Backup & Restore

What Backup & Restore is for

Backup & Restore protects important lab data before risky changes, imports, onboarding cleanup, training, or operational audits. It is not a replacement for infrastructure backups, but it gives lab owners and managers a practical way to export and restore the data areas they work with inside the Lab Panel.

Use this page when you need a controlled snapshot of catalog setup, prices, patient history, doctors, inventory, finance records, orders, instruments, or QC data. Every section that appears in the Backup action can also be restored from a matching JSON or CSV backup file produced by Kashef.

Open Backup & Restore from Admin in the Lab workspace. Backups, restores, downloads, and restore uploads are scoped to the whole lab company, not to a single branch workspace.

Page areas

Backup Protection summarizes how many supported sections have a recovery point inside the configured RPO, how many stored files passed the recovery-readiness check, and whether the protection schedule is active. A warning names missing or stale section counts so the gap is visible before a destructive operation.

Backup Insights shows each supported section, the current record count, the count from the latest completed backup, the change since that backup, and when the backup happened. Use it to decide which data changed enough to need a new snapshot.

Automatic Backup shows whether scheduled backups are enabled, which sections are included, when the next run is expected, and how many completed automatic backups are kept. Configure it from the Automatic Backup page action.

Backups lists recent manual and automatic backup files. Completed backups can be downloaded by users with download permission. Completed or failed backup records can be deleted by users with delete permission; queued and processing jobs stay protected until they finish.

Backup / Restore Log is the full operational history. It includes backup and restore records, section, format, status, import mode, completion time, download actions, and error details when a job fails. Technical error details are restricted to users with the Backup & Restore manage permission because they may contain internal identifiers.

Creating a manual backup

Open Backup, choose one or more sections, and select a format. JSON is the safest format for restore because it keeps structure clear. CSV can also be restored when it was generated by Kashef, including raw table snapshots for doctors, inventory, finance, orders, machines, and QC data. PDF is a readable report and should not be used as a restore source.

Catalog backs up test definitions, categories, sample settings, parameters, reference ranges, and related catalog structure. Prices backs up catalog base prices, price lists, contracts, and discount rules according to the selected options. Patients backs up patient identity and can include order history and results.

Doctors, Inventory, Finance Records, Orders, Machines, and QC Data use structured table snapshots. JSON stores the structure directly. CSV stores each table row as table and row_json, so it is still restorable by Kashef, but it should not be edited casually in spreadsheets.

After starting the backup, the job is queued. Backup, restore, and reset jobs for the same company run one at a time to avoid conflicting writes or inconsistent snapshots. Keep working normally, then return to the log or Backups table to download the completed file.

Every generated JSON, CSV, and PDF file is encrypted with AES-256-CBC before it is written to the private backup disk. Kashef immediately decrypts the stored copy in memory, verifies its format, company scope, and section, and records its checksum before marking the job completed. The stored file remains encrypted; an authorized download is decrypted only while streaming it to the user. Failed jobs retry with bounded backoff, and final technical details stay in the restricted backup log rather than the notification.

Restoring data

Open Restore, choose the section, select the source file type, choose a restore mode, upload the matching file, then confirm the destructive notice. Restore uploads must use the selected .json or .csv extension and may be up to 12 MB. Each upload receives a private company-specific storage path and is deleted after the restore job succeeds or fails. Restore jobs run in the queue and appear in the log.

Override existing updates matching records and creates missing records. Assert inserts missing records only and skips existing records. Delete all current then import removes the current scoped records for that section before importing the backup. Use Delete all only after taking a fresh backup and confirming that the uploaded file is the correct one.

Catalog, Prices, and Patients support JSON and CSV restore. Doctors, Inventory, Finance Records, Orders, Machines, and QC Data also support JSON and the Kashef-generated table CSV format. For those related-table sections, use files exported from Backup & Restore so IDs and relationships remain consistent. Kashef rejects generated JSON backups that identify a different lab company or section, and table restores skip rows that would update records outside the current company.

Automatic backups

For eligible lab companies without a schedule, the backup policy creates an enabled daily JSON schedule for all nine supported sections, uses the branch timezone, targets a 24-hour recovery point, and keeps 14 completed automatic files per section. The cloud scheduler checks every fifteen minutes and queues the first protection run immediately. Existing administrator-created schedules remain under administrator control.

