[{"data":1,"prerenderedAt":551},["ShallowReactive",2],{"navigation_docs":3,"-guides-backup-and-restore":220,"-guides-backup-and-restore-surround":546},[4,25,60,91,190,205],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75,81,86],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"path":83,"stem":84,"icon":85},"Backup and restore","\u002Fguides\u002Fbackup-and-restore","3.guides\u002F4.backup-and-restore","i-lucide-database-backup",{"title":87,"path":88,"stem":89,"icon":90},"Upgrade and roll back","\u002Fguides\u002Fupgrade-and-roll-back","3.guides\u002F5.upgrade-and-roll-back","i-lucide-arrow-up-circle",{"title":92,"icon":6,"path":93,"stem":94,"children":95,"page":6},"API reference","\u002Fapi","4.api",[96,101,106,111,116,121,126,131,136,139,144,149,153,158,163,168,173,178,183,186],{"title":97,"path":98,"stem":99,"icon":100},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":102,"path":103,"stem":104,"icon":105},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":107,"path":108,"stem":109,"icon":110},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":112,"path":113,"stem":114,"icon":115},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":117,"path":118,"stem":119,"icon":120},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":122,"path":123,"stem":124,"icon":125},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":127,"path":128,"stem":129,"icon":130},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":132,"path":133,"stem":134,"icon":135},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":137,"stem":138,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":140,"path":141,"stem":142,"icon":143},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":145,"path":146,"stem":147,"icon":148},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":150,"path":151,"stem":152,"icon":120},"People and sessions","\u002Fapi\u002Fpeople","4.api\u002F12.people",{"title":154,"path":155,"stem":156,"icon":157},"Overview","\u002Fapi\u002Foverview","4.api\u002F13.overview","i-lucide-layout-dashboard",{"title":159,"path":160,"stem":161,"icon":162},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F14.webhooks","i-lucide-webhook",{"title":164,"path":165,"stem":166,"icon":167},"Cases","\u002Fapi\u002Fcases","4.api\u002F15.cases","i-lucide-folder-open",{"title":169,"path":170,"stem":171,"icon":172},"Reports","\u002Fapi\u002Freports","4.api\u002F16.reports","i-lucide-file-check",{"title":174,"path":175,"stem":176,"icon":177},"Organisation","\u002Fapi\u002Forganisation","4.api\u002F17.organisation","i-lucide-building-2",{"title":179,"path":180,"stem":181,"icon":182},"Setup","\u002Fapi\u002Fsetup","4.api\u002F18.setup","i-lucide-rocket",{"title":56,"path":184,"stem":185,"icon":59},"\u002Fapi\u002Faudit-log","4.api\u002F19.audit-log",{"title":80,"path":187,"stem":188,"icon":189,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F20.coming-soon","i-lucide-clock",{"title":191,"icon":6,"path":192,"stem":193,"children":194,"page":6},"Security and licensing","\u002Fsecurity","5.security",[195,200],{"title":196,"path":197,"stem":198,"icon":199},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":201,"path":202,"stem":203,"icon":204,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":206,"icon":6,"path":207,"stem":208,"children":209,"page":6},"Reference","\u002Freference","6.reference",[210,215],{"title":211,"path":212,"stem":213,"icon":214},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":216,"path":217,"stem":218,"icon":219},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":221,"title":82,"body":222,"description":539,"extension":540,"links":541,"meta":542,"navigation":543,"path":83,"seo":544,"stem":84,"__hash__":545},"docs\u002F3.guides\u002F4.backup-and-restore.md",{"type":223,"value":224,"toc":526},"minimark",[225,229,234,249,290,305,309,315,321,325,328,353,360,363,372,384,387,391,450,454,457,474,477,519,522],[226,227,228],"p",{},"Everything