up to a day of state since the last snapshot

What survives without the backup

Every signed receipt is timestamped on Bitcoin through OpenTimestamps every hour, and a salted commitment to it goes to these Nostr relays (kind 30087). Anyone holding a receipt older than the last run can check it without us. The relays hold commitments, not receipts: a receipt names a person, so it is never published.
  • relay.damus.io
  • nos.lol
  • relay.snort.social
  • relay.ochk.io

So the relays cannot rebuild a lost store.

Recovery is the copy above. The public record proves what happened; putting it back is done by hand.

Restoring

  1. 01
    Stop writesThe app has no maintenance switch, so it is taken offline first. A restore over live traffic overwrites balances that moved since the snapshot.
  2. 02
    Rehearse itRead the newest snapshot and list everything it would write back, changing nothing.
  3. 03
    RestoreOnly records missing from the store are written back, so nothing newer is rolled back. Restoring the snapshot exactly is a separate, deliberate choice.
  4. 04
    Check the booksBalances are recomputed from envelopes on every read, and /audit re-checks each event against its project's published prices.

No restore has been timed or drilled yet.

So there is no recovery-time target we can stand behind.

Live health is on Status. What we store, and why, is on Security.

Never backed up

Some things cannot leak from a backup, because we never have them.

Private keys
A Bitcoin wallet's key never reaches orangecheck. Email users hold none here; orangecheck signs for them.
Recovery phrases
We never see one.
Real names, cards, addresses
We do not collect them.