Business Continuity and Disaster Recovery (BCDR) Policy

1. Purpose

The purpose of this Business Continuity and Disaster Recovery (BCDR) Policy is to establish a framework that ensures Valstorm LLC can respond to, recover from, and restore critical business operations in the event of a significant disruption. Our primary objectives are to maintain a high level of service availability for our customers, protect company and customer data, and ensure the timely resumption of operations following an incident.

2. Scope

This policy applies to all Valstorm LLC personnel, critical business processes, and the information technology infrastructure and systems that support our SaaS platform.

3. Policy Statements

3.1 Business Impact Analysis (BIA) and Risk Assessment Valstorm LLC performs a Business Impact Analysis (BIA) to identify critical business functions and the resources that support them. This analysis determines our Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical systems. We conduct regular risk assessments to identify a broad range of potential threats, including those related to natural disasters, pandemics, cyber-attacks, and critical vendor failures.

3.2 Continuity Strategy: A Cloud-Native Approach Our continuity strategy is built upon the inherent resilience of our cloud infrastructure provider (e.g., AWS, Google Cloud, Azure). We do not rely on physical data centers. This approach provides robust protection against localized and regional disruptions.

• Geographic Redundancy: Our production environment is architected across multiple, geographically isolated Availability Zones. In the event of a zone-level failure, traffic is automatically routed to a healthy zone. For critical data, we utilize cross-region replication to protect against a large-scale regional disaster.
• High Availability and Fault Tolerance: Our platform is designed for high availability using load balancing, auto-scaling groups, and redundant infrastructure components. This ensures that the failure of a single server or component does not impact overall service availability.
• Data Backup and Recovery: As defined in our Data Backup and Recovery Policy, we perform regular, automated backups of all customer data. These backups are encrypted and stored in a separate, secure location. Recovery procedures are tested regularly to ensure data can be restored effectively within our defined RTO and RPO targets.

3.3 Personnel and Operational Resilience Valstorm LLC operates as a distributed, remote-first organization. This model ensures that disruptions to a specific building, city, or region do not impact our ability to conduct business, maintain our platform, or provide customer support. Our continuity plan explicitly accounts for events like pandemics or regional disruptions by leveraging secure, remote access for all employees.

3.4 Incident Management and Plan Activation The BCDR plan is an integral part of our overall Incident Response Plan. A declared disaster or major disruption will trigger the activation of the Incident Response Team (IRT), which is responsible for executing the procedures outlined in this plan to recover and restore services.

3.5 Third-Party Dependency Management We identify and maintain a list of critical third-party service providers, with our cloud infrastructure provider being the most critical. We actively monitor the status and service health of these vendors. Our BCDR plan includes communication protocols and procedures for managing service disruptions caused by a critical vendor failure.

4. Plan Testing and Maintenance

To ensure the effectiveness of our BCDR plan, we are committed to:

• Regular Testing: Conducting BCDR tests at least annually. These tests may include tabletop exercises, simulations of failover procedures, and tests of data restoration from backups.
• Continuous Improvement: Reviewing and updating the BCDR plan and associated documentation annually, or whenever there is a significant change to our infrastructure, business processes, or risk landscape. Lessons learned from tests and actual incidents are incorporated into the plan.