Workspace restores for a project management app

Your company sells a project management app to 5,000 businesses. Each business has one workspace with its projects, tasks, comments and members. All workspaces share one Postgres database of 800 GB, and every table has a workspace_id column. The largest workspace holds 6 GB.

About twice a week, a customer asks to have their workspace back as it was a few days ago. An admin deleted the wrong project, or a bad import overwrote hundreds of tasks. Today the database service takes a snapshot of the whole database at midnight UTC and keeps the last 7. It can keep up to 35. It can restore any snapshot as a new, separate database in about 40 minutes. Restoring a snapshot over the live database would roll back every customer, so support says no.

Customers should be able to pick any day in the last 30 days, as it stood at midnight UTC. A restore must finish within 4 hours of the request and must not touch any other workspace. The workspace may be closed to its users while its restore runs.

Which copies do you keep for restores, and how does support put one workspace back as it was?