Does Railway train AI on customer data?

Our reader didn't find a statement on the Railway pages it could read. Ask the vendor and check its DPA and AI terms.

Is Railway SOC 2 compliant?

Railway's website mentions SOC 2 Type II (trust.railway.com). Ask the vendor for the audit report to verify it.

Who are Railway's subprocessors?

Railway lists 45 subprocessors, including SOC 2 Type 2, SOC 3, HIPAA, GDPR, EU-US DPF.

Does Railway have a DPA?

Yes, Railway publishes a data processing agreement at https://railway.com/legal/dpa.

Railway security review: SOC 2, AI training & subprocessors

What Railway publishes about its security, privacy and use of your data, with a link to the page each fact came from. Checked October 10, 2026.

Transparency score

80/100

SOC 2

SOC 2 Type II

ISO 27001

Not mentioned

Trains AI on your data?

Not found

Subprocessors

45 listed

DPA

Published

"Not found" means our reader didn't find it on the public pages it could read; the vendor may still publish it.

Does Railway train AI on your data?

Our reader didn't find a statement about training AI models on customer data on the Railway pages it could read. Railway may publish one elsewhere, for example in a help center, AI terms or a trust portal. Ask the vendor in writing and check its DPA and AI terms.

Certifications Railway claims

Certification or report	Mentioned on
SOC 2 Type II	trust.railway.com
SOC 3	trust.railway.com
HIPAA	trust.railway.com

Privacy laws and frameworks mentioned: GDPR, CCPA/CPRA, EU-U.S. Data Privacy Framework. These are laws the vendor says it follows, not certifications.

A certification on a website is a claim. For anything sensitive, ask Railway for the SOC 2 report or ISO certificate.

Railway subprocessors

Railway lists 45 subprocessors on trust.railway.com:

SOC 2 Type 2
SOC 3
HIPAA
GDPR
EU-US DPF
Swiss-US DPF
Data Access LevelRestricted
Impact LevelSevere
Recovery Time Objective60 minutes
View more
Audit Logging
Data Security
Integrations
HIPAA Report
Pentest Report
SOC 2 Report
Data Backups
Data Erasure
Encryption-at-rest
Responsible Disclosure
Bot Detection
Code Analysis
Data Processing Agreement
Privacy Policy
Cookies
Data Breach Notifications
Data Privacy Officer
Data Access
Logging
Password Security
Status Monitoring
Google Cloud Platform
Separate Production Environment
Disk Encryption
DNS Filtering
Endpoint Detection & Response
Firewall
Spoofing Protection
Traffic Filtering
Asset Management Practices
Email Protection
Employee Training
Acceptable Use Policy
Asset Management Policy
Backup Policy

Security features mentioned

SSO / SAML	Not found
SCIM provisioning	Not found
Multi-factor authentication	Mentioned
Encryption at rest	Mentioned
Encryption in transit	Not found
Penetration testing	Mentioned
Bug bounty / disclosure program	Mentioned
Audit logs	Not found
Data residency	Mentioned United States, Singapore, Netherlands
security.txt contact	Not found

Key documents

Trust / security center	trust.railway.com
Privacy policy	railway.com/legal/privacy
Subprocessor list	trust.railway.com
Data processing agreement (DPA)	railway.com/legal/dpa
AI policy	Not found
Terms	railway.com/legal/terms
Status page	status.railway.com

How this score is worked out

Check	Points	Result
Security or trust page	15	Yes
Certifications listed	20	Yes
Privacy policy	10	Yes
Subprocessor list	15	Yes
DPA available	10	Yes
AI training policy stated	15	No
security.txt contact	5	No
Status page	10	Yes

The score measures how much of a standard security review our reader could answer from Railway's public pages. It is not a rating of how secure Railway is, and a "No" can mean the document exists where our reader couldn't see it.

Check another vendor

Get the same profile for any vendor in seconds, or let your AI agent do it with Stormap's free MCP server.

Check a vendor Connect to Claude, Cursor or ChatGPT Vendor security review checklist

Other Developer & data vendors

Airbyte · Algolia · Amplitude · Auth0 · CircleCI · Clerk · Cloudflare · Confluent · Databricks · Datadog · DigitalOcean · Fastly

Source: Railway's own public website (6 pages read on October 10, 2026). Stormap is not affiliated with Railway. Facts are what the vendor publishes about itself; certifications are claims, not verified audit reports. Something wrong or out of date? Pages are re-checked every two weeks.