Sentinel needs is in its PostgreSQL database: events, decisions, alerts, cases, rules, people, API key hashes, filings, attachments and the audit log. Redis holds only counters that are rebuilt from the database, and the configuration lives in your environment variables. Back up the database and you can rebuild the rest.",[230,231,233],"h2",{"id":232},"take-a-backup","Take a backup",[226,235,236,240,241,244,245,248],{},[237,238,239],"code",{},"sentinel-admin db backup"," runs ",[237,242,243],{},"pg_dump"," against ",[237,246,247],{},"SENTINEL_DATABASE_URL"," and writes one compressed file.",[250,251,257],"pre",{"className":252,"code":253,"filename":254,"language":255,"meta":256,"style":256},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","docker exec sentinel \u002Fapp\u002Fsentinel-admin db backup -out \u002Fbackups\u002Fsentinel-2026-10-22.dump\n","Terminal","bash","",[237,258,259],{"__ignoreMap":256},[260,261,264,268,272,275,278,281,284,287],"span",{"class":262,"line":263},"line",1,[260,265,267],{"class":266},"sBMFI","docker",[260,269,271],{"class":270},"sfazB"," exec",[260,273,274],{"class":270}," sentinel",[260,276,277],{"class":270}," \u002Fapp\u002Fsentinel-admin",[260,279,280],{"class":270}," db",[260,282,283],{"class":270}," backup",[260,285,286],{"class":270}," -out",[260,288,289],{"class":270}," \u002Fbackups\u002Fsentinel-2026-10-22.dump\n",[226,291,292,293,296,297,300,301,304],{},"The folder has to exist inside the container and be writable by it, so mount one with ",[237,294,295],{},"-v \u002Fbackups:\u002Fbackups"," when you start the container. Without ",[237,298,299],{},"-out"," it writes ",[237,302,303],{},"sentinel-\u003Ctime>.dump"," to the current directory. The file is readable only by its owner. A failed dump leaves no file behind, so a half-written backup is never mistaken for a good one.",[306,307,308],"warning",{},"A backup holds personal data, API key hashes and sessions. Store it as carefully as the database: encrypted at rest, with access limited to the people who already have the database.",[226,310,311,312,314],{},"The container image carries the PostgreSQL 17 client tools. If your server is a newer major version, run the command on a host that has matching tools, since ",[237,313,243],{}," refuses a server newer than itself.",[226,316,317,318,320],{},"You can also use your own database backups, such as a managed service's snapshots or continuous archiving. Those suit a tight recovery point. ",[237,319,239],{}," suits a scheduled dump, a copy before an upgrade, and moving an install.",[230,322,324],{"id":323},"restore","Restore",[226,326,327],{},"Restore into an empty database, then start Sentinel against it.",[250,329,331],{"className":252,"code":330,"filename":254,"language":255,"meta":256,"style":256},"docker exec sentinel \u002Fapp\u002Fsentinel-admin db restore -in \u002Fbackups\u002Fsentinel-2026-10-22.dump\n",[237,332,333],{"__ignoreMap":256},[260,334,335,337,339,341,343,345,348,351],{"class":262,"line":263},[260,336,267],{"class":266},[260,338,271],{"class":270},[260,340,274],{"class":270},[260,342,277],{"class":270},[260,344,280],{"class":270},[260,346,347],{"class":270}," restore",[260,349,350],{"class":270}," -in",[260,352,289],{"class":270},[226,354,355,356,359],{},"It refuses a database that already has people or events, so a mistyped URL can't overwrite a live install. To replace one on purpose, add ",[237,357,358],{},"-replace",". That drops and recreates every table in the dump, in a single transaction: if anything fails, the database is left as it was.",[226,361,362],{},"When the load finishes, the command walks every organisation's audit chain and prints the result:",[250,364,370],{"className":365,"code":367,"filename":368,"language":369,"meta":256},[366],"language-text","restored \u002Fbackups\u002Fsentinel-2026-10-22.dump\nok: 