Self-hosted Railway alternative for HIPAA workloads

Why a self-hosted Railway alternative for HIPAA workloads needs a different answer

If your team runs services that touch electronic protected health information on Railway and needs a business associate agreement, the Railway BAA is only available through an Enterprise agreement. The short answer for most teams that want a different route is to run those workloads in an environment you audit yourself, on Coolify or Kubernetes, where you control the servers, the network path and the evidence. Before you choose, confirm with Railway's sales team what an Enterprise agreement covers, what it excludes and what it costs, because the contract terms define the shared responsibility line you would be buying into.

HIPAA does not issue a certification. HHS states that no Security Rule standard requires an entity to certify compliance, and private certifications do not stop HHS from later finding a violation. The question is therefore not whether a platform carries a badge but which safeguards, configurations and records you own. Under the Security Rule (45 CFR Part 164 Subpart C), covered entities and business associates must address administrative, physical and technical safeguards for all ePHI they create, receive, maintain or transmit. A self-hosted platform moves much of the technical safeguard work, including access control, audit controls, transmission security and integrity, from the vendor's responsibility into yours.

A BAA is a contract, and it does not make a platform compliant on its own. Under 45 CFR 164.314(a)(2)(i), the agreement must require the business associate to comply with the Security Rule, flow the same terms down to subcontractors that handle ePHI and report security incidents. Those clauses only matter if the controls behind them exist and produce records. Before you migrate, inventory which services touch ePHI, map each Security Rule standard to an owner and a technical control, and confirm where logs, backups and access reviews will be kept and for how long. Ask your legal and compliance leads to review the HHS penalty exposure and the pending Security Rule revision as part of that plan.

What the HIPAA Security Rule requires of a hosting platform

The Security Rule applies to covered entities and their business associates for every electronic protected health information (ePHI) they handle, and a hosting platform that stores or transmits ePHI usually falls on the business associate side. The cards below separate the scope question from the safeguard standards, the contract terms and the evidence you will need to show an assessor.

Who the rule covers

The Security Rule under 45 CFR 164.302 applies to covered entities, which are health plans, health care clearinghouses and covered health care providers, and to their business associates, for all ePHI they create, receive, maintain or transmit. If your application stores patient data on servers you operate, your organization is in scope even when no vendor is involved. Confirm with your privacy or legal team which role each party in your stack holds before you design the environment.

Administrative, physical and technical standards

Appendix A to Subpart C lists 18 standards across administrative (164.308), physical (164.310) and technical (164.312) safeguards, with 36 implementation specifications. Of those, 14 are required and 22 are addressable, which means you must assess whether each one is reasonable for your environment and document the decision. Map each specification to a named owner, a system or a runbook before the first patient record reaches the platform.

Technical safeguard specifications

The five technical standards in 164.312 carry 7 implementation specifications. Unique user identification and emergency access procedures are required, while automatic logoff and both encryption specifications are addressable. On a self-hosted stack, you configure these yourself: per-person accounts for the Coolify dashboard and cluster access, session timeouts, TLS in transit and encryption of volumes and backups at rest.

Unique users and emergency access

Every person who touches ePHI needs an individual identity. Shared deployment logins and a single root SSH key for all engineers fail the unique user identification specification in practice, and they make audit trails meaningless. Plan a break-glass account that is stored under dual control, tested on a schedule and logged whenever it is used, so that the emergency access procedure works during an outage.

Business associate contract terms

Under 45 CFR 164.314(a)(2)(i), a business associate contract must require the business associate to comply with the Security Rule, flow the same terms down to subcontractors that handle ePHI, and report security incidents, including breaches of unsecured PHI, to the covered entity. When you run the platform yourself, you still need these terms with any cloud provider, managed database operator or support firm that can reach the data. Ask each one for its signed agreement before onboarding.

