This Business Continuity and Disaster Recovery Plan ("BCP/DR") describes how RAVEN maintains availability of the platform, protects against data loss, and recovers from disruptive events affecting the platform's infrastructure, personnel, or third-party dependencies. It is designed to align with the FFIEC Business Continuity Management booklet and the resilience expectations of our chartered depository-institution customers.
2. Scope
This plan covers RAVEN's production platform (API, dashboard, database, key management), critical third-party subprocessors (listed at /legal/subprocessors), and the personnel necessary to operate the platform.
3. Business Impact and Recovery Objectives
Recovery Time Objective (RTO): 4 hours for the core verification API and dashboard. 24 hours for ancillary functions (PDF report generation, analytics).
Recovery Point Objective (RPO): 15 minutes for consumer and tenant data; 1 hour for audit logs.
Maximum Tolerable Downtime: 24 hours before customer notification and remediation commitments under the Customer Agreement are triggered.
4. Architecture and Resilience Posture
Hosting: Amazon Web Services, U.S. region. Compute is containerized and stateless; service can be redeployed in any AWS region from infrastructure-as-code.
Data store: Amazon DynamoDB with encryption at rest and continuous point-in-time recovery enabled. DynamoDB's managed replication provides regional durability; cross-region restore is supported through point-in-time recovery exports.
Key management: AWS KMS with automatic key rotation. KMS is regionally available and managed by AWS.
Source of truth: Infrastructure-as-code and application source are stored in version control with offsite backups. A full production environment can be rebuilt from source.
Statelessness: The application tier holds no state — recovery is a redeploy plus data restore.
5. Backup and Restoration
DynamoDB continuous backups (point-in-time recovery) cover a 35-day window
Application source and infrastructure code are mirrored across version control providers
Encrypted off-region exports of DynamoDB tables on a documented cadence for disaster scenarios
Restore drills exercised at least annually; restore drill results are recorded and reviewed by the Qualified Individual under the WISP
6. Failover Scenarios
Single-AZ failure: AWS managed services handle this transparently. No RAVEN action required.
Regional impairment: Application tier is redeployed from infrastructure-as-code to an alternate AWS region. DynamoDB tables are restored from point-in-time recovery to the alternate region. RTO target: 4 hours.
Subprocessor outage: The platform's enrichment engine tracks per-provider health and routes around degraded providers where alternatives exist. Verification reports are delivered with provider-attribution and confidence indicators that reflect partial completion when a provider is unavailable.
Loss of key personnel: Documented runbooks and shared on-call rotation ensure no single individual is required to operate the platform. Incident Commander role is delegated under the Incident Response Plan.
Source-control provider outage: Off-provider mirrors enable continued development and deployment.
7. Testing
Tabletop exercise of a major-disruption scenario at least annually
Restore drill of DynamoDB point-in-time recovery into a non-production environment at least annually, with documented validation that the restored state matches expectations
Failover deploys exercised through routine deployment automation, which doubles as a region-rebuild capability
Test results are reviewed by the Qualified Individual and reported to the governing body in the annual WISP report
8. Notification
If an event causes (or is likely to cause) a customer-facing disruption exceeding RTO, the Incident Commander notifies affected customers under the Incident Response Plan and the Customer Agreement, with status updates at least every four hours until resolution.
9. Plan Maintenance
This BCP/DR is reviewed at least annually and after any material change to the platform architecture, subprocessor list, or threat landscape. The Qualified Individual owns plan maintenance.