Our data plane is a dedicated tier with its own lifecycle. Databases are not co-located inside your application container, which means a container restart, an out-of-memory kill, or a rollback never touches persistent state. Each customer schema gets its own credentials and its own grants; nothing is shared beyond the engine itself.
Backups run on the data tier rather than inside your application, so they keep working when your application does not. We take a logical dump on a daily schedule and hold a rolling window of restore points. Restores are performed by an operator on request; we will tell you the restore point before we act, not after.