No certification exists for HIPAA

HHS states that no Security Rule standard requires an entity to certify compliance, and that private certifications do not prevent HHS from later finding a violation. The Office for Civil Rights enforces the rule through complaints, compliance reviews and audits. Any vendor or consultant who claims HIPAA certification should be asked to explain exactly what they mean, and your own evidence file should show how each safeguard operates in your environment.

Where Railway's HIPAA route stops and what your own environment must cover

The HIPAA route with Railway runs through an Enterprise agreement, so that is the first point to settle before any workload moves. Confirm in writing the current Enterprise terms, which subprocessors touch your data, and exactly what Railway's logs capture and how long they are kept. Do not assume a platform feature satisfies a specific safeguard until Railway documents it for your plan. The HIPAA Security Rule applies to covered entities and their business associates, and a business associate contract under 45 CFR 164.314 must bind the vendor to the Security Rule and to incident reporting. A signed agreement covers the vendor's side only. HHS states there is no HIPAA certification, so no vendor badge replaces your own evidence.

Whatever platform you choose, the operator keeps the work that no vendor can sign for you. Access reviews are the most common gap. Assign named owners for deploy rights, database credentials and secrets, and document the unique user identification and emergency access procedures that 45 CFR 164.312 addresses. Turn on audit logging at the platform, host and database layers, and decide where those logs go and who reviews them. Backups need restore tests as well as schedules. Coolify's own guidance for teams leaving managed platforms notes that a rollback can redeploy an application image but does not restore databases or persistent files. Patch the Linux hosts, the Coolify or Kubernetes control plane, and container images on a written cadence.

Incident response is the last gap. Write a runbook that names who decides whether an event is a security incident, who contacts counsel and the covered entity, and how reporting deadlines are tracked, since business associate contracts require reporting to the covered entity. Test that runbook with a tabletop exercise before you need it. If you move to Kubernetes, the Kubernetes Secrets good practices page explains that Secrets are stored unencrypted in etcd by default, so encryption at rest must be configured and checked. Ask any implementation partner which controls and evidence they will prepare, and confirm with your independent auditor what they will assess.

Which self-hosted options fit HIPAA workloads and what each one costs you

This table compares Coolify on rented servers, a self-managed Kubernetes cluster and Dokku against the HIPAA controls you would own after leaving Railway. Read each row as a question to answer in your own environment, because no option makes a workload compliant by default. The main takeaway is that the software license is free in most cases, while staff time, hardened configuration and evidence collection are the costs that determine the outcome.

Area	Coolify on rented servers	Self-managed Kubernetes	Dokku on your servers
Software license	Apache-2.0, and the self-hosted edition is free with all features	Apache 2.0, with no license fee for the open-source project	MIT licensed, with no license fee for the project
Who configures encryption and access control	You do, including TLS through the proxy, disk encryption and SSH key policy	You do, including etcd encryption at rest, RBAC and API authentication	You do, including TLS, host hardening and SSH access
Secrets handling	Stored in the Coolify instance; confirm where they are encrypted and who can read them	Secrets are unencrypted in etcd by default, so encryption at rest must be enabled or an external store used	Environment variables on the host; plan encryption and restricted file access yourself
Operational footprint	Linux servers connected over SSH, with one coolify-proxy container on each server	A highly available control plane of at least three nodes, a load balancer on port 6443 and etcd backups	Single host or small set of hosts managed through Git pushes and CLI commands
Backups and recovery	Scheduled database backups for PostgreSQL, MySQL, MariaDB, MongoDB and ClickHouse; Redis is not covered	etcd snapshots through etcdctl and restores through etcdutl, plus separate backups of persistent volumes	Backups are your responsibility through the host and database tooling you choose
Audit and access reviews	Confirm what logging and access history the instance keeps and export it to your SIEM	Kubernetes audit logging and RBAC reviews are configured by you and need retention planning	Host-level logs and SSH records; you assemble the evidence
Main cost drivers	Server rental, staff time for hardening, backups, monitoring and patching	Control plane nodes, etcd operations, upgrades on a roughly 14-week minor release cycle, and skilled staff	Lower infrastructure count, but ongoing patching, backups and on-call still fall to your team
Best fit	Teams that need a small footprint and can own host security and evidence	Organizations with platform engineers who already run clusters and need multi-team isolation	Small, single-application workloads where the operator can keep the host tightly controlled

