An honest inventory
of what you would actually get
Railgun is a beta product being evaluated by organizations. This page lists what works today and what does not, in that order, because the second list is the one that decides whether we are a fit for you.
Read this before you evaluate anything else
Community and channel messages are not encrypted in any Railgun client today, and direct messages are not encrypted on the Electron desktop build either — libsignal loads there, and the handler it selects base64-encodes the message rather than encrypting it. Sealed-box encryption runs only on the browser and development builds. If your reason for looking at Railgun is that discussion must be unreadable by the operator, we do not do that yet, and no configuration turns it on. The mechanism, and what it will take to close, is documented on the encryption reference.
Mail is a second boundary worth understanding. Mail arriving from outside Railgun is plaintext SMTP by the time it reaches us — as it is for every mail provider — and is then encrypted at rest under a key the server holds. Railgun-to-Railgun mail and mail you send are stored as submitted, with no at-rest encryption at all. We can read stored mail either way. Say that out loud in your risk assessment rather than discovering it later.
What works today
Each of these was verified in the running code before it was put on this page.
Communities, channels & group DMs
Persistent spaces with roles, threads, and membership management. Channel content is not encrypted yet — see the limits below before you put client matter in one.
@railgun.chat mail
An @railgun.chat address on our own MX record that receives mail from the outside world, with tracking beacons stripped on arrival. Sending back out is not delivering today, so treat it as inbound-only for now. Read and written inside the Railgun app; there is no IMAP server, so Outlook and Apple Mail cannot connect.
Inbound tracking protection
Incoming mail is scanned for 1×1 beacons, known tracker domains, hidden images, and link-wrapping redirectors, which are stripped before the message reaches you.
Outbound mail tracking, per account
Opens and link clicks on mail you send outside Railgun, viewed in your own mailbox. Tracking is never added to Railgun-to-Railgun mail. There is no organisation-wide rollup.
Encrypted file sharing
Encrypted file sharing (up to 500 MB). Files are stored on Railgun servers; client-side encryption is rolling out with the mobile clients.
Authentication audit log
Sign-in, sign-out, and session events are recorded per account. These are ordinary database rows — useful for review, not tamper-evident, and not an admin-action trail.
Recovery codes
Offline recovery codes issued at registration are the account recovery path. No phone number is required to register or to recover.
REST + WebSocket API
The same API the clients use is available for internal tooling. There are no prebuilt SIEM or ticketing integrations; you would be writing the glue.
Desktop clients
macOS 11+, Windows 10+, and Linux, code-signed and auto-updating. iOS and Android are not released yet — the download page says the same thing.
Support terms by agreement
Response targets, support coverage, and onboarding are defined in a signed customer agreement. No blanket public SLA is promised, and none is implied here.
What does not exist yet
These were previously advertised on this page. None of them are in the product. Some are planned; none has a date we are willing to publish.
SAML / SSO / SCIM
No identity-provider integration exists in the codebase. Accounts are created and managed individually.
Admin console
There is no organisation-level provisioning, policy, or usage dashboard. Roles exist inside a community, not across a tenant.
Retention policies & legal hold
Neither is implemented. Messages are relayed and dropped after delivery; there is nothing to place a hold on.
Custom domain email
The mail server accepts one domain, railgun.chat, and rejects mail addressed to any other. Per-tenant domains do not exist.
IMAP access
Inbound SMTP and outbound direct-MX only. No IMAP server is running, so third-party mail clients cannot connect.
On-premise, air-gapped, or dedicated infrastructure
Production is a single hosted deployment. A dedicated or isolated install would be new engineering work, not a configuration option.
Encrypted direct messages on the desktop client
libsodium sealed boxes (X25519 + XSalsa20-Poly1305) encrypt one-to-one messages only on the client path selected when the native libsignal module is absent — the browser and development builds. On the Electron desktop build libsignal loads, and the IPC handler it selects base64-encodes the message instead of encrypting it, so the relay receives readable text. Treat direct messages as readable by the operator until that handler calls the sealed-box implementation.
Channel & community encryption
Group key distribution is written but not wired in. Channel messages reach the server readable.
Forward secrecy
X3DH and the Double Ratchet are implemented but never instantiated by a shipping client. Today one long-term key opens every message sent to a user.
SOC 2 / ISO 27001
No audit has been performed and none is in progress. We are not going to describe ourselves as "aligned" with a standard nobody has tested us against.
HIPAA, and regulated-data compliance generally
We do not sign BAAs. Compliance is a programme of controls and contracts, not a property of an encryption algorithm.
Where Railgun fits — and where it does not
A reasonable fit
- Internal teams that want their one-to-one messages out of Slack and Google, and can accept that channels are not yet encrypted.
- Small organisations replacing several tools with one, where the admin burden of per-user accounts is tolerable.
- People who need a mail address that strips tracking beacons before they load.
- Pilot and evaluation deployments where the limits above are understood in writing before rollout.
Not a fit today
- Anything where an unencrypted group channel would be a breach — privileged legal discussion, PHI, material non-public information.
- Organisations whose procurement requires SSO, SCIM provisioning, or a completed SOC 2 report.
- Teams that need retention policy enforcement, legal hold, or an admin-side export.
- Anyone who needs mail on @theirdomain.com, or access from Outlook, Apple Mail, or Thunderbird.
- Mobile-first teams — the phone apps are not out.
How we compare, without the spin
vs. Slack / Teams
Slack and Teams store message content their operators can read. So does Railgun today — for channels on every client, and for direct messages on the Electron desktop build, whose encryption handler is still a placeholder. The difference that does hold is that Railgun keeps no server-side message history beyond a 30-day offline queue that holds only what the client sent — ciphertext for sealed-box direct messages — and that this page tells you where the gaps are. If you need encrypted group channels right now, neither we nor they provide them.
vs. ProtonMail for Business
Proton is a mature, audited mail provider with custom domains and its own apps. Railgun is a beta chat platform with a mailbox attached, on one domain, with no audit. What we offer instead is one app for messaging, mail, and calls, and a page like this one telling you where the edges are.
vs. Signal
Signal has the protocol we are still building toward, and it is fully deployed there. Railgun does not have forward secrecy or encrypted groups yet. What Railgun adds is persistent communities, mail, and an API — not stronger cryptography.
vs. Self-hosted Matrix / Element
Matrix gives you encrypted rooms and full control of the server, at the cost of running it. Railgun is managed and simpler to adopt, but you cannot self-host it, and its group encryption is not there yet. For an organisation whose priority is encrypted group chat under its own control, Matrix is the better answer today.
Still interested?
Then you have read the limits, which is the conversation we would rather start from. Tell us what you need it to do and we will tell you whether it does it, including when the answer is no.
Organization pricing is set per agreement and is not published. Railgun does not currently sell desktop subscriptions from this site.