Glossary
The words this documentation uses precisely: service, database, RPO, recoverable point, recovery reserve, verification, drill.
Each term below is used in exactly one sense throughout these docs. Where two words are nearly synonyms in ordinary usage, we pick one and mean only that.
If a page seems to be splitting hairs between "limit", "default" and "guideline", or between "last backup" and "last verified restore", this is why.
Service
One managed PostgreSQL instance with a defined vCPU, RAM, storage and I/O allocation, in one location, on one major version. The unit you buy. A service is not a database: it contains multiple logical databases.
Database
A logical database inside a service. Created through the platform rather than with CREATE DATABASE, so the published count is enforced.
Pooled endpoint
The transaction-pooling endpoint, served by a PgBouncer process inside your service's own cgroup. The default for application traffic.
Direct endpoint
A connection straight to PostgreSQL with no pooler. Needed for session-scoped features.
Hard ceiling
A limit enforced by the kernel or the filesystem, which cannot be exceeded. Memory, CPU, storage,
I/O, max_connections.
Configuration default
A value we set that you can change per session. work_mem, statement_timeout. Called a default,
never a limit, because we cannot enforce it.
Recovery point objective (RPO)
The amount of data you could lose. Defined here as now − recoverable_to, where recoverable_to
requires a verified base backup and a gap-free write-ahead log chain following it. Not the time
of the last upload.
Recoverable point
The latest moment you can actually be restored to. Computed per repository, with an explicit unknown state when the evaluation is stale.
Recovery time objective (RTO)
How long recovery takes end to end. Ours comes from drills, not from verification runs.
Restore verification
A scheduled run that restores a real backup into an isolated environment, replays WAL, starts PostgreSQL, runs consistency checks and records timings. Produces the "last proven restorable" date.
Restore test duration
The time a verification run took: restore and replay, uncontended, single service. A lower bound on recovery, not a recovery time.
Drill
A scheduled exercise measuring recovery end to end — detection, decision, host selection, provisioning, fencing, restore, replay, endpoint change and propagation. The only input to a published RTO.
Recovery reserve
Unallocated capacity held in every location so the services on a failed host can be rebuilt on the hosts that remain. Sized from the allocatable capacity of the largest host in the location, evaluated independently per resource dimension.
Repository
A backup destination. Every service writes to two, and the second is in a different country.
Location
Where a service runs, and where its primary backup repository lives. A service does not move between locations.
Managed elevated role
The role you get. Can create schemas and roles, install approved extensions and tune allowlisted
parameters. Not superuser, and without CREATEDB.