Database: continuous WAL archiving to object storage, point-in-time recovery tested monthly. - Event store: all events also written to a cross-region backup. - Failover: automated database failover; matching engine shards have hot standby. - Recovery Time Objective (RTO): 5 minutes. Recovery Point O