Choosing between Coolify and Kubernetes for ePHI workloads

A small team that runs a handful of servers for one organization usually gets the shortest path to a controlled environment with Coolify. The Coolify instance manages Docker workloads over SSH on hosts you control, so the operator's job is mostly host hardening, patching, backups and access control around a few well-understood components. The trade-off is that every control you would otherwise inherit from a managed vendor now sits on a small group of people.

Operating surface: You patch the Linux hosts, the Coolify installation and the container images, and you own the reverse proxy, which is Traefik by default or Caddy.
Database backups: Scheduled backups cover PostgreSQL, MySQL, MariaDB, MongoDB and ClickHouse, but not Redis, Dragonfly or KeyDB, so any ePHI held in those stores needs a separate recovery plan.
Access and logging: Confirm how the Coolify login, server SSH keys and API tokens are issued, rotated and removed, and where container and proxy logs are shipped.
Preview deployments: Preview builds from pull requests create extra public URLs that copy application data into short-lived environments. For ePHI workloads, disable them unless a documented need exists.
Staffing: Confirm who is on call for host failures, since a single-server design has no built-in failover.

Before committing, confirm the hosting location, the host operating system support matrix and your restore time against the backup configuration you plan to use.

How to deploy a HIPAA workload on your own servers

This sequence moves a HIPAA-scoped workload into an environment you audit and control, with the proxy, secrets, backups, access and restore tests documented as evidence. It produces a running system and a set of records your own assessor can review. It does not make the deployment compliant on its own, because the HIPAA Security Rule applies to your organization's whole program.

Define the audited boundary and data flows
Your security and compliance leads list every server, cluster, database, backup target, log store and administrator account that will create, receive, maintain or transmit ePHI. Document which of these sit inside your audited environment and which are third-party services that need a business associate agreement under 45 CFR 164.314. The step is done when the boundary diagram and the inventory are signed off by the people who own the risk decision.
Install Coolify or prepare the Kubernetes control plane
For a small footprint, the platform team installs Coolify on Linux hosts that meet its documented minimum resources, then connects each server over SSH. For Kubernetes, the team builds a kubeadm high availability cluster with at least three control plane nodes, a TCP load balancer in front of kube-apiserver on port 6443, and an etcd topology chosen deliberately (stacked or external). The step is done when every node reports ready and the cluster passes your hardening baseline, such as checks drawn from the CIS Kubernetes Benchmark.
Configure TLS through the reverse proxy
The team selects the Traefik or Caddy proxy in Coolify, or the ingress option in Kubernetes, and confirms that every ePHI-bearing endpoint is served over HTTPS with valid certificates. If the team chooses the Custom (None) proxy option, it takes on certificate issuance and renewal itself. The step is done when an external scan of each public hostname shows only encrypted connections and the certificate renewal process has been tested at least once.
Encrypt Kubernetes Secrets at rest
Kubernetes stores Secrets unencrypted in etcd by default, so the platform team configures encryption at rest for the API server, restricts list and watch access to Secrets with least-privilege RBAC, or moves credentials into an external store through the Secrets Store CSI Driver. Database passwords and API keys should never sit in plain container environment files in the repository. The step is done when a read of a raw etcd value shows ciphertext and an access review confirms only named service accounts can read Secrets.
Schedule encrypted database backups with retention
For PostgreSQL, Coolify's scheduled backups use the pg_dump custom format and can upload to S3-compatible storage on a cron schedule with retention by count, days or size. Confirm that the target bucket encrypts objects at rest, that credentials are scoped to backup writes, and that retention meets your records policy. Redis, Dragonfly and KeyDB are not covered by Coolify's scheduled backups, so the team must document a separate procedure for any of them that hold ePHI. The step is done when the first scheduled dump appears in the bucket with the expected retention settings.
Restrict access with RBAC and Coolify roles
The team maps each person and service to the smallest role that does the job. In Kubernetes this means RBAC bindings for namespaces that hold ePHI, with human users authenticated through your identity provider using OpenID Connect or an equivalent method. In Coolify, the team assigns roles per team and limits who can view secrets or open a shell in production. The step is done when an access list exported from both systems matches the approved roster and every change is logged for review.
Test restores from the encrypted backups
The team restores a recent PostgreSQL dump into an isolated environment using the Import Backup feature or the documented restore procedure, then verifies row counts and application behavior against a known baseline. Coolify's guidance notes that a rollback can redeploy an application image but does not restore databases or persistent files, so the restore test is the only proof that data can come back. The step is done when a dated restore record, with who ran it and what was checked, is filed with the other operational evidence.

