Does Railyard support single sign-on (SSO)?

Yes. Sign-in is passwordless — use a one-time magic link, or your Google, Microsoft or GitHub identity, with owner, editor and viewer roles. SAML/OIDC federation to your own identity provider (e.g. Okta or Entra ID) is on the roadmap for Enterprise.

Can I self-host Railyard?

Yes, on the Enterprise plan. Railyard ships as a single binary you run on your own infrastructure next to your own PostgreSQL database, so your estate never leaves your network.

Can I export my designs to my DCIM?

Yes. Railyard produces one-click, structured export bundles for Nautobot and NetBox — real data, not screenshots — so your sketch becomes the source of record.

Is there a free trial, and do I need a credit card?

Every plan starts with a 14-day free trial, and no credit card is required to start.

How is my data kept secure?

Passwordless authentication with hashed credentials, role-based access control, and tenant isolation between organisations — with no third-party trackers. See our Security page for the full detail.

Can I cancel anytime?

Yes. Plans are billed per seat; cancel from your billing settings at any time and your plan stays active until the end of the term you have paid for.

What can Railyard model?

Your whole estate — locations, data centres, rows, racks and devices — with structured cabling and circuit tracing, power and thermal budgets, and a built-in library of 692 real hardware models.

Security

How we protect Railyard and your data.

Overview

Security is built into Railyard rather than bolted on. This page describes the controls that are actually in place today — how we host the Service, how we authenticate you without passwords, how we keep one organisation's data separate from another's, and how we handle payments, logging and deletion. If you have a question we don't answer here, or you want to report a vulnerability, contact us at [email protected].

Infrastructure and hosting

Railyard is served over HTTPS only. TLS is terminated at the Cloudflare edge, which also provides DDoS protection and network delivery in front of the application.
The application runs behind a Cloudflare Tunnel and an internal reverse proxy; the app server is not published directly to the public internet.
Application data is stored in a PostgreSQL database. Encryption at rest depends on the host storage configuration. [Confirm at-rest encryption / disk-encryption posture for the production database.]
Self-hosted deployments run the same binary within your own infrastructure, so your data never leaves your environment.

Authentication

Passwordless by design. There are no passwords to phish, guess or leak. You sign in either through a one-time link sent to your email, or — where your organisation enables it — through single sign-on (OIDC/OAuth with providers such as Google, Microsoft or GitHub).
Credentials are stored hashed. Session identifiers, one-time email sign-in links and personal API-token secrets are never stored in plaintext; only their SHA-256 hashes are kept, so a read-only database exposure does not yield usable credentials. API-token secrets are shown once, at creation, and never again.
Hardened session cookie. The session cookie is HttpOnly, marked Secure over HTTPS, and set with SameSite=Lax. Sessions expire, and sensitive actions such as deleting your account or minting API tokens require an interactive browser session — a leaked API token cannot perform them.
SSO account-linking is verified-email gated. A new identity provider is only linked to an existing account when the provider has verified the matching email address.
Abuse controls. Sign-in link requests are rate limited per email address and per source IP so an inbox cannot be spammed and a single source cannot blast many addresses.

Access control and tenant isolation

Access within an organisation is governed by role-based access control with three roles: owner, editor and viewer. Viewers are read-only; editors can change designs; owners additionally manage membership and billing.
Every request is authorised against the caller's membership and role in the specific organisation it targets, so one organisation cannot read or write another's data.
Plan entitlements are enforced server-side, not just hidden in the interface.

Data protection in transit

All traffic is encrypted in transit with TLS.
HTTP Strict Transport Security (HSTS) is enforced with a one-year max-age, includeSubDomains and preload, so browsers refuse to connect over plain HTTP.
The application-to-proxy hop asserts HTTPS to the app, so the session cookie always keeps its Secure flag behind the edge.

Network and application hardening

The Service ships with a strict set of browser security headers applied at the edge:

Content-Security-Policy — default-src 'self' with script-src 'self' (no inline or eval scripts), object-src 'none', frame-ancestors 'none', base-uri 'self', form-action 'self' and connect-src 'self'. The single-page app is fully self-hosted and talks only to its own origin.
X-Frame-Options: DENY and frame-ancestors 'none' — the app cannot be framed, preventing clickjacking.
X-Content-Type-Options: nosniff — blocks MIME-type sniffing.
Referrer-Policy: strict-origin-when-cross-origin — limits referrer leakage.
Permissions-Policy — geolocation, microphone, camera and payment browser features are disabled.
The server software banner is stripped from responses to avoid leaking version details.

Privacy by design

No third-party trackers. Railyard includes no third-party analytics, advertising or cross-site tracking scripts.
Minimal cookies. We use a single strictly-necessary session cookie, plus a short-lived cookie used only during single sign-on. Interface preferences are stored locally in your browser and never sent to us.
Data minimisation. We collect only what the Service needs, and expired sign-in links and sessions are pruned automatically.

See our for the full detail on what we collect and why.

Billing security

Payments are processed by Stripe, a PCI-DSS Level 1 provider. Card details are entered directly with Stripe through its hosted Checkout and Customer Portal — we never receive or store your full card number. We hold only Stripe's customer and subscription references and your plan status. Incoming Stripe webhooks are verified by signature before we act on them.

Audit logging

Significant account and organisation actions are recorded to an append-style audit log, capturing the actor, a timestamp, the action and the source IP address. This trail supports incident investigation and accountability, and is retained for a limited period before being deleted or anonymised.

Data deletion and portability

Export. You can export your design data from within the Service at any time as a downloadable bundle, in a range of formats — your data is never locked in.
Deletion. Deleting your account is a hard delete: your personal workspace and its projects are removed, along with your sessions, memberships, linked identities and API tokens, and personal data keyed to your email such as pending sign-in links and invitations. A limited security/audit record may be retained for a short period, then deleted or anonymised.

Compliance and standards

Our security practices are designed to align with recognised industry standards and the principles of UK GDPR. We do not currently claim formal certification against ISO 27001 or SOC 2. [Update this section if and when a certification or independent audit is completed.]

Reporting a vulnerability

We welcome reports from security researchers and treat them as a priority. If you believe you have found a vulnerability in Railyard, please email [email protected] with enough detail to reproduce the issue. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access, modify or delete data that is not yours, or degrade the Service for others, while testing. We will acknowledge your report and keep you updated on our progress. We do not take legal action against researchers who follow this responsible-disclosure guidance in good faith.