# Railway privacy rating

Cloud platform for deploying apps, databases and services from Git repositories or Docker images, with usage-based billing.

## Summary

Railway scores 44 out of 100 (grade D) on the app hosting platforms criteria. It meets 3 of 8 criteria: no ads or data sales, tells users about requests and TLS configuration. It partly meets independent audit and transparency report. It does not meet open source, no trackers or telemetry and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade D-.

- Website: https://railway.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: none found
- Category: [App hosting platforms](https://privacyratings.com/app-hosting/)
- Grade: D (44/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. The Railway CLI and the Railpack builder are open source, but the platform is not. |  |
| No trackers or telemetry | No | The privacy policy describes third-party analytics providers, advertising measurement cookies and session replay. | https://railway.com/legal/privacy |
| No ads or data sales | Yes | Funded by paid usage, and the privacy policy says personal data is not sold, shared or used for targeted advertising. | https://railway.com/legal/privacy |
| Independent audit | Partial | Only the SOC 3 summary is public; the SOC 2 Type II report is available on request. | https://docs.railway.com/enterprise/compliance |
| Transparency report | Partial | The data processing addendum describes how government requests are handled, but no request counts are published. | https://railway.com/legal/dpa |
| Tells users about requests | Yes | The data processing addendum promises reasonable notice to customers of compelled disclosure unless legally prohibited. | https://railway.com/legal/dpa |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=railway.com&hideResults=on |
| Security headers | No | Grade D- (25/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=railway.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/app-hosting/railway/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/app-hosting/railway.md