Salesforce has disaster recovery plans in place and tests them at least once per year. The Salesforce Services utilize secondary facilities that are geographically remote from their primary data centers, along with required hardware, software, and Internet connectivity, in the event Salesforce production facilities at the primary data centers were to be rendered unavailable.
The Salesforce Services’ disaster recovery plans currently have the following target recovery objectives: (a) restoration of the Salesforce Service within 12 hours after Salesforce’s declaration of a disaster; and (b) maximum Customer Data loss of 4 hours; excluding, however, a disaster or multiple disasters causing the compromise of both data centers at the same time, and excluding development and test bed environments, such as the Sandbox service.
Source – https://compliance.salesforce.com/en/disaster-recovery-bcp and https://help.salesforce.com/servlet/servlet.FileDownload?file=01530000003SIm9AAG
Salesforce maintains a copy of customer data for disaster recovery purposes, but it is important for customers to develop a data backup and recovery strategy as part of their overall data management and security model. The Salesforce Data Recovery service is an expensive and time-consuming process and should only be used as a last resort, when no other copy of the data is available.