Database Backups

CifraHQ backs up your tenant database automatically once a day at 12:10 AM Eastern Time. Each backup is exported as a .bacpac file (a portable, self-contained archive of schema and data), uploaded to secure cloud storage, and kept for 21 days. The Database Backups screen lists every available backup, lets you queue an on-demand backup at any time, and lets you download any file to your own machine for restoration on a SQL Server you control.

Where to find it

Go to Setup > System > Database Backups.

On-screen actions

Field reference

What is a .bacpac file?

A .bacpac is the standard export format produced by the Microsoft DacFx framework. Unlike a traditional .bak (which is a binary, engine-specific snapshot restored with RESTORE DATABASE), a .bacpac is a logical archive containing:

• the database schema (tables, views, procedures, functions, indexes, constraints)
• the row-level data for every user table
• a small metadata manifest describing the source server version

You restore a .bacpac by importing it, which creates a brand new database on the target server. You cannot use RESTORE DATABASE for a .bacpac, and you cannot import a .bacpac on top of an existing database.

Prerequisites for restoring a .bacpac

Before you start a restore, make sure you have:

1. A SQL Server instance you can connect to with sysadmin or at least dbcreator + securityadmin rights. Local SQL Server Developer Edition is free and works perfectly for restore testing.
2. One of the following client tools installed:
   • SQL Server Management Studio (SSMS) version 18 or newer (Windows only).
   • Azure Data Studio with the SQL Server Dacpac extension (Windows, macOS, Linux).
   • sqlpackage command line tool (cross platform, included with SSMS or downloadable as a standalone package from Microsoft).
3. Free disk space of roughly 3 to 5 times the .bacpac file size. The import process expands the data, builds indexes, and writes a transaction log.
4. A target database name that does NOT already exist on the destination server. The import will fail if a database with the same name is already attached.

Method 1: Restore using SQL Server Management Studio

The easiest way to import a .bacpac if you are on Windows.

1. Open SSMS and connect to the SQL Server instance where you want the restored copy to live.
2. In Object Explorer, right click the Databases folder (not an existing database).
3. Choose Import Data-tier Application...
4. On the Introduction page, click Next.
5. On the Import Settings page, select Import from local disk, browse to the .bacpac file you downloaded from CifraHQ, then click Next.
6. On the Database Settings page:
   • Set New database name to something descriptive, for example CifraHQ_acmecorp_20260501_restore.
   • Leave Data file path and Log file path at the defaults unless you have a specific storage location.
7. Click Next, review the Summary page, then click Finish.
8. Wait for the import to complete. The progress dialog shows each step (extracting schema, importing data, building indexes). For a 100 MB .bacpac expect roughly 2 to 10 minutes; for a multi-gigabyte file it can take much longer.
9. When the dialog Reports success, expand Databases and confirm the new database appears with all expected tables.

Method 2: Restore using sqlpackage (command line)

Use this method for scripted, repeatable, or headless restores.

sqlpackage /Action:Import ^
  /SourceFile:"C:\Backups\acmecorp_20260501031007.bacpac" ^
  /TargetServerName:"localhost" ^
  /TargetDatabaseName:"CifraHQ_acmecorp_restore" ^
  /TargetUser:"sa" ^
  /TargetPassword:"YourStrongPassword" ^
  /TargetTrustServerCertificate:True

Cross platform shells (PowerShell, bash) use the same flag names; only the line continuation character differs (` in PowerShell, \ in bash).

Useful extra flags:

Authentication options other than SQL login:

• Windows authentication: drop /TargetUser and /TargetPassword and add /TargetTrustServerCertificate:True. The current Windows account is used.
• Microsoft Entra ID (formerly Azure AD): add /TargetUser:"name@tenant.com" and /UniversalAuthentication:True.

Method 3: Restore using Azure Data Studio

For macOS or Linux Users.

1. Install the SQL Server Dacpac extension from the Extensions marketplace inside Azure Data Studio.
2. Connect to your target SQL Server instance.
3. Press Ctrl+Shift+P (or Cmd+Shift+P on macOS) to open the command palette and run Data-tier Application Wizard.
4. Choose Deploy a data-tier application (.dacpac) or import a bacpac (.bacpac) to a new database.
5. Browse to the .bacpac, name the new database, and click Deploy.

Verifying the restore

After the import completes, run a few sanity queries against the new database to confirm the data is intact:

USE CifraHQ_acmecorp_restore;

-- Top tables by row count
SELECT TOP 25 t.name, p.rows
FROM   sys.tables t
JOIN   sys.partitions p ON p.object_id = t.object_id AND p.index_id IN (0, 1)
ORDER  BY p.rows DESC;

-- Most recent activity (date columns vary by entity, this is a quick spot check)
SELECT TOP 10 Id, DateCreated, DateModified
FROM   PurchaseOrderHeaders
ORDER  BY DateModified DESC;

If the row counts and recent timestamps match your expectations from the live tenant at the time of the backup, the restore is good.

Common errors and how to fix them

Tips

• Download a manual backup before any high-impact change (bulk import, mass update, GL re-post). Click Backup Now, wait for it to appear, then download the file. You will have an exact pre-change snapshot you can stand up locally if you ever need to compare.
• Keep restored copies clearly labeled. Naming the target database CifraHQ_<tenant>_<yyyyMMdd>_restore makes it obvious which environment a sandbox came from and which day it was captured.
• Drop sandbox restores promptly. A restored copy is a snapshot of business data; treat it as sensitive and remove it from your local server when you are done.
• Restoring to Azure SQL Database works the same way; pass /TargetServerName:yourserver.database.windows.net and use the /p:DatabaseEdition, /p:DatabaseServiceObjective, and /UniversalAuthentication:True flags appropriate to your subscription.

Related: Tenant Configuration · System Logs