Hi ! I run a small private application on Railway that stores personal financial data (bank transaction history) for a handful of EU-based users. I am the data controller under GDPR and need to document my processing accurately, so I need precise answers rather than general assurances. The public documentation does not state these. Projects concerned: - Production: 8d9fa610-5ba5-47c4-a0d3-fbf449bc5a2c (Postgres service d87896d0-8651-4dc3-bfda-2af36d41c709) - Staging: 1f18c5cb-af4a-4911-8541-249ace2f8d70 1. ENCRYPTION AT REST a. Are Railway Volumes encrypted at rest? If yes, with what algorithm? b. Who manages the keys — Railway, or the underlying cloud provider? c. Does this depend on plan, region, or volume age? My volumes were created before mid-2026. d. Is there a documentation page or DPA clause I can cite for this? 2. ENCRYPTION IN TRANSIT VIA TCP PROXY I connect to Postgres from outside Railway through the TCP proxy (e.g. reseau.proxy.rlwy.net). a. Is that traffic encrypted end to end, or does the proxy terminate/forward in plaintext? b. Does the proxy support or require TLS to the Postgres instance, and what sslmode should a client use to be certain the connection is protected? c. Is traffic between services on the private network (*.railway.internal) encrypted? 3. BACKUPS AND SNAPSHOTS a. Does Railway retain its own backups or snapshots of volume data? b. If so: where are they stored, for how long, and are they encrypted? c. When a volume or service is deleted, how long until the underlying data is irrecoverably destroyed? I need this for GDPR erasure requests. 4. DATA RESIDENCY AND SUB-PROCESSORS a. In which region and country do the volumes for the projects above physically reside? b. Which cloud provider(s) underlie that region? c. Is there a published sub-processor list and a DPA I can sign or reference? 5. INCIDENT NOTIFICATION If Railway becomes aware of a breach affecting my data, how and within what timeframe am I notified? GDPR gives me 72 hours to notify my own users, so I need to know what I can rely on. Thank you so much in advance — a link to authoritative documentation for each point is ideal, since I need to cite these rather than paraphrase them.

Data protection specifics for Postgres volumes and TCP proxies (GDPR documentation)

francoisgeorgesvieux

HOBBYOP

25 days ago

Hi !

I run a small private application on Railway that stores personal financial data

(bank transaction history) for a handful of EU-based users. I am the data controller

under GDPR and need to document my processing accurately, so I need precise answers rather than general assurances. The public documentation does not state these.

Projects concerned:

Production: 8d9fa610-5ba5-47c4-a0d3-fbf449bc5a2c (Postgres service d87896d0-8651-4dc3-bfda-2af36d41c709)
Staging: 1f18c5cb-af4a-4911-8541-249ace2f8d70

ENCRYPTION AT REST

a. Are Railway Volumes encrypted at rest? If yes, with what algorithm?

b. Who manages the keys — Railway, or the underlying cloud provider?

c. Does this depend on plan, region, or volume age? My volumes were created before mid-2026.

d. Is there a documentation page or DPA clause I can cite for this?
ENCRYPTION IN TRANSIT VIA TCP PROXY

I connect to Postgres from outside Railway through the TCP proxy (e.g. reseau.proxy.rlwy.net).

a. Is that traffic encrypted end to end, or does the proxy terminate/forward in plaintext?

b. Does the proxy support or require TLS to the Postgres instance, and what sslmode should a client use to be certain the connection is protected?

c. Is traffic between services on the private network (*.railway.internal) encrypted?
BACKUPS AND SNAPSHOTS

a. Does Railway retain its own backups or snapshots of volume data?

b. If so: where are they stored, for how long, and are they encrypted?

c. When a volume or service is deleted, how long until the underlying data is

irrecoverably destroyed? I need this for GDPR erasure requests.
DATA RESIDENCY AND SUB-PROCESSORS

a. In which region and country do the volumes for the projects above physically reside?

b. Which cloud provider(s) underlie that region?

c. Is there a published sub-processor list and a DPA I can sign or reference?
INCIDENT NOTIFICATION

If Railway becomes aware of a breach affecting my data, how and within what

timeframe am I notified? GDPR gives me 72 hours to notify my own users, so I

need to know what I can rely on.

Thank you so much in advance — a link to authoritative documentation for each point is ideal, since I need to cite these rather than paraphrase them.

Closed

3 Replies

Railway

BOT

25 days ago

Several of your questions are answered in public docs, and the rest are in the DPA and trust center. Private networking (*.railway.internal) is encrypted via WireGuard (ChaCha20, Curve25519, BLAKE2s) per our docs. The TCP proxy forwards raw TCP without adding or terminating TLS, so protecting the Postgres connection requires configuring SSL on the Postgres instance itself. EU West is in Amsterdam, Netherlands per docs.railway.com/deployments/regions. Deleted volumes are permanently destroyed after a 48-hour grace window. Volume backups are self-managed (Pro plan), with retention per your configured schedule. We hold SOC 2 Type II and SOC 3 certifications at trust.railway.com. For encryption-at-rest specifics, key management, sub-processor list, breach notification SLAs, and data destruction timelines, the DPA is the citable document - you can self-sign it via the DocuSign link on the compliance page.

Status changed to Awaiting User Response Railway • 25 days ago

Status changed to Solved francoisgeorgesvieux • 25 days ago

Railway

Several of your questions are answered in public docs, and the rest are in the DPA and trust center. Private networking (*.railway.internal) is encrypted via WireGuard (ChaCha20, Curve25519, BLAKE2s) per [our docs](https://docs.railway.com/networking/private-networking). The TCP proxy forwards raw TCP without adding or terminating TLS, so protecting the Postgres connection requires configuring SSL on the Postgres instance itself. EU West is in Amsterdam, Netherlands per [docs.railway.com/deployments/regions](https://docs.railway.com/deployments/regions). Deleted volumes are permanently destroyed after a 48-hour grace window. Volume backups are self-managed (Pro plan), with retention per your configured schedule. We hold SOC 2 Type II and SOC 3 certifications at [trust.railway.com](https://trust.railway.com). For encryption-at-rest specifics, key management, sub-processor list, breach notification SLAs, and data destruction timelines, the [DPA](https://railway.com/legal/dpa) is the citable document - you can self-sign it via the DocuSign link on the [compliance page](https://docs.railway.com/enterprise/compliance).

francoisgeorgesvieux

HOBBYOP

25 days ago

Another question:

Is the private network (*.railway.internal) encrypted?

Status changed to Awaiting Railway Response Railway • 25 days ago

Railway

BOT

25 days ago

Apologies, we only correspond in English. Please open a new thread in English.

Status changed to Closed Railway • 25 days ago

Welcome!