Recover.is

Recover.is was a backup platform engineered around the assumption that everything else has already failed — the customer has been ransomwared, the cloud account is compromised, the prod database has been dropped, or a subpoena landed in a friendlier jurisdiction. It shipped Recover Archive, WORM-immutable storage with hash-chained audit evidence and daily Merkle roots, where retention policies were enforced at the gateway and not even the operator could delete data inside its lock window.

Three-layer architecture: the Recover.is application layer — customer dashboard, S3 gateway, control plane, audit, metering, worker — ran on top of Atlas, the underlying compute/storage/Kubernetes/managed-Postgres platform, all hosted in Iceland on 100% renewable power, inside the EEA but outside the EU and outside the reach of the US CLOUD Act. The S3 gateway was SigV4-compatible with envelope encryption (per-object DEKs wrapped by KEKs in OpenBao); audit events were append-only with a verifiable hash chain.

The full stack shipped: Phase 12 deployed control plane, admin console, customer dashboard, gateway, and worker to a production VM, with OIDC via Authentik, evidence-verifier and KEK-rotation smokes wired into CI, and a full S3 conformance suite (v1.0.0-rc cut, through human UAT). On 2026-06-22 the project was placed on hold indefinitely and folded into RunAtlas, where the work can carry forward. Everything was built except Dark Buckets (Chaum blind-signature anonymous storage), the one piece that never shipped.