The safeguards, logs and access reviews you own after migration

Moving a HIPAA workload off Railway's managed platform moves several Security Rule safeguards from the vendor to your team. The cards below cover the areas that stay with you: identity and access, administrative logging, encryption, recovery testing and the breach reporting chain under a business associate contract. Each one needs an owner, a written procedure and evidence an assessor can inspect.

Unique user identification and access reviews

The Security Rule requires unique user identification as a required implementation specification under the technical safeguards, so every operator, developer and service account needs its own identity rather than a shared login. Coolify is administered through user accounts and API tokens, so you must decide who holds the admin role, who can deploy to production and how API tokens are issued, scoped and revoked. Schedule access reviews on a fixed cadence, record the reviewer and remove departed staff the same day. Confirm how Coolify's roles and team scoping map to your own separation of duties before go-live.

Audit logging of administrative actions

You need a record of who changed what on the servers, the proxy and the application platform, and when. Coolify keeps its own activity history, but the host operating system logs, SSH sessions, Docker events and Kubernetes audit logs, if you use Kubernetes, sit outside it and must be shipped to storage you control. Define retention, protect log integrity so administrators cannot edit their own trail, and test that a sample change can be traced from the log entry back to the person who made it. Ask your auditor which retention period they expect before you configure it.

Encryption in transit and at rest

Encryption is an addressable specification, so you must document a decision and the reasoning behind it. In transit, Coolify's proxy issues certificates automatically with Traefik or Caddy, but the Custom (None) option leaves TLS entirely to you, and traffic between application containers, databases and the control plane needs its own design. At rest, Kubernetes stores Secrets unencrypted in etcd by default, so you must enable encryption at rest or move secrets to an external store. Check disk encryption on every server, including backup volumes and object storage used for database dumps.

Backup and recovery testing

Coolify's rollback can redeploy a retained application image, but it does not restore databases or persistent files. Scheduled PostgreSQL, MySQL, MariaDB, MongoDB and ClickHouse backups exist, but Redis, Dragonfly and KeyDB are not covered by scheduled backups, so any data held in those stores needs a separate plan. Store copies off the server, encrypt them, set retention and run full restore drills into a clean environment, recording how long the restore took and whether the data matched. Recovery testing is your job, and an untested backup is not evidence that the workload can recover.

Incident reporting under a business associate contract

A business associate contract must require you to report security incidents, including breaches of unsecured PHI, to the covered entity, and to flow the same terms down to any subcontractor that touches ePHI. Your hosting provider, backup storage vendor and monitoring service may each be a subcontractor, so list them and confirm their contracts carry the same terms. Write the escalation path with named roles, the time you commit to notify and the evidence you preserve. Run a tabletop exercise against a stolen-credential scenario so the reporting chain works before a real incident.

Questions buyers ask before moving HIPAA workloads off Railway

Can a self-hosted stack be HIPAA compliant?

