Railway: data processing agreement, subprocessors and data location
Where to find the Railway DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: application hosting and deployment. The table is the short version; the sections below add detail.
Railway at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 10 days Details on objecting |
| Data regions |
|
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Railway
Railway's DPA is not accepted with the terms of service. You submit a DocuSign form, and it binds once Railway signs (section 14). The page shows no effective date and does not say which plans it covers.
Railway gives at least 10 days' email notice of a new subprocessor and you have 10 days to object (section 6.2). If Railway has no alternative, your remedy is to discontinue the affected Service, and fees already owed stay payable (section 6.3).
Section 9.1 says primary processing is in the United States and that local data storage options may be offered to customers on Paid Services, without naming regions. For account and usage data Railway acts as its own controller (section 13), so that data is outside the processor terms.
Railway DPA: where to find it and how it is accepted
Read the DPA on railway.com. Complete the requested information and submit the DocuSign form linked in the DPA; it becomes legally binding when Railway signs in the signature block (section 14). The page shows no effective or last-updated date..
Source: railway.com, checked 2026-10-17Not stated in the source we checked (2026-10-17).
The DPA applies to the Services under the Agreement and does not list which plans are covered. It mentions Paid Services (section 9.1) and Enterprise customers (Exhibit C) only in other contexts.
Source: railway.com, checked 2026-10-17Railway subprocessors: the list and how change notices reach you
Source: trust.railway.com, checked 2026-10-17How changes are announced: Email notice under section 6.2, after the new third party is added to the list at trust.railway.com.
Source: railway.com, checked 2026-10-17Notice before a new subprocessor starts: 10 days.
Section 6.2: at least ten (10) days before a new third party accesses Personal Data, Railway adds it to the list and notifies you by email. The same section says Railway may offer a subscription mechanism and that you agree to subscribe where one is available.
Source: railway.com, checked 2026-10-17You can object within 10 days. If Railway cannot offer a commercially reasonable alternative within a reasonable time, you may discontinue the affected Service by written notice. Discontinuing does not relieve you of fees owed under the Agreement (section 6.3).
Section 6.2: within ten (10) days of receiving the notice, in writing and on reasonable data protection grounds. The section adds that some subprocessors are essential to the Services and that objecting may prevent Railway from providing them.
Source: railway.com, checked 2026-10-17Source: railway.com, checked 2026-10-17Where Railway stores data
- United States (primary processing operations)
Section 9.1: Railway's primary processing operations take place in the United States, and it may offer local data storage options to customers on Paid Services. The DPA names no regions. Exhibit C says Railway infrastructure runs on Google Cloud Platform.
Source: railway.com, checked 2026-10-17How Railway moves data outside the EU and UK
- DPF (where the recipient participates)
- SCCs (Modules 1, 2 and 3)
- UK Addendum
- Swiss FADP modifications
Sections 9.2 to 9.5: transfers use the Data Privacy Framework where the recipient participates in it, otherwise the EU SCCs, deemed entered into, with Irish law and courts. UK transfers use the UK Addendum (Exhibit D). Swiss transfers use the DPF or the SCCs with Swiss modifications. The DPA does not say Railway itself participates.
Source: railway.com, checked 2026-10-17Is Railway a processor or a controller?
Both: processor for some data, controller for other data.
Section 2.1: you are the controller and Railway the processor for Personal Data processed to provide the Services. Section 13: for Company Account Data and Company Usage Data, Railway is an independent controller.
Source: railway.com, checked 2026-10-17Is Railway GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Railway's own documents say:
- A DPA is published: Complete the requested information and submit the DocuSign form linked in the DPA; it becomes legally binding when Railway signs in the signature block (section 14). The page shows no effective or last-updated date.
- A subprocessor list is published.
- Notice of new subprocessors: 10 days. Section 6.2: at least ten (10) days before a new third party accesses Personal Data, Railway adds it to the list and notifies you by email. The same section says Railway may offer a subscription mechanism and that you agree to subscribe where one is available.
- Transfer mechanisms named: DPF (where the recipient participates), SCCs (Modules 1, 2 and 3), UK Addendum, Swiss FADP modifications.
- Data locations named: United States (primary processing operations).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Railway to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Railway, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Railway | Application hosting and deployment | United States (primary processing operations) | DPF (where the recipient participates); SCCs (Modules 1, 2 and 3); UK Addendum; Swiss FADP modifications | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Railway | Application hosting and deployment | United States (primary processing operations) | DPF (where the recipient participates); SCCs (Modules 1, 2 and 3); UK Addendum; Swiss FADP modifications | [DPA](https://railway.com/legal/dpa) | [Subprocessors](https://trust.railway.com/item/subprocessors) |
If you add or replace Railway: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Railway states 10 days of notice before it adds a subprocessor. Section 6.2: at least ten (10) days before a new third party accesses Personal Data, Railway adds it to the list and notifies you by email. The same section says Railway may offer a subscription mechanism and that you agree to subscribe where one is available. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- First check: facts recorded from Railway's own DPA and its Trust Center subprocessor page. The DPA shows no effective date.
- Re-checked the notice, objection, location and transfer clauses against the full text; no changes.
Related vendors
Sources and method
- https://railway.com/legal/dpa checked 2026-10-17
- https://trust.railway.com/item/subprocessors checked 2026-10-17
Facts come from Railway's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: railway.com.