# ETP Foundry — Business continuity

**Draft v0.1 — pending counsel review · 28 September 2026**

What happens if a component fails, or if the person who runs ETP Foundry cannot. It states tested and
untested items separately.

## 1. Recovery objectives

| Component | Recovery point | Recovery time | Tested? |
|---|---|---|---|
| Desk service (Cloud Run) | none lost (stateless) | about 5 minutes (roll back to the previous revision) | **Yes** |
| Desk record store | the last completed write | about 2 minutes to remount, plus the decision on which version to restore | **No** |
| Canton DevNet validator | as of the last identity backup | 1–2 hours, rebuilt from scripted, repeatable steps | Partly: the scripts have run; a full restore has **not** been performed |
| Website (Firebase Hosting) | none lost (built from source) | minutes (redeploy, or roll back a release) | Yes |
| Daily publication record | 1 day | minutes | Yes: the hash chain verifies |

All of this runs in one Google Cloud region (`us-central1`). There is no second region.

## 2. Backups

In place: the validator's participant identities, held in Google Secret Manager. Not yet in place:
scheduled database dumps, a second-region copy, and a tested restore. These are open items.

## 3. Key-person event

ETP Foundry has one operator. If that person is unavailable:

1. **Nothing is invented.** If no committee reaches quorum, the rulebook's fallback applies, and a
   value that cannot be produced is published as a gap. It is never estimated.
2. **Committee members and licensees are told** through the contacts on file, and on /status, as soon
   as anyone with access can do so.
3. **A named deputy** with sealed, documented access to the cloud project and the runbooks will be
   appointed before the first licence is signed. **Not yet appointed.**

## 4. If ETP Foundry stops

- **Notice**: at least 60 calendar days before ceasing any OFFICIAL benchmark (enforced on-ledger;
  rulebook §9).
- **Transfer**: the methodology and the full history may be transferred to a successor administrator;
  licensees are told at least 60 calendar days before (rulebook §9.3).
- **Escrow**: the methodology is published in full, and the fixing history is on the ledger and in the
  publication record, so a successor can recompute any value from published inputs. For a licence we
  will agree a written hand-over: methodology, rulebook, full history, and the right to continue
  publishing under the licensee's own administration.
- **Records** survive cessation for the rulebook's 7-year retention period.

Lucilla, Inc., federal corporation no. 16699448, Toronto, trading as ETP Foundry.
Contact: hello@etpfoundry.com.