No stack is HIPAA certified, because the HIPAA Security Rule has no certification requirement, so the question is whether your environment meets the required safeguards and can show evidence of it. Coolify or Kubernetes running in your own audited cloud account can support those safeguards, but the covered entity or business associate remains responsible for access control, encryption, audit logging, backups and incident response. The HHS FAQ on certification states that private certifications do not prevent HHS from later finding a violation, so treat any vendor claiming HIPAA certification with caution and ask for the specific control evidence instead.

What work and cost drivers apply when self-hosting for HIPAA?

Cost falls into four components: staff time, servers, backups and monitoring, and on-call coverage. Staff time covers installation, hardening, access reviews, patching and documentation, and it recurs every month. Servers are a recurring rental or cloud charge that grows with the number of nodes and whether you run a high-availability control plane. Backups need off-site storage and restore tests, and monitoring and logging need retention that matches your policies. Ask any quote to break out these components and to state which are one-time and which recur.

How long does a HIPAA migration off Railway take?

Duration depends on the number of services, the databases and volumes to move, how many safeguards must be documented, and how much your team already has in place. No duration figure applies to your environment until the scope is written. Ask for a fixed-scope plan that lists each service, database, domain cutover and evidence item with its own milestone, and confirm which of those items your own change management process must approve.

Can our team migrate and run this stack without outside help?

A capable platform or DevOps team can do it alone if it has time, Linux and Docker operations experience, and clear ownership of security controls. The harder parts are usually not the install but the ongoing work: configuring encryption at rest for Kubernetes Secrets if you choose Kubernetes, restoring from backups on a schedule, and running access reviews that show least-privilege use. Assess whether those duties have a named owner before deciding between in-house work and a fixed-scope engagement.

What does a business associate agreement with a consultant involve?

If a consultant creates, receives, maintains or transmits electronic protected health information for you, the HIPAA rules require a business associate contract. Under 45 CFR 164.314, that contract must require the business associate to comply with the Security Rule, flow the same terms down to any subcontractors that handle ePHI, and report security incidents, including breaches of unsecured PHI. Ask whether the engagement involves ePHI access at all, and have your counsel review the agreement before any access to production data is granted.

When do we need an independent assessor such as HITRUST or an auditor?

A HIPAA deployment does not require a HITRUST certification, but you may choose an independent assessment when a customer, partner or internal governance process asks for third-party evidence. HITRUST issues its own certifications through an assessment process, and DeployOpen prepares systems, controls and evidence for such assessments without issuing audit reports or attestations. Decide early whether you need an assessor, because that choice changes the evidence you collect and the scope you define.

What should we ask for in a written scope before starting?

Ask for a fixed scope that names each system, data flow, control and deliverable, along with the acceptance criteria and the responsibilities split between your team and the implementation partner. The scope should cover hardening, backup and restore testing, logging and access review procedures, and the evidence package you will keep. Request that the document also state what is excluded, such as the Railway contract exit, legal review and final compliance determinations, so no assumption is left implicit.

Evidence regulators and assessors ask for under the Security Rule

HHS enforces the HIPAA Security Rule through complaints, compliance reviews and audits, and each review starts with records. The cards below cover the evidence that connects your Kubernetes or Coolify environment to the Security Rule safeguards. DeployOpen prepares these records and controls, but independent auditors and HHS decide whether they are sufficient.

Policies and risk analysis records

Keep written security policies for the platform, plus a dated risk analysis that lists every system holding ePHI, including the Coolify host, Kubernetes nodes, etcd, databases, backups and log stores. Record how each risk was rated, who accepted it and when it is reviewed. Ask whether your business associate contracts with hosting and backup vendors require the Security Rule terms that 45 CFR 164.314 describes.

Access review logs

Produce periodic reviews showing who holds access to the Coolify dashboard, cluster admin roles, SSH keys and database credentials, and whether each grant still matches job need. Kubernetes does not store normal users as API objects, so your identity provider and certificate or token issuance logs become the primary evidence. Confirm that every review leaves a signed or ticketed record.

