Legal
Security
Effective date: October 3, 2026
Overview
This page lists the security controls RailVio has today. Each one is stated no more strongly than the product supports, and all of them were last checked on the date above.
Your code is yours
Your app’s code is created in a private repository in your own GitHub account or organization, so you keep it if you leave. RailVio works in it through the GitHub App or access token you grant, and you can revoke either from your GitHub settings.
Credentials are encrypted
Credentials you add to a board are encrypted (AES-256-GCM) before they’re stored, and RailVio’s screens never display them again after you save them. Each time the RailVio app reads one to use it, it first records that read in your Security Activity log (Settings → Security Activity). If the record can’t be written, the read is refused.
Changes are reviewed and tested
Changes our agents make go through an automated pipeline before they merge: tests, type checks, lint, a build, and an AI code review, plus an AI security review when a change touches authentication or other sensitive code.
Your data
What we collect, how long we keep it, and your rights to access, correct, delete or get a portable copy of your data are set out in our privacy policy.
Reporting a vulnerability
If you find a security vulnerability in RailVio, email [email protected] with the details and the steps to reproduce it. The same contact is published at /.well-known/security.txt.
What we don’t claim yet
RailVio doesn’t hold SOC 2, ISO 27001 or any other security certification today.