3 hours ago
Please clarify the documented retention and transfer mechanisms without accessing any customer deployment.
Retention: the official logs page lists 7 days for Trial/Hobby but says upgrading restores older logs. What is the actual physical deletion period or criterion for HTTP, runtime, build/deploy, DNS and network-flow logs, including operational and backup copies? Public support answers have referred to both 7 and 90 days. Please distinguish visibility from deletion.
Contents: do HTTP edge logs contain request bodies or only metadata such as IP, user-agent and path? Does this also describe internal operational systems?
Controls: can individual personal-data log entries be restricted or erased before expiry? What settings are available without changing plan?
Recipients: how can a customer obtain the mapping of workload content, HTTP/network metadata and account/usage data to the published subprocessor list and processing/access countries? We do not assume every listed provider receives every workload record.
Transfer mechanisms: does Railway offer Serbian standard contractual terms or another documented mechanism for a Serbian controller, distinct from EU SCC/DPF mechanisms for eligible EU/UK/Swiss transfers? Please identify applicable documents and versions or the appropriate private privacy channel.
No customer records, credentials or project-specific configuration are included. This question does not authorize access changes, deployment, plan upgrade or paid services.
1 Reply
3 hours ago
The plan figure is a visibility window, not a deletion period. Trial/Hobby can query 7 days, but runtime, build, deploy, HTTP/edge, DNS and network logs are stored for 90 days and then expire automatically, which is why upgrading can show older logs. All of these logs are stored in US West, whatever deploy region you choose.
HTTP access logs hold request metadata, not request bodies: method, host, path without query parameters, status, timing, client IP and User-Agent. They don't include the full set of headers or raw cookie values. Your application's own stdout/stderr or OpenTelemetry traces can still contain anything the app writes or sends to them.
Log entries can't be restricted, redacted or erased one at a time or in batches before they expire, and no setting on any plan changes this.
We don't publish a per-provider mapping of data categories to subprocessors. The published disclosures are the subprocessor list and the DPA. These documents also don't list the countries staff support access may come from, and we won't be providing a list of those countries.
The published DPA is the only data-processing agreement we offer, and we don't amend or supplement it for any customer. That includes adding Serbian-specific transfer clauses. Whether the transfer mechanisms in the DPA are enough for a Serbian controller is a decision for you and your counsel, based on the published documents at railway.com/legal.
Status changed to Awaiting User Response Railway • about 3 hours ago