Configure a destination deliberately
Fresh installation leaves backup destinations unconfigured. The reviewed root-only destination planning/enrollment process must establish the repository, credentials, policies and independently retained recovery key before backups run. A repository on the same server is not off-server disaster recovery.
The implementation uses encrypted restic snapshots and verifies exact snapshot content before recording completion. Keep the required key accessible outside the server; losing the only key makes encrypted backups unrecoverable.
Know what a snapshot can restore
The release's backup report records component limits. Account snapshots do not recreate every database identity/grant/password, mailbox definition/password hash, application secret or transfer state. Whole-panel component inventory is not a proven full-machine reconstruction.
Do not treat a completed snapshot, readable archive or local component restore as authority for deleting a hosting account. The required full reconstruction attestation is not supplied by the current production workflow, so termination/recovery gates can legitimately remain blocked.
Rehearse independent recovery
Use two designated disposable VMs and the reviewed encrypted off-server recovery procedure. Verify actual identities, credentials, files, websites, databases, DNS/mail/certificates as applicable and behaviour after reboot. Keep provider snapshots and a separate complete recovery plan while these product-level checks remain unqualified.
Do not promote the candidate to customer hosting solely on the basis of local backup tests.