Weekly AWS s3 backup service

Benchling can configure weekly exports of a Benchling tenant's data to an AWS s3 bucket owned by a customer. Once configured, the customer's Benchling data will be copied to the designated s3 bucket every Sunday. Benchling is not responsible for maintaining this data within AWS. 

Set up weekly s3 backups

To request weekly s3 backups, contact your Benchling Customer Success representative or our Support team at support@benchling.com and ensure you:

1. Create an AWS account.
2. Create the buckets to store backups.
3. Share the name of your s3 bucket in AWS with your representative.
4. Grant Benchling's AWS account access to your bucket.

Recommendations for creating your AWS bucket

When creating your AWS bucket, we recommend:

• Naming the bucket yourname-benchling-backups or something similar. Note that AWS bucket names are global across all AWS customers and regions.
• Placing it in a region close to you for improved download times. The regions we currently support are:
  • us-west-1 (N. California, USA)
  • us-west-2 (Oregon, USA)
  • us-east-1 (Virginia, USA)
  • us-east-2 (Ohio, USA)
  • eu-central-1 (Frankfurt, Germany)
  • eu-west-1 (Ireland)
  • ap-northeast-1 (Tokyo, Japan)
  • ap-northeast-2 (Seoul, South Korea)

Grant Benchling AWS account access

Grant Benchling AWS account access to your bucket and attach the following policy to the destination bucket.

• Replace YOUR_BUCKET_NAME with your destination bucket name.
• Replace ACCOUNT_NUMBER with either:
  • 371589656068 if the customer is a non-Validated cloud tenant
  • 282336740275 if the customer is a Validated cloud tenant

You can attach policies in the S3 management console in the Permissions panel and by opening Bucket Policy.

{
     "Version": "2012-10-17",
     "Statement": [
          {
               "Sid": "AllowBenchlingAccess",
               "Effect": "Allow",
               "Principal": {
                    "AWS": "arn:aws:iam::ACCOUNT_NUMBER:root"
               },
               "Action": [
                    "s3:PutObject",
                    "s3:PutObjectAcl"
                ],
               "Resource": [
                    "arn:aws:s3:::YOUR_BUCKET_NAME",
                    "arn:aws:s3:::YOUR_BUCKET_NAME/*"
                ]
          }
     ]
}

After sharing your bucket name, we'll configure the backup system to write to the bucket. Backups happen once a week, on Sundays.

What data is included in the export?

S3 URL structure

s3://your-bucket/backup-path/human/YYYY/MM/DD/project_id/file_id/index.extension

• Optionally the format can be configured to
  •  .../Project Name (project_id)/File Name (file_id)/index.extension for PDF exports
  • or  `.../project_id/File Name (file_id)/index.extension for HTML exports

Data included

Projects

• Each project will be exported as a prefix (folder) in AWS
• Virtual projects or folders where only entities are stored are also exported

Entities

• Metadata fields exported as key/value pairs in a .txt file
• Description exported as a PDF
• Archived entities included
• DNA sequences exported as GenBank file (.gb)
• AA sequences exported as a FASTA file (.fasta)
• Entities that are registered are exported within the src_id of that Registry, while unregistered entities are exported within their respective project
  • Note: Registries and projects both use the same src_ prefix

Notebook Entries

• Either HTML or PDF
• Attached protocols and sequences included within the .pdf
• Review history embedded in the entry IF the configuration is enabled
• Metadata exported as either a separate .csv file or within the entry PDF
• Note: Metadata ONLY includes metadata tracked in Entry Schema fields
• Attached files (e.g. images, Excel files) exported in the same folder as separate files
• Archived entries are exported with [Archived] prepended to the title

Data NOT included

Projects and Folders

• Empty projects
• Folder hierarchies within projects are not maintained. Data is still exported, but subfolders within a project are flattened. 

Entities

• Non-field metadata (author, folder, etc)
• Attachment files in metadata fields
• DNA Sequences: Visualizations (linear map, plasmid map, etc.)
• AA Sequences: Biochemical properties

Notebook Entries

• EXP ID, Date Created, Author Name, etc. This data must be queried with a custom Insights query
• All schema configurations
• Drop-down menu options
• Entry templates
• Workflows, Inventory, Requests, Insights, and Results that were not captured in Notebook entries

Export options

Please inform your Benchling representative of your preference for the following options of file type of entries in the export and other information to optionally include:

• Notebook entries can be exported as either HTML or PDF
• Notebook entry audit logs can be included as a .DSV file with the entry export
• The Genbank text sequence of @-mentioned DNA sequences
  • For PDFs these are embedded within the entry. For HTMLs these are included as a separate file
• An entry's schema fields can be included as a separate .CSV file with the entry export
• An entry's schema fields can be included as a metadata page 
  • For PDFs this is included in the entry. For HTMLs these are included as a separate file
• A summary table of the entry's review history can be included at the top of each entry file 
  • The comments associated with each review state change can be included in the review history table
• The attachments submitted in any structured results tables can be included as separate files in the export

Institutional backups (for licensed academic institutions)

Some academic institutions partner with Benchling to administer their scientists' data. These licensed institutions receive a weekly backup of the data in Benchling projects that their members own, delivered to an institution-owned s3 bucket. The AWS setup is the same as described above — create a bucket in a supported region and grant Benchling's AWS account access with the bucket policy. The points below describe what is specific to institutional backups.

Eligibility

Institutional backups are arranged with Benchling as part of an institution partnership and are not self-serve. Contact your Benchling representative or support@benchling.com to have institutional backups set up for your institution.

Which projects are backed up

A project is included in your institution's backup when either:

• the owner of the project is a member of your licensed institution, or
• the project is owned by an organization whose admin is a member of your licensed institution.

Only ownership places a project in scope. A project that is merely shared with one of your members, but owned by someone outside the institution, is not included.

What the backup contains

Institutional backups include the same human-readable exports described in What data is included in the export?, for the projects in scope above. Depending on your agreement with Benchling, they can also include:

• Audit records for the institution's data, and
• Institution reports — CSV summaries of entries, users, organizations, and projects.

What to include in your request

In addition to the standard bucket details above (bucket name, AWS account ID, supported region, and the bucket policy), please tell your Benchling representative:

• That the request is for an institutional (licensed-institution) backup,
• Your institution's name as registered with Benchling,
• The institution-owned s3 bucket (and path) that should receive the backups, and
• Any additional data types you want beyond the default human-readable export (e.g. audit records or institution reports).

How Benchling protects customer data

Benchling is designed with high availability in mind, and data is stored with high redundancy. Our AWS-hosted databases are synchronously replicated across data centers, and files are stored in Amazon S3, which stores files across multiple data centers and is designed for 99.999999999% durability (11 9s). All data is stored encrypted at rest.

As an additional measure, Benchling performs several layers of backups to ensure data recovery if necessary. Database change logs are captured along with daily snapshots to allow Benchling engineers to perform point-in-time recovery for any time in the last 30 days. Weekly snapshots are also captured and stored cross-region in the event of large-scale disasters.

Access to customer data is strictly controlled and audited. Your data is stored on production networks separate from Benchling employees, and access to customer data requires administrative approval and is granted only on an as-needed, temporary basis.