RPO and RTO
RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time – how far back you can roll back. RTO (Recovery Time Objective) is the maximum acceptable downtime – how quickly you must be back online. RPO=0 means zero data loss (synchronous replication). RTO=0 means zero downtime (active-active). Both cost exponentially more as they approach zero.
Definition
RPO and RTO are the two fundamental parameters of any backup and disaster recovery strategy. RPO answers: 'if disaster strikes right now, how much recent data can we afford to lose?' An RPO of 1 hour means backups run hourly – at most 1 hour of transactions are lost. An RPO of 0 requires synchronous replication (every write confirmed in two locations before acknowledging to the application). RTO answers: 'how long can the business survive without this system?' An RTO of 4 hours means the DR plan must restore service within 4 hours of failure detection. An RTO of 0 requires active-active multi-region with instant failover. Business impact analysis determines these values: a trading platform may need RPO=0/RTO=0 (millions lost per minute of downtime). A blog might accept RPO=24h/RTO=48h (daily backups, restore when convenient). Every decision has cost implications: RPO=0 doubles write latency (synchronous replication) and storage costs. RTO=0 doubles infrastructure costs (full standby environment). The conversation with business stakeholders is: 'how much are you willing to pay to reduce downtime from 4 hours to 4 minutes?'
Examples
- –RPO=15min: WAL archiving every 15 minutes to S3 + point-in-time recovery
- –RPO=0: PostgreSQL synchronous_commit = remote_apply (zero data loss, +latency)
- –RTO=1h: pre-provisioned DR infra with Terraform, automated DNS failover, tested runbook
Related Protocols
Related Terms
Failover
Failover is the automatic transfer of traffic from a failed primary system to a standby replica. Database failover promotes a replica to primary. DNS failover routes to a backup IP. Load balancer failover removes failed backends. Recovery time (RTO) depends on detection speed and promotion mechanism – seconds for load balancer, minutes for database.
High Availability (HA)
High availability is a system design that minimizes downtime by eliminating single points of failure. Measured in 'nines' – 99.9% (8.7h downtime/year), 99.99% (52min/year), 99.999% (5min/year). Requires: redundant components, automatic failover, health monitoring, and tested recovery procedures.
Disaster Recovery (DR)
Disaster recovery is the plan and infrastructure for restoring service after catastrophic failure (region outage, data center loss, ransomware). Defined by RPO (how much data loss is acceptable) and RTO (how quickly service must resume). DR requires cross-region replication, tested runbooks, and regular drills.