Yes, your PostgreSQL data is encrypted at rest with AES-256. Our Trust Center publishes this as the Encryption-at-rest control: "All data at rest within Railway's systems is encrypted using AES 256, providing robust protection against unauthorized access and ensuring data confidentiality." It covers volume data, volume backup snapshots, and PostgreSQL point-in-time recovery archives. The control page and the SOC 3 report are public, and the SOC 2 Type II report is available there too.

Backups are encrypted under that same control. We handle encryption and key management on our own infrastructure, so you can't see or configure the keys from your workload, and we don't offer customer-managed keys. If you explicitly ask us for support, team members may need access to investigate.

Yes, the private network link between your app and database is encrypted. All traffic between services goes over WireGuard tunnels and stays inside our network, never crossing the public internet, as described in How Private Networking Works.