# ETP Foundry: business continuity

**Draft v0.2, pending counsel review, 19 October 2026**

> **In short.** What happens if a part of the service fails, or if the one person running ETP Foundry cannot continue. Tested and untested items are stated separately. If no fund committee can sign, no NAV is struck and the gap is published; nothing is estimated. A fund is wound down with at least 60 days' notice, enforced on the ledger. Everything runs in one Google Cloud region; there is no second region and no deputy yet.

> **What changed from v0.1.** Restated for the fund model: the key-person rule now refers to fund NAVs and the Methodology's missed-value rule; "ceasing an OFFICIAL benchmark" is now a fund's wind-down, signed by the fund's own parties; "licensees" are now fund sponsors and seat holders; and a successor is a successor operator of the fund toolkit, not a benchmark administrator. Recovery objectives and backups are unchanged.

## 1. Recovery objectives

| Component | Recovery point | Recovery time | Tested? |
|---|---|---|---|
| Desk service (Cloud Run) | none lost (stateless) | about 5 minutes (roll back to the previous revision) | **Yes** |
| Desk record store | the last completed write | about 2 minutes to remount, plus the decision on which version to restore | **No** |
| Canton DevNet validator | as of the last identity backup | 1–2 hours, rebuilt from scripted, repeatable steps | Partly: the scripts have run; a full restore has **not** been performed |
| Website (Firebase Hosting) | none lost (built from source) | minutes (redeploy, or roll back a release) | Yes |
| Daily publication record | 1 day | minutes | Yes: the hash chain verifies |

All of this runs in one Google Cloud region (`us-central1`). There is no second region. Signed fund records live on the Canton ledger, not only in our systems.

## 2. Backups

In place: the validator's participant identities, held in Google Secret Manager. Not yet in place: scheduled database dumps, a second-region copy, and a tested restore. These are open items.

## 3. Key-person event

ETP Foundry has one operator. If that person is unavailable:
1. **Nothing is invented.** If a NAV is not signed by its deadline, it is recorded as missed and the gap is published (Methodology v1.1 §6.3). It is never estimated. Seats can still pause creations and redemptions themselves.
2. **Sponsors and seat holders are told** through the contacts on file, and on /status, as soon as anyone with access can do so.
3. **A named deputy** with sealed, documented access to the cloud project and the runbooks will be appointed before the first sponsor agreement is signed. **Not yet appointed.**

## 4. If ETP Foundry stops

- **Notice:** each fund is wound down by its own parties with at least **60 days'** notice before the final redemption, enforced on the ledger (Methodology v1.1 §8.6). We will give sponsors and seat holders at least 60 days' notice before we stop.
- **Transfer:** the methodology and the full record may be transferred to a successor operator, with at least 60 days' notice to sponsors and seat holders.
- **Escrow:** the methodology is published in full, and every signed NAV and fund action is on the ledger, so a successor can recompute any value from its recorded inputs. For a real fund we will agree a written hand-over: methodology, rulebook, full record, and the right to continue running the fund under a successor.
- **Records** survive for at least five years (Methodology v1.1 §9.4).

Lucilla, Inc., federal corporation no. 16699448, Toronto, trading as ETP Foundry. Contact: hello@etpfoundry.com.