What to save
Create a coordinated backup of the database, app/config.local.php, private storage/, and uploaded business or portal assets under assets/uploads/. Include any other installation-specific uploaded files and server configuration used by your deployment. Retain the matching release archive and version information.
The original application encryption key belongs with the data it protects. A database dump without its matching keys and files is not a complete recovery plan. Store backups outside the web root with restricted access and a retention schedule appropriate to your records.
Produce a consistent backup
Use your host's database and file backup tools. Arrange a maintenance window or another supported consistency method so the database and files represent the same point in time. Protect database exports as customer data; do not put them in a public downloads folder or Git repository.
Prove recovery privately
Restore into an isolated environment first. Keep it inaccessible to customers and leave email, external AI and other external connections disabled until reviewed. Verify local sign-in, a case, quotation, application, attachments and decryption using authorised test records.
Preserve the restored keys. Do not run the fresh installer against the restored database or copy a newly generated configuration over the original configuration. Once recovery is proven, plan the production cutover and confirm that only the intended installation can send customer messages.