# Disaster recovery tiers

> Choose how much standby capacity to keep for a lost region, from backups alone to a second site that serves traffic all the time, and pay for the speed you need.

Disaster recovery tiers trade money for recovery speed: the faster you must be back, the more idle or duplicate capacity you pay for.

## Use it when

- A whole region or zone loss would end the business, not just spoil a day.
- The business says how long it can be down and how much data it can lose, so the tier is a choice and not a guess.
- You have backups but have never restored one.

## How it works

AWS's whitepaper names four tiers, cheapest first:

1. **Backup and restore.** Copy data elsewhere, and rebuild everything after the disaster. Recovery takes hours.
2. **Pilot light.** Keep the data replicated and the core running, and start the rest on demand. Recovery takes tens of minutes.
3. **Warm standby.** Keep a scaled-down copy of the whole stack running, and scale it up on failover. Recovery takes minutes.
4. **Active-active.** Serve traffic from two sites at once, so a loss only removes half the capacity. Recovery is near zero.

A team that loses a region at `02:00` with only nightly backups restores a day-old copy and rebuilds servers by hand. A team with active-active already serves from the other site.

## What it costs

Each tier up multiplies the bill and the complexity, and active-active adds the cross-site consistency problems of [replication strategies](https://wiki.playquorum.dev/patterns/replication-strategies.md). The common mistake is an untested restore. A backup you have not restored is a hope, so rehearse it.

## In Quorum

The game has the rungs that matter. A snapshot-only Database is backup and restore. A zone standby covers a lost zone. A replica in another region behind GeoDNS is a warm standby, and a Spread store is active-active. It has no pilot light. The Design below shows the zone rung.



[Point-in-time recovery](https://wiki.playquorum.dev/research/pitr.md) unlocks backups, [Multiple zones](https://wiki.playquorum.dev/research/multi-az.md) unlocks the standby, and [Disaster recovery drills](https://wiki.playquorum.dev/research/dr-drills.md) runs the scripted regional outage the IPO checklist asks for. The [Zone outage](https://wiki.playquorum.dev/incidents/zone.md) incident shows a standby taking over. See [RPO and RTO](https://wiki.playquorum.dev/patterns/rpo-and-rto.md) for the two numbers a tier buys, and the glossary entry on [availability zones](https://wiki.playquorum.dev/glossary/availability-zone.md).

Source: https://wiki.playquorum.dev/patterns/disaster-recovery-tiers