Regions, disaster recovery and exit

What this page covers

This is MYRILUM's target architecture. It does not mean everything on the map is live; whether a capability can be used today is stated in “Current availability”.

Going global never means copying across borders by default. This page states principles only; implementation details are not published.

One contract, regional runtime

Regions share one set of versioned interfaces, tasks and evidence semantics; customer data, execution processes and storage are partitioned as needed. Using data across regions requires stating which data, for whom, for what purpose, for how long and who is responsible.

No global claims without evidence

Without real regions and operating evidence, there are no claims of global high availability, active-active multi-cloud or localized data. Take the China region: today only the business database is inside mainland China, and identity authentication runs in a separate environment, isolated by region and hosted outside mainland China.

A backup is not a restore

Backups cover everything needed to restore the business. A restore drill checks more than whether the database starts: identity, keys and versions, and whether tasks, external operations, funds, entitlements and usage all agree. Recovery-point and recovery-time objectives follow measurement.

Fallbacks stay within the same limits

When a model or tool fails, switching happens only within the same authorization, and work pauses if there is no qualified alternative; when a region fails, only a pre-approved fallback is used and data is never moved elsewhere on its own. Recovery never bypasses users' data permissions, regional limits or payment authorization, and customers are told what was affected, where things stand, how far handling has got and when the next update comes.

Exit is a product capability

After a user or organization stops using the platform, they can still export their material, results and evidence together with versions, authorizations and correction records, and verify and migrate them. Work in progress is completed, handed over, cancelled or refunded; keys, connections, access and indexes are revoked or deleted, and on exit the receipts and anything unresolved are checked. No one is locked into records they cannot make sense of.

Source

This page follows A28 of the MYRILUM architecture map v2.2. Under the public boundary it publishes principles only and carries no diagram. Related: “Enterprises, tenancy and organization workspaces”; “Data and memory lifecycle”; “Deployment and trust boundaries”.