44 audit entries verified for default\nok: 3 audit entries verified for acme\n","Output","text",[237,371,367],{"__ignoreMap":256},[226,373,374,375,378,379,383],{},"If any chain doesn't match, it prints ",[237,376,377],{},"BROKEN",", names the organisation and exits with an error. Don't put that database into service until you know why. See the ",[380,381,382],"a",{"href":57},"audit log",".",[226,385,386],{},"A dump from an older version restores fine. Start the newer version afterwards and it applies the migrations it is missing.",[230,388,390],{"id":389},"a-schedule-that-works","A schedule that works",[392,393,394,410],"table",{},[395,396,397],"thead",{},[398,399,400,404,407],"tr",{},[401,402,403],"th",{},"What",[401,405,406],{},"How often",[401,408,409],{},"Notes",[411,412,413,426,439],"tbody",{},[398,414,415,420,423],{},[416,417,418],"td",{},[237,419,239],{},[416,421,422],{},"At least daily",[416,424,425],{},"Copy the file off the machine that took it",[398,427,428,431,434],{},[416,429,430],{},"A copy before every upgrade",[416,432,433],{},"Each time",[416,435,436,437],{},"See ",[380,438,87],{"href":88},[398,440,441,444,447],{},[416,442,443],{},"A restore test",[416,445,446],{},"Every quarter, and after changing the setup",[416,448,449],{},"Restore into a scratch database and check the audit result",[230,451,453],{"id":452},"disaster-recovery","Disaster recovery",[226,455,456],{},"Decide two numbers with your compliance lead, and write them down:",[458,459,460,468],"ul",{},[461,462,463,467],"li",{},[464,465,466],"strong",{},"How much data you can lose"," (recovery point). A daily dump means up to a day. Continuous archiving of PostgreSQL brings it down to minutes.",[461,469,470,473],{},[464,471,472],{},"How long you can be down"," (recovery time). Time a restore of a recent backup on the hardware you would really use. That is your number, not an estimate.",[226,475,476],{},"To recover on new hardware:",[478,479,481,486,489,492,499,503,506,510],"steps",{"level":480},"3",[482,483,485],"h3",{"id":484},"prepare","Prepare",[226,487,488],{},"Install the same Sentinel version, or newer, with the same environment variables, and an empty database.",[482,490,324],{"id":491},"restore-1",[226,493,494,495,498],{},"Run ",[237,496,497],{},"sentinel-admin db restore"," with the most recent good backup.",[482,500,502],{"id":501},"check","Check",[226,504,505],{},"Confirm the audit result, start Sentinel, sign in, and open a recent alert and a recent filing.",[482,507,509],{"id":508},"replay","Replay",[226,511,512,513,516,517,383],{},"Events sent after the backup are not in it. Your services can resend them: an event with an ",[237,514,515],{},"idempotency_key"," Sentinel already has is returned as it was, and a new one is scored. See ",[380,518,107],{"href":108},[226,520,521],{},"Test this before you need it. A backup nobody has restored is a guess.",[523,524,525],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":256,"searchDepth":527,"depth":527,"links":528},2,[529,530,531,532],{"id":232,"depth":527,"text":233},{"id":323,"depth":527,"text":324},{"id":389,"depth":527,"text":390},{"id":452,"depth":527,"text":453,"children":533},[534,536,537,538],{"id":484,"depth":535,"text":485},3,{"id":491,"depth":535,"text":324},{"id":501,"depth":535,"text":502},{"id":508,"depth":535,"text":509},"Back up a Sentinel install, restore it, and prove the restored audit trail is intact.","md",null,{},{"icon":85},{"title":82,"description":539},"F3uMPNzMehofCNk02CWtJBfiwGQ5YaDNNW1S0GEMEWc",[547,549],{"title":76,"path":77,"stem":78,"description":548,"icon":79,"badge":80,"children":-1},"Use a connector to bring events from a payment rail into Sentinel without writing integration code.",{"title":87,"path":88,"stem":89,"description":550,"icon":90,"children":-1},"Move an install to a new version, and go back if it goes wrong.",1792666436026]