Railway's security incident and what it means for Clerion
Railway, our hosting provider, disclosed that an unauthorised party may have read stored secrets. We revoked every key we kept there, so Clerion's AI features are paused until Railway lets us deploy new ones. Your dashboard and tracking still work.
22 October 2026
On 21 October, Railway, the company that hosts Clerion's servers, disclosed a security incident. An unauthorised party got into the system where Railway stores its customers' environment variables, and for some customers read the decrypted contents. Those variables are where apps like Clerion keep the keys to the services they use.
Railway says the impact may be limited to some customers. It has not told us whether we were one of them, so we are treating every key we stored there as exposed.
What Railway has said
Railway says it detected unusual activity on the morning of 21 October in the systems that hold customer environment variables. It has told every customer to rotate stored secrets, including API keys, database credentials and private registry credentials, and to review their logs. It also says it will contact affected customers directly as it confirms which accounts were hit. Deployments are paused for everyone while it investigates.
What we did
We revoked the keys that were stored at Railway, starting with the ones that could cost money or reach your data. Railway has also paused all deployments while it investigates, which means we cannot yet put the replacement keys on our servers. Until we can, some of Clerion is switched off.
We are acting on the assumption that exposure happened, not on proof that it did. Revoking a key we didn't need to revoke costs us a few days of AI features. Leaving a live key exposed could cost you far more.
Why we can't just swap the keys today
A key stored as an environment variable only takes effect when the service is redeployed. Revoking is instant. Replacing means a deploy. That gap is why some features are off: the old key no longer works, and the replacement can't reach our server until Railway lets us deploy again.
What is paused
- AI features. Briefings, AI answers and anything else that asks a model are off. They come back as soon as we can deploy a new key.
Your dashboard, your reports and the tracking on your site keep working.
What was not exposed
- Your password. We store passwords only as bcrypt hashes in our database. They were never kept at Railway.
- Your card details. Payments go through Dodo Payments' checkout. Card numbers never reach our servers.
- Your visitors' IP addresses. We never store them. Each one is hashed in memory as the visit arrives and then discarded. The key we use for that hashing was among the secrets at Railway, so we are replacing it too.
Your analytics data lives in our database at Supabase in Frankfurt, not at Railway. The key our server uses to reach it was among the stored secrets, so we have replaced it and are reviewing the database logs for any access we can't account for.
What you need to do
Nothing right now. Your tracking snippet needs no change.
When we deploy the new keys, we will also replace the secrets that sign your sessions. That means:
- You will be signed out once and need to sign in again.
- If you connected an AI assistant to Clerion, you will need to connect it again.
What happens next
As soon as Railway resumes deployments, we will deploy the new keys, switch the AI features back on and update this post.
Beyond that, we are reviewing where Clerion runs, and we are putting spending limits and narrower permissions on every key we hold, so a leaked key can do far less.
I'm sorry for the disruption. If you have a question, or you notice anything unusual in your account, write to hello@getclerion.com and I'll answer it myself.
Minura
Updates
22 October 2026. AI features paused. Keys revoked. Waiting for Railway to resume deployments.
Frequently asked questions
Was my Clerion password exposed in the Railway incident?
No. We store passwords only as bcrypt hashes in our database. They were never kept at Railway, where the exposed variables were stored.
Were my card details exposed?
No. Payments go through Dodo Payments' checkout, and card numbers never reach Clerion's servers, so there was nothing to expose at Railway.
Do I need to change my tracking snippet?
No. Your tracking snippet needs no change, and your dashboard, reports and site tracking keep working while the AI features are paused.
Why are Clerion's AI features switched off?
We revoked the model keys stored at Railway. Railway has paused all deployments, so we cannot yet deploy replacement keys. AI returns once we can.
Will I be signed out when the new keys go live?
Yes, once. We will replace the secrets that sign sessions, so you will need to sign in again. AI assistants connected to Clerion must also be reconnected.