Automatic Backup lets trusted administrators change the recurring schedule. Choose whether the schedule is enabled, which sections to include, the frequency, run time, and how many completed automatic backups to keep. Disabling the schedule requires acknowledging the resulting recoverability gap; existing files remain available but no new recovery point is created.

Daily runs every day at the selected time. Weekly runs on the selected weekday and time. Monthly runs on a day from 1 to 28 so the schedule is valid in every month. Automatic backups use JSON so they can be restored later.

The scheduled worker checks due backup schedules every fifteen minutes. If the lab subscription or rollout flag does not allow automatic backups, the schedule does not dispatch jobs and its next run is moved forward.

The RPO shown on the page is 24 hours for daily schedules, 168 hours for weekly schedules, and 744 hours for monthly schedules. A section becomes stale when its latest completed backup is older than that objective. Retention is a per-section count, not a promise to retain files for a fixed number of calendar days.

Encryption key and storage controls

Production should set a stable BACKUP_ENCRYPTION_KEY in the secret manager and use a shared private backup disk such as encrypted object storage. Kashef never shows the key in the panel or stores it in a backup record. The page shows only the encryption algorithm and a non-secret key identifier in verification metadata.

Keep the encryption key in the infrastructure recovery runbook and preserve it during application-key rotation. Losing or replacing the key without retaining the previous secret makes older encrypted snapshots unreadable. Limit the backup disk and key to the web/worker identities that create or restore snapshots, audit key access outside Kashef, and regularly copy authorized portable downloads to a separately controlled recovery location.

Reset Data

Reset Data is the destructive companion to Backup & Restore. It permanently removes selected modules across every branch in the current lab company; it does not remove only one branch.

Only a Manager whose access role still grants Data Reset: Queue Destructive Resets can open the page or queue a request. A direct permission deny blocks the page even for a Manager. Before queueing, select the modules, confirm that you created and verified a current backup for every selection, type the exact English phrase yes delete all, and enter your own current password.

The module descriptions are part of the confirmation:

• Patients removes company patient links, unshared patient records, their company orders, portal visit requests, and loyalty records. A patient still linked to another lab company is preserved.
• Doctors removes company doctors and clears doctor references on existing orders.
• Catalog always removes tests and dependent results, prices, ranges, parameters, calculations, and mappings. Optional checkboxes also remove catalog foundations and microbiology setup.
• Inventory removes items, stock levels, movements, suppliers, receipts, transfers, warehouses, and supply requests.
• Finance Records removes transactions, entries, receipts, budgets, exchange rates, transfers, and reconciliations. Accounts, categories, and payment methods remain.
• Orders removes every company order with samples, results, payments, invoices, attachments, feedback, home visits, and sample transfers.
• Instruments removes instruments and their test mappings.
• QC Data removes controls, targets, and QC result history.

Only one backup, restore, or reset operation can run for a company at a time. When another operation is queued or processing, Reset Data remains visible for review but the queue button is disabled and the server rejects another request.

The Reset Operations Log shows the requesting manager, selected modules, localized status, approximate queue progress, completion time, primary deleted-record counts, and a safe failure reference. Detailed database or filesystem exceptions are written only to protected application logs and are not exposed in the panel.

Before using Reset Data, create the matching JSON or CSV backups and verify that completed files can be downloaded. After completion, open each affected module and confirm the intended empty or retained setup. Use Restore with the matching files when the reset was performed for cleanup rather than permanent retirement.

Permissions and subscription access

Backup & Restore has separate permissions for managing technical details and the catalog schema, creating backups, restoring data, downloading backups, deleting finished backups, and managing automatic backup schedules. Any of these operational permissions can make the page available, but each action and download endpoint enforces its own permission. Give restore and backup-delete access only to owners, managers, or senior administrators who understand the operational impact.

Data Reset is stricter: the user must still have the Manager job role, the dedicated reset permission, current company membership, and a valid password at submission and processing time.

Manual backup and restore are controlled by the backup and restore subscription features. Automatic backups have their own subscription feature and rollout flag, so the page can allow manual backup while keeping scheduling unavailable on plans that do not include it.

Recovery checklist

Before restoring, confirm the section, file date, lab company, and intended mode. Download a fresh backup of the current data before using Delete all. Restore one section at a time when recovering from a complex issue.

After restore, check the affected page, the Backup / Restore Log, and Activity Logs. For catalog or prices, create a test order to confirm pricing and test lookup. For patients or orders, confirm samples and results still open correctly. For finance, reconcile totals before closing a shift.