Recover.is was a backup platform engineered around the assumption that everything else has already failed — the customer has been ransomwared, the cloud account is compromised, the prod database has been dropped, or a subpoena landed in a friendlier jurisdiction. It shipped **Recover Archive**, WORM-immutable storage with hash-chained audit evidence and daily Merkle roots, where retention policies were enforced at the gateway and not even the operator could delete data inside its lock window.
Three-layer architecture: the **Recover.is** application layer — customer dashboard, S3 gateway, control plane, audit, metering, worker — ran on top of **Atlas**, the underlying compute/storage/Kubernetes/managed-Postgres platform, all hosted in **Iceland** on 100% renewable power, inside the EEA but outside the EU and outside the reach of the US CLOUD Act. The S3 gateway was SigV4-compatible with envelope encryption (per-object DEKs wrapped by KEKs in OpenBao); audit events were append-only with a verifiable hash chain.
The full stack shipped: Phase 12 deployed control plane, admin console, customer dashboard, gateway, and worker to a production VM, with OIDC via Authentik, evidence-verifier and KEK-rotation smokes wired into CI, and a full S3 conformance suite (v1.0.0-rc cut, through human UAT). On **2026-06-22** the project was placed **on hold indefinitely and folded into RunAtlas**, where the work can carry forward. Everything was built except **Dark Buckets** (Chaum blind-signature anonymous storage), the one piece that never shipped.