Backup restore
What to write when they ask if you have restored a backup
The row asks how backups work, whether you have ever restored, and what recovery time to write. Having backups is a different sentence from a restore you have done, and both are different from a recovery time. If you have no restore on record, say so and say what you will do. Do not tick Yes.
This is a practical note for a security review, not legal advice.
What the row is asking
Reviewers ask how backups work. They ask whether you have ever restored. They ask for backup evidence, and they ask for a recovery time. Those are separate sentences.
Clausebench, on a page updated September 22, 2026, writes: "Both questionnaires ask whether access is reviewed, whether data is encrypted, whether there is an incident response process, how backups work and how suppliers are chosen." Clausebench sells software that drafts questionnaire answers. The page is written for a consultant, not as a founder asking for help.
The same page says: "Will a No lose us the deal? Rarely on its own. A pattern of optimistic Yes answers that the documents do not support is more likely to." Nothing in these sources says a deal stalled on a restore date.
John Farmer, writing on August 18, 2026, weights backup and a tested restore as "Not whether you back up. Whether you have ever restored." The eleven-person company in his opening is the article's scene, not a named client. The sample answers on that page are samples he wrote, not a clock from a named company.
Having backups is often the hosting company or the database company keeping a copy. A restore is you bringing a copy back, on a date you can name. A recovery time is how long that restore took. Write a number only when you measured one.
The data retention guide tells you to say when a backup keeps a copy longer than the live product. It does not ask whether anyone has restored that copy, or what recovery time to write.
The security questionnaire guide names backups in the overview you keep. It does not separate "we have backups" from "we restored one."
The processing location cell is where a vendor processes data. The location cell is not where backups sit. A region you selected is not a restore.
What reviewers accept
Say who makes the backups. Often the hosting company or the database company does it. Name that company, and how often the copy is made if their page says. If you have not read that page, say you have not checked.
Say whether you have ever restored. If you have, name the date and what you restored. That is the backup evidence.
If you have no restore on record, say so, and say what you will do. Run one and date it. Do not tick Yes.
A recovery time is a number from a restore you timed. If you have not timed one, do not write a number.
"We have backups" is not "we restored one," and neither sentence is a recovery time. Write only the sentences that are true.
An honest gap is a complete answer. The answer that fails is a Yes you cannot stand behind when they ask whether you have ever restored.
Answers you can paste
Use the line that is true. Replace the brackets. Delete anything that is not true.
The provider makes the backups
Backups of customer data are made by [hosting or database company]. Their page says the copies run [how often]. We read that page on [date]. This is how backups work. It is not a restore, and it is not a recovery time.
We restored one
We restored a backup on [date]. We restored [a database / a customer account / a file]. That is the backup evidence. Whether you have ever restored: yes, on that date.
No restore on record
We have not restored a backup. There is no restore on record. We will run one and date it. We will not tick Yes until that date exists.
Recovery time we measured
The restore on [date] took [time]. That is the recovery time we can write. We will not write a shorter time.
No recovery time yet
We have not timed a restore. We will not write a recovery time until we have.
We have not checked backups
We have not checked whether [hosting or database company] keeps backups, and we do not keep a copy ourselves. We will not write that we have backups.
What not to write
Do not tick Yes because a hosting company or a database company says it keeps copies. That can support how backups work. It is not a restore.
Do not write a recovery time you have not measured.
Do not put backups in the processing location cell. The location cell is not where backups sit.
Do not treat a longer backup copy in the retention answer as a restore. How long a copy is kept is a different row.
Do not invent a restore date, a deal that stalled, or a number of hours.
Do not describe a restore that only lives in your head. If you have not written the date, say you have no restore on record.
Where this answer lives
Keep these sentences in the questionnaire answer you control.
The public page shows your company name, a short summary, and a contact email. Each row shows the company, what it does, the processing location, the agreement link, and the date you saved it.
You can list the company that hosts the data or makes the backups as a vendor row once you type it.
There is no field for a restore date, a backup schedule, or a recovery time. The page does not fill this row.
If you want the longer notes
How long you keep customer data, including when a backup keeps a copy longer than the live product, is in the data retention guide.
The file a customer takes when they leave, and a confirmation that the live copy is gone, is a different row from a restore. A backup may still hold a copy after that delete. What to write for the exit is in the customer data export guide.
How to answer a vendor security questionnaire, including the overview line that names backups, is in the security questionnaire guide.
The location cell is not where backups sit. What to write for a processing location is in the processing location guide.
Related guides
Optional next step: a living page
The sentences above are enough for the row in front of you.
If you want one link for the companies that handle customer data, Trust Prep is a page you edit when a company changes. The page shows your company name, a short summary, and a contact email. Each row shows the company, what it does, the processing location, the agreement link, and the date you saved it. You can add the company that hosts the data or makes the backups once you type that row.
The page has no field for a restore date, a backup schedule, or a recovery time. Those sentences stay in the answer you keep.