SLO and Error Budget Service  ·  View 11 of 21  ·  Data

Storage Zones

Four classes, where the classification is itself the recovery design.

Editable source SVG draw.io All views
System of record — backed up, point-in-time restore SLO registry Azure SQL, RPO 1 min Budget policies versioned Measured input — retained and replayable Minute buckets 13 months hot/warm Quarantined batches replayable, 30 d Derived — rebuildable, deliberately not backed up Budget projection Redis Compiled alert rules Report extracts Evidence — immutable, write-once Window snapshots Blob WORM, 5 yr Audit ledger SQL ledger, 5 yr Alert decisions 13 months Cold Compressed aggregates archive tier project close window tier at 90 d replay Storage Zones — Record, Input, Derivation, Evidence Data store event / async batch Four classes, and the classification is the decision: anything rebuildable from the two left-hand zones is not backed up at all, and anything in the evidence zone has no update path. A restore of the derived zone is a recompute, which is why its objective is stated in minutes of compute rather than as an RPO. v 1.0 · owner Reliability Architecture · date 2026-10

Decisions

  • Anything rebuildable from the record and the retained input is not backed up at all. Its recovery objective is stated in minutes of compute rather than as an RPO, because a backup of derived state is a slower way to get a staler answer (ADR-16).
  • The evidence zone has no update path at all — immutable blob with time-based retention and tamper-evident ledger tables. An auditor's question is answerable without trusting the platform's own access control (ADR-14).
  • Quarantined batches are a retained store rather than a dead-letter queue, because the operational act is "look at it, fix the source, replay" rather than "discard" (ADR-08).

Targets

  • Registry and audit ledger RPO ≤ 1 minute, RTO ≤ 15 minutes. SLI aggregates RPO ≤ 5 minutes — all assumed.
  • Minute buckets 13 months; snapshots and audit 5 years; alert decisions 13 months; cold archive tiered at 90 days — assumed.
  • Derived state restored within 90 minutes of regional recovery, by recompute.

Risks

  • A recovery path only exercised in an incident is a claim, not a capability. Shadow verification exists to keep the recompute honest (view 15).
  • Write-once retention is irreversible by design: a retention policy set wrongly cannot be corrected, and the blast radius is five years of evidence.
◀  Data Flow — Cube to Verdict All views Data Model  ▶
Solution Architecture v1.0 · Microsoft Azure · Reliability Architecture · 2026-10 · 21 views · 17 architecture decision records11-storage-zones