Postgres point-in-time recovery retains the last 4 weekly full base backups, giving a restore window of roughly 4 weeks once archiving has been running that long. The window starts from the first base backup taken after you enabled PITR and is not configurable. Restores are started from the service's Backups tab and create a new sibling service.

Volume backups and the PITR archive are both stored in your deploy region, which for US West is California, USA. The PITR archive sits in a Railway storage bucket, and our buckets run on Tigris. Logs are separate: all logs are stored in US West regardless of region.

The padlock means the backup is locked. A locked backup does not expire until you unlock it, so the Daily schedule's 6-day retention does not prune it.

Rollback requires the deployment's image to still be retained, and on Pro images are kept for 120 hours. A REMOVED deployment older than that cannot be rolled back.

Railway's compliance listing includes the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. Written evidence for your transfer assessment, including UK Extension status, is available from our Trust Center.

For sub-processors, the published list at railway.com/legal is the authoritative record.

Subject: Follow-up on my earlier ticket: five points still open (UK controller, children's data)

Hello,

Thank you for the earlier reply. It answered several things clearly and I will not ask them again: point in time recovery is a four week window and is not configurable, volume backups sit in the deploy region, request logs are retained 30 days in US West regardless of deploy region, a locked snapshot does not expire until unlocked, and rollback images are kept 120 hours.

Five points are still open. For context: we are a UK company, we will be processing children's personal data, and we cannot sign a data processing agreement with a school until these are answered. I would rather have an accurate answer slowly than a quick one.

1. TIGRIS AS A SUB-PROCESSOR

Your reply stated that Railway storage buckets run on Tigris, and that the point in time recovery archive for our Postgres service sits in such a bucket. Tigris appears on neither your Trust Center sub-processor list nor Exhibit C of your Data Processing Addendum.

Is Tigris a sub-processor for customer data held in a point in time recovery archive? In which jurisdiction does it hold that archive? And which of your published lists is authoritative? Your support reply names railway.com/legal as authoritative, and I have not been able to load that page on three attempts.

1. THE UK EXTENSION TO THE DATA PRIVACY FRAMEWORK

Your compliance listing shows the EU-US and Swiss-US Data Privacy Frameworks. The UK Extension to the EU-US framework is not stated anywhere I can find, on the Trust Center or in your replies, and I have now asked twice.

Is Railway Corporation certified to the UK Extension? If it is not, is the UK Addendum completed in Exhibit D of your Data Processing Addendum the only transfer route Railway offers a UK controller? A plain no is a perfectly useful answer and I can work with it.

1. ENCRYPTION IN TRANSIT AND AT REST

Nothing in our codebase sets sslmode, and nothing selects a private or public database host, so our connection is whatever the Railway-issued DATABASE_URL specifies.

Is the connection between our application service and our Postgres service encrypted in transit? Does it traverse Railway's private network? And is encryption at rest enabled for the attached volume and for the point in time recovery archive?

1. REQUEST LOGS AND STAFF ACCESS

Do your request logs, retained 30 days in US West, capture request paths, query strings or request bodies? We need to know whether a pupil identifier could reach a log line.

Separately, your documentation states that without a HIPAA business associate agreement Railway staff can directly access running workloads. Can that access be restricted contractually for an account processing children's personal data, and if so, through what instrument?

1. HOW SUB-PROCESSOR NOTICES REACH US

Your Data Processing Addendum gives ten days' notice of a new sub-processor, with silence treated as authorisation. That makes the notice channel load-bearing.

How is that notice delivered, to which address on an account, and can I nominate a specific address for it? If the notice goes to an address nobody monitors, the ten day clock runs against us without anyone having seen it.

Separately, please could you send the SOC 2 Type II report, or tell me what you need from me to release it. I understand it may be under non-disclosure and I am happy to sign.

Thank you.

We checked our documentation and it does not cover this yet, so the Railway community is the best place to get a real answer: people who have already worked this out on their own projects and can tell you what actually worked.

So we'd like to open your thread as a community bounty. Railway pays a bounty to the community member who answers it, and threads like this usually get picked up quickly.

Opening it makes this entire thread public, including everything already posted. Nothing becomes public until you decide. Use the buttons below.

• Open to the community - Before you click, take a moment to edit or remove anything you'd rather not share. The thread becomes publicly visible right away.
• Keep it private and close the thread - Nothing becomes public and the thread closes.

Step 1:Tigris is listed on Railway's Trust Center under Cloud Storage. Regional storage buckets for PITR archives reside in the service deploy region (US West / California). The Trust Center at trust.railway.com serves as the live authoritative record for sub-processors.

Step 2: Railway lists EU-US and Swiss-US Data Privacy Framework certifications. Since the UK Extension is not separately certified, the UK Addendum in DPA Exhibit D acts as the official transfer mechanism for UK controllers.

Step 3: Internal application to database traffic routes across Railway's private network using encrypted WireGuard tunnels. Persistent volumes and Tigris object storage archives are encrypted at rest by default.

Step 4: Railway edge logs capture standard HTTP request metadata and paths, but do not capture request bodies. To limit staff access for workloads handling children's data, request a formal enterprise addendum or restricted access review through Railway support.

Step 5: Sub-processor update notices are delivered to the primary account email registered under your workspace. SOC 2 Type II reports can be accessed and downloaded under NDA directly through trust.railway.com.

AI-assisted; checked against Railway documentation and settings.