Scheduled backups

Scheduled backups export your workspace's data on a cadence you choose, to cloud storage you already own — Google Drive, Dropbox, or Box. Configure destinations under Settings → Backups.

What's in the archive, and what deliberately isn't

Every archive is a ZIP of one CSV per table plus a manifest.json that says exactly what was included and, just as importantly, what was left out.

Personal HR data is excluded. Compensation records, performance reviews, leave records, employee profiles, and employee documents are never exported — those are scoped to the individual, not the organization, and an org admin is not automatically an HR admin. The manifest lists them under withheld with the reason person-scoped, so their absence reads as "deliberately not included," not "the org had none."

Credentials are excluded too. The archive contains no OAuth tokens for your connected storage and no webhook signing secrets. Those columns are encrypted with a key that never leaves Time Trakkr, so exporting them would put unreadable secrets into your Dropbox or Box and restore nothing — encryption at rest protects our database, not a file syncing to every device attached to that folder. The manifest lists them under withheld with the reason secret-material.

Internal machinery is excluded. Request-deduplication keys, webhook delivery logs, unsaved drafts, running timers, and the backup system's own run history are your rows, but not records you would restore a workspace from. They appear under withheld with the reason operational, so the archive holds your business data rather than a database dump.

A handful of other tables (invitations, API keys, client links, and some internal OAuth bookkeeping tables) are withheld because they are never scoped by organization in the database — including them would risk mixing rows across workspaces, so they are never on the table.

What connecting a provider actually grants

The three providers do not grant the same level of access, and it is worth knowing the difference before you click Connect.

Google Drive and Dropbox are scoped to what this app creates. Drive uses the drive.file scope — Time Trakkr can only see and manage files it creates itself, never the rest of the Drive. Dropbox connects through an app-folder-equivalent access type with the same effect: a space of its own, not the whole account.

Box is the exception: connecting it grants read and write access to the entire Box account, not just a backups folder — every file and folder the connecting user can see, for as long as the connection stays active. This isn't a corner Time Trakkr cut: Box's standard "sign in with Box, click Allow" authorization flow — the one that lets you connect your own account from Settings without an administrator provisioning anything for you first — only offers two scopes, root_readonly and root_readwrite, and neither is folder-scoped. There is no Box equivalent of Drive's drive.file or Dropbox's app-folder access reachable through that flow. Box does support true folder-isolated access, but only through a service-account style authentication that has no per-user "Connect" button at all — trading away the self-serve connect flow this feature relies on. The Backups settings page repeats this warning directly next to the Box connect button, before you authorise anything.

Which providers are actually available

Connecting Google Drive, Dropbox, or Box requires that provider's OAuth client to be registered for this deployment first. If a provider isn't registered, the Backups settings page shows it disabled with the specific thing that's missing, rather than offering a "Connect" button that would fail. Ask whoever administers this deployment which providers are turned on before assuming one is available — the app will not let you configure a destination for one that isn't.

Cadence and retention

Each destination has its own cadence (daily, weekly, or monthly) and retention count (how many archives to keep — older ones are deleted automatically after a successful upload). A destination can be paused without losing its configuration or history.

When a scheduled backup actually runs

There is no hour to choose. A destination runs for the first time shortly after you create it, and from then on it keeps roughly that time of day — a daily backup first taken at 10am stays at about 10am, whether or not the export itself is quick.

Two things follow, and both are deliberate:

• The check happens hourly, so a run can land up to an hour after the moment you might expect, and the first one begins within an hour of setting the destination up rather than instantly. Use Run now if you want one immediately.
• A missed run is not skipped for the whole cadence. If the destination was paused, failing, or unreachable, it becomes due again on the next check rather than waiting another full day, week or month.

Run now triggers an export immediately, outside its schedule — useful right after setting one up, without waiting for the next cadence to roll around. It queues the same real export-and-upload job a scheduled run does; it is not a preview or a dry run.

When something goes wrong

A backup that fails silently for weeks is worse than no backup at all, so failure is surfaced in three places:

• The destination's card shows its last run time, last success time, and its most recent error, if it has one.
• The very first time a destination starts failing, the workspace's owners and admins get an email about it. You are not emailed again for every repeat failure in the same streak — only when a new failure follows a success, or the first time it ever fails.
• A destination with no active credential (never connected, or disconnected since) is shown as needing to be reconnected, and a run against it fails loudly rather than silently doing nothing.

Ask the assistant

The assistant can tell you the status of every backup destination — provider, cadence, retention, whether it needs reconnecting, and its last run/success/error — and can trigger an existing destination to run immediately. It cannot create a destination, connect a provider, or change cadence or retention; those are Settings → Backups only.