RPO

The Definition

 RPO (Recovery Point Objective):
 the MAXIMUM acceptable data loss window, measured in time.

 RPO = 15 minutes means:
 a disaster at 14:00 may lose everything written
 between 13:45 and 14:00. accepted by the business.

 [writes: ▁▂▃▅▆▇█] ──── disaster! █
                    │◄──────►│
                    last backup    loss window ≤ RPO

 RPO is a BUSINESS tolerance translated into
 an ENGINEERING replication architecture.

Architecture Is Determined by the Number

RPO	Required mechanism
24 hours	nightly backups
1 hour	frequent incrementals/log shipping
~1 minute	continuous WAL shipping / async replicas
~seconds	cross-region async streaming
zero (none)	synchronous replication to second site

 cost curve is steep:
 zero-RPO = synchronous writes across distances =
 latency tax on EVERY write + availability coupling
 (second site slow = your writes slow).

 most real systems: RPO of seconds-to-minutes via async,
 accepting bounded loss for bounded cost.

RPO Per Data Class (not one number)

 differentiate honestly:

 payments/ledger:     RPO 0        (synchronous; law+trust)
 user content/posts:  RPO minutes  (async replication)
 session/cart state:  RPO acceptable-loss (rebuildable)
 analytics events:    RPO hours    (re-ingest from source)
 derived caches/views: RPO ∞       (rebuildable by design!)

 declaring per-class RPOs shrinks cost dramatically:
 protect what's precious precisely;
 rebuild what's rebuildable instead of replicating it.

Measuring ACTUAL RPO

 the declared RPO ≠ achieved RPO:

 - async lag SPIKES under load (replication lag lessons!)
 - failed log-ships nobody noticed for hours
 - backups failing silently since March
 
 measure continuously:
 □ replica-lag dashboards with SLO-style budgets
 □ ship-failure alerts (loud ones)
 □ periodic "effective RPO" audits: timestamp newest data
   restorable RIGHT NOW vs now → report the gap
 □ restore drills verify the chain end-to-end (restore lesson)

 effective_rpo = worst-case window given CURRENT health.
 track it like an SLI — because it is one.

Interview Framing

“What’s your data-loss tolerance and how do you achieve it?” scored shape: define RPO crisply, per-data-class table (payments-zero vs analytics-rebuildable), architecture matched to each number (sync vs async vs rebuild), measured-effective-RPO monitoring named, lag-spike caveat acknowledged. The per-class differentiation is the senior move — one global RPO is both overpriced and underprotective.