Configuration baselines

Document the hardening baseline for each node and cluster, and map your settings to the CIS Kubernetes Benchmark, published by the Center for Internet Security. Cover encryption at rest for Secrets, least-privilege RBAC, Pod Security controls and how you detect drift from the baseline. Store each baseline version with its approval date so an assessor can see what was in force during any period.

Backup and restore test records

Keep backup schedules, retention settings and the output of restore tests. A backup that has never been restored is weak evidence of recoverability. For etcd, keep snapshots taken with the etcd snapshot tooling and records of restores performed with etcdutl. For Coolify databases, keep the results of restoring a dump into a clean instance, and note any service, such as Redis, that your backup configuration does not cover.

Incident response records

Maintain the incident response plan, on-call roster, timelines for detection and containment, and post-incident reviews. The business associate contract requires you to report security incidents, including breaches of unsecured PHI, to the covered entity, so the record must show when each incident was identified and when the covered entity was notified. Test the plan with a tabletop exercise and keep its written outcome.

Assessment and enforcement exposure

HHS does not issue HIPAA certificates, so no document you hold proves compliance on its own. The penalty range for violations assessed on or after 28 January 2026 runs from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294, and this is why an assessor will ask for the full evidence set. Ask any third party you engage to state in writing exactly which reports and records it will and will not issue.

What HIPAA penalties and pending rule changes mean for this decision

The penalty exposure is the reason to get this decision right before you move any electronic protected health information. For penalties assessed on or after 28 January 2026, the inflation-adjusted HIPAA civil money penalty runs from $145 per violation to $2,190,294 per violation, with a calendar-year cap of $2,190,294, according to 45 CFR 102.3 as published in 91 FR 3666. Those figures apply to covered entities and business associates alike, so the operator of a self-hosted stack carries the same legal obligations as the platform it replaces. Confirm the figures against the current eCFR text before you cite them in an internal risk register, because the adjustment is updated periodically.

HHS proposed a major revision to the Security Rule on 6 January 2025 (90 FR 898). As of October 2026 no final rule has been published, and the Unified Agenda entry for RIN 0945-AA22 projects final action for July 2027. The proposal would tighten requirements for areas such as asset inventories, encryption, multi-factor authentication and vulnerability scanning, so plan for those controls as likely direction without treating them as current obligations. Ask your privacy and security counsel which proposed items would be expensive to retrofit on a Coolify or Kubernetes host, such as network segmentation and asset tracking, and design those in now.

Practically, this means building the Coolify or Kubernetes environment so that the current Security Rule is met with evidence you can produce, and so that the proposed controls can be added without re-architecture. Keep configuration in version control, record access reviews and retain logs in a store you control. Do not assume the final rule will match the proposal, and do not treat a future rule as a reason to delay the business associate contract or risk analysis that the current rule already requires.

How DeployOpen deploys Coolify and Kubernetes under HIPAA constraints

DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a HIPAA workload moving off Railway, we prepare the hosting environment, its controls and its evidence, while your compliance team and any independent auditor make the final determinations.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope lists which services, databases and environments move, and which ePHI they handle.
We ask you to confirm the hosting location, the Coolify or Kubernetes option, and your business associate arrangements before design begins.

How we build

We install and harden the host, Coolify or the Kubernetes cluster, and the reverse proxy and TLS configuration in your environment.
We configure database backups, access roles, secret handling and logging to match the controls documented in the scope.
We run security testing against the deployed applications and APIs before any production cutover is approved.

How we hand over

You receive architecture documentation, runbooks for deploys, backups and restores, and a map of each safeguard to its owner.
We deliver evidence packages such as configuration records, access review templates and test results for your assessors.
Restore procedures are tested and recorded, so your team can run backups and recovery without relying on us.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover Coolify and Kubernetes version upgrades, patching of the host operating system and periodic access reviews.
Ask us to confirm in writing which parts of compliance readiness we cover and which remain with your compliance team.