How can RPO be zero if recovery takes under a minute?

They measure different things. RPO is how much data you can afford to lose. RTO is how long the service can be unavailable. You can have a 30-second outage and still have zero data loss if the system comes back with all its committed data intact.

Zero RPO needs to be defined for a particular failure scenario. Typically, it means no acknowledged transactions are lost, which may require synchronous replication or another design that confirms data is durable on more than one system before reporting success. During failover, writes might pause for a short time, so users see an outage without losing committed data.

There are edge cases to pin down, especially writes that were in progress when the failure happened. A system can only make a zero-RPO claim if its behavior for those writes is clear and tested. Replication that happens after a write is accepted can still leave a data-loss window.

Also, a sub-minute RTO is a recovery target, not a promise that every request keeps working. And an uptime target is a separate measurement. A service can meet its recovery-time target after an outage while still having experienced downtime, with no data loss at all.