> Fetch the index of every Tonbo docs page as Markdown at https://tonbo.dev/llms.txt

# Durability

Last updated 29 October 2026

Read this when you run databases in production: where each region keeps the replicas, how maintenance behaves, and which releases of the package work together. [Guarantees](https://tonbo.dev/docs/databases/how-it-works.md#commit) states when a commit is durable.

Every region databases are created in keeps a database’s three replicas the same way, one in each of three availability zones of the region: `us-east-1`, `ap-southeast-1`.

## Replicas

`synced()` resolves once two of the three replicas hold every commit made before it. A replica that restarts, or comes back after its host or its disk was lost, catches up from the other two before it takes part again (see [Ursula in Tonbo](https://tonbo.dev/docs/databases/internals/ursula.md#fsync)), and older commits and snapshots move to [object storage](https://tonbo.dev/docs/databases/internals/snapshots.md) in the same region. To take a database elsewhere, or keep a copy to go back to after a mistake of your own, export it (see [Backups and salvage](https://tonbo.dev/docs/databases/backups.md)).

## Maintenance

Tonbo [restarts the replicas one at a time](https://tonbo.dev/docs/databases/internals/ursula.md#maintenance) for maintenance. Replication pauses for a few seconds while another replica takes over. Commits continue on your host meanwhile, and the package sends them again until Tonbo takes them.

## Versions

Use `@tonbo/sqlite-ursula` 0.11. Its releases within 0.11 work with each other and with the service, which runs Ursula 0.11, the open-source server behind Tonbo, and other minor releases do not. A release within 0.11 opens the databases and local copies another one left, so upgrade a database’s writer by stopping the old process before the new one opens the database.