Operations: upgrades, backups and support

This page covers day-to-day operation of the single-tenant Hindsight Enterprise options: Private cloud, Bring your own cloud (BYOC) and On-premises. It is for the platform, security and operations teams who need to know what Vectorize does, what you do, and how releases, backups and recovery work.

If you use Enterprise features on a Hindsight Cloud organization, Vectorize operates the whole service and none of the responsibilities below fall to you.

Responsibility matrix

Vectorize means Vectorize does it. You means your team does it. Shared means both have a part, described below the table.

Area	Private cloud	BYOC	On-premises
Infrastructure	Vectorize	Shared	You
Hindsight upgrades	Vectorize	Vectorize	Shared
Schema migrations	Vectorize	Vectorize	Vectorize
Monitoring and alerting	Vectorize	Vectorize	Shared
Backups	Vectorize	Vectorize	Shared
Restores and disaster recovery	Vectorize	Vectorize	Shared
Identity provider and SSO configuration	You	You	You
User management	You	You	You
Network and private connectivity	Shared	Shared	You
Security patches	Vectorize	Shared	Shared

What "Shared" means in each case:

• Infrastructure (BYOC). You provide the cloud account, region, compute quota (including GPU quota) and network. Vectorize deploys and operates the cluster and everything in it.
• Hindsight upgrades (on-premises). Vectorize ships the new chart and pinned image version and works through the upgrade with you; your team runs it on your cluster, and mirrors the new images first if you are air-gapped.
• Schema migrations. In every option, migrations ship with the release and run automatically as part of the upgrade. You never run them by hand.
• Monitoring and alerting (on-premises). Vectorize ships the alert rules and dashboards; they run in your Prometheus and Grafana and alert your team.
• Backups and restores (on-premises). You provide the backup storage and watch the backup alerts. Vectorize configures continuous backups at install and joins you for restores and disaster recovery.
• Network and private connectivity. For private cloud and BYOC, Vectorize publishes the private endpoint and you connect to it from your network, or give Vectorize the IP ranges to allow. See Private networking.
• Security patches. For BYOC, Vectorize patches Hindsight and the cluster it runs; your account-level controls stay with you. For on-premises, Vectorize ships patched Hindsight images and you patch your cluster, nodes and operating systems.

Identity and users are always yours. Your organization owners connect your identity provider in the SSO setup and manage members as described in Team management.

Release and upgrade process

Single-tenant deployments receive the same Hindsight builds as Hindsight Cloud, on a schedule you agree with Vectorize.

• Validated on the multi-tenant service first. A build reaches a single-tenant deployment only after it has already run on Hindsight Cloud.
• Pinned versions. Each deployment runs a specific, immutable image version, never a floating tag. Your deployment changes only when an upgrade is applied to it.
• Coordinated maintenance windows. Upgrades are scheduled with you, not pushed on their own. For on-premises, Vectorize sends the new chart and image version and joins the upgrade.
• Migrations before rollout. Database migrations run as a pre-upgrade step, before any application pod is replaced. If a migration fails, the upgrade stops there: the running version and the schema still match, and service continues on the old version.
• The identity service is upgraded in a set order, with a backup of its database first. Vectorize handles this sequence.

Rollback

Application code and configuration can roll back to the previous release. Schema changes are forward-only: a rollback returns the previous code, but the database keeps the newer schema. Migrations are designed to be additive so that the previous code keeps working against the newer schema. Before relying on a rollback across a release, Vectorize checks that release's migrations for changes that would prevent it.

Monitoring

Every single-tenant deployment ships with alert rules covering the parts of Hindsight that matter for availability and data safety:

Area	Alerts on
API	Error rate, latency, stuck requests, no API instance up
Language model	Failing LLM calls per operation, such as a bad key, lost model access or rate limiting
Background work	Queued or failed operations, consolidation backlog, no worker up
Embeddings	Model service down, failing or queuing requests
PostgreSQL	Instance down, replication lag, connections near the limit, disk nearly full, failing archiving, no recent backup
Workloads	Fewer replicas than desired, pods restarting repeatedly, identity service down

For private cloud and BYOC, these alerts go to Vectorize, and critical alerts page Vectorize's on-call engineers. For on-premises, the rules register with your Prometheus and route through your Alertmanager, and Vectorize provides Grafana dashboards for the API, operations, embeddings and PostgreSQL.

Vectorize reaches private cloud and BYOC clusters through Teleport, with short-lived certificates, MFA on every login, and audit logging tied to each engineer's identity. In BYOC, the Teleport agent dials out, so no inbound access to your network is needed.

Backups and recovery

PostgreSQL

PostgreSQL holds your organizations, users, banks, settings and, unless you use Hindsight Memlake, your memories. It is backed up with continuous archiving of every change plus daily base backups, with 30-day retention by default. Where continuous archiving is in place, which is the standard configuration, you can restore to a point in time within the retention window, not only to the last nightly backup.

Memlake

Hindsight Memlake keeps its own backup, independent of PostgreSQL:

• Continuous WAL archive. Every change to every memory bank is shipped to the archive continuously.
• Daily base backups of every bank.
• A separate region or bucket. The archive lives apart from the live data, so it survives the loss of the live store or its region.
• Soft delete on the archive storage, so deleted backup data can still be recovered within the soft-delete window.

See Memlake for how the storage engine works.

Restore scope

• A restore never overwrites live data. Both PostgreSQL and Memlake restore into a new copy first. Switching the application to the restored copy is a separate, deliberate step.
• A Memlake restore brings back a bank's memories. The bank's configuration, directives, webhooks and knowledge tree are stored in PostgreSQL and come back with the PostgreSQL restore.
• Point-in-time restores take a target time and restore to the latest state the archive holds at or before it.
• Restore testing. On-premises installs test a restore before go-live and then quarterly, into a separate namespace that never touches production.

For site-level disaster recovery, see On-premises: disaster recovery.

Support

Organizations on an enterprise support plan get a ticket portal in the app, email intake, a shared Slack channel with the Hindsight team, and contracted response times measured within your support window. See Enterprise support for how to raise and prioritize tickets.

For an upgrade window, a restore or a failover, contact Vectorize before you start so an engineer can join you.

Next steps

• Compare deployment options in the Deployment overview.
• Book a call or contact your Hindsight representative to discuss operations for your deployment.