The legal provider entity is Railway Corporation, a US-domiciled company. The published DPA at railway.com/legal/dpa is the governing data processing agreement.

For your US West deployment: application workloads and attached volumes run in California. Volume backups and PostgreSQL PITR data follow the deploy region (US West). All logs (application, deploy, build, HTTP) are stored in US West regardless of deploy region. Railway primarily runs services on its own hardware (Railway Metal) and also uses Google Cloud Platform and AWS for additional capacity. The authoritative current subprocessor list is published at trust.railway.com/item/subprocessors, and Google Cloud, AWS, and DataPacket.com are all active subprocessors today. When you explicitly request support, any access needed to investigate your request may be carried out by team members in the United States or other countries where Railway staff work. There is no contractual commitment restricting processing or access to a single country on any plan. Security and audit materials, including SOC 2 Type II, are available at trust.railway.com.

Thank you. The remaining question is the specific country list. Meta requires us to select every country where the provider processes or remotely accesses Platform Data; "other countries where Railway staff work" does not identify those countries.

Please escalate to a human support or privacy specialist and provide the current countries applicable to US West customer workloads, logs, backups, remote operational/support access, and relevant subprocessors. We are not requesting a single-country guarantee or employee identities, only the country names and an authoritative source applicable to this setup.

If a complete list cannot be provided publicly, please direct us to a private privacy/compliance contact or document. Please keep this request open pending that clarification.

For a US West setup, application workloads, attached volumes, volume backups, PostgreSQL PITR data, and all logs are stored in the United States (California). Subprocessor locations are listed per provider on the published subprocessor list, which is the authoritative current source for that part of your disclosure. When you explicitly request support, access may come from the United States or other countries where our staff work. We do not publish a fixed country list for that access, so we can't give you one as complete or authoritative. The documents available for this review are the published DPA and the materials at trust.railway.com, and the provider entity is Railway Corporation.