# Trust and SOC 2 readiness

> Railbase security, availability, confidentiality and operating controls.

_Updated: 2026-08-18_

Railbase is built for organisations that need a defensible private operating
boundary. Silkway Tech LLC maintains a control programme aligned to the SOC 2
Trust Services Criteria. Alignment and readiness are not a claim that an
independent SOC 2 report has already been issued.

## Control areas

| Area | Current design |
| --- | --- |
| Access | Separate customer and operator identities, RBAC, optional 2FA and auditable administration |
| Data | Customer-controlled Vault storage, tenant isolation and optional encrypted file storage |
| Distribution | Signed releases, hash verification, private entitlement and managed update path |
| Availability | Backup, restore, health, update rollback and incident runbooks |
| Change | Version control, automated tests, release provenance and controlled deployment |
| Vendor operations | KYC, sanctions/export screening, legal acceptance and billing reconciliation |
| AI | Customer-selected provider, redaction, policy, approvals and audit |
| Federation | Signed pairing and tenant-aware transport between approved estates |

## Shared responsibility

Silkway Tech operates railbase.app, signing, licensing and its own security
programme. The customer operates the private Railbase estate, user access,
hosting network, backup destination, recovery exercise and business-data
configuration. An implementation Order may allocate additional duties.

If the current sanctions snapshot is unavailable, the incident is not treated as a match
and is escalated as an availability problem. It does not alone revoke a current paid-period entitlement.
Railbase continues signed licence validation
through a heartbeat whose rolling window is no longer than 24 hours; a confirmed
hit follows the separate suspension and review process in the Terms.

## Evidence

Customers and qualified prospects can request the current security packet,
control summary, subprocessors, DPA, incident contact and available test or
provenance evidence through Support. Sensitive evidence is shared under an
appropriate confidentiality basis.

## FAQ

### Is Railbase SOC 2 certified?

Do not infer certification from readiness language. Ask Support for the current
independent-assurance status and available report.

### Does railbase.app store ordinary Suite records?

No. Those records remain in the customer's private estate. railbase.app stores
the control-plane information described in the Privacy Policy.