Trust and SOC 2 readiness
Railbase security, availability, confidentiality and operating controls.
Updated
Railbase is built for organisations that need a defensible private operating boundary. Silkway Tech LLC maintains a control programme aligned to the SOC 2 Trust Services Criteria. Alignment and readiness are not a claim that an independent SOC 2 report has already been issued.
Control areas
| Area | Current design |
|---|---|
| Access | Separate customer and operator identities, RBAC, optional 2FA and auditable administration |
| Data | Customer-controlled Vault storage, tenant isolation and optional encrypted file storage |
| Distribution | Signed releases, hash verification, private entitlement and managed update path |
| Availability | Backup, restore, health, update rollback and incident runbooks |
| Change | Version control, automated tests, release provenance and controlled deployment |
| Vendor operations | KYC, sanctions/export screening, legal acceptance and billing reconciliation |
| AI | Customer-selected provider, redaction, policy, approvals and audit |
| Federation | Signed pairing and tenant-aware transport between approved estates |
Shared responsibility
Silkway Tech operates railbase.app, signing, licensing and its own security programme. The customer operates the private Railbase estate, user access, hosting network, backup destination, recovery exercise and business-data configuration. An implementation Order may allocate additional duties.
If the current sanctions snapshot is unavailable, the incident is not treated as a match and is escalated as an availability problem. It does not alone revoke a current paid-period entitlement. Railbase continues signed licence validation through a heartbeat whose rolling window is no longer than 24 hours; a confirmed hit follows the separate suspension and review process in the Terms.
Evidence
Customers and qualified prospects can request the current security packet, control summary, subprocessors, DPA, incident contact and available test or provenance evidence through Support. Sensitive evidence is shared under an appropriate confidentiality basis.
FAQ
Is Railbase SOC 2 certified?
Do not infer certification from readiness language. Ask Support for the current independent-assurance status and available report.
Does railbase.app store ordinary Suite records?
No. Those records remain in the customer's private estate. railbase.app stores the control-plane information described in the Privacy Policy.