A production architecture for protecting database backups from destructive compromise while continuously proving that complete, application-consistent recovery remains possible.