セキュリティモデル

Railbase uses separate encrypted company Vaults and a System Vault for shared identity and authority. On-premise, the customer operates the hosting boundary. In Managed Cloud, Railbase operates a shared process under the Cloud Schedule and DPA. Separate files and keys do not mean separate virtual machines or operating-system processes.

Core controls

• independently generated company encryption keys and protected installation unlock material;
• tenant-scoped data access and role-based authorisation;
• one human identity with separate installation and company authority;
• signed releases and hash verification;
• fail-closed entitlement at execution;
• audit events for sensitive administration and business actions;
• encrypted file storage when enabled by the operator;
• controlled backup, restore and update procedures;
• human approval policy for high-impact AI actions;
• signed federation pairing between approved estates, only after activation.

Customer duties

The on-premise operator must protect secrets, restrict administrator surfaces, configure TLS/network controls, maintain least privilege, operate backups and promptly apply supported security updates. Managed infrastructure duties follow the Cloud Schedule; customers still control membership and company permissions. These duties can be assigned to an implementation partner but remain part of the customer's operating model.

Reporting

Report a suspected vulnerability through the contact in /.well-known/security.txt. Do not include live customer data in an initial report. Silkway Tech triages reports under its vulnerability-management and incident-response procedures.