On October 21, Railway, one of the cloud infrastructure providers Confident AI runs on, disclosed a security incident in which an unauthorized party may have accessed environment variables stored on its platform, including some of ours. This incident originated at Railway, and we believe the risk to customer accounts is low. We're still investigating and would rather notify customers early than wait for certainty. Railway is listed in our sub-processors list https://www.confident-ai.com/subprocessors-list#list-of-sub-processors.

We're rotating our own infrastructure credentials and working with Railway as they investigate. Railway has also been experiencing outages, which has delayed some of our deployments. We've asked customers to monitor usage on the model provider API keys they've added to Confident AI, and to hold off on updating keys until we confirm the issue is resolved. We'll post an update here as soon as it's safe to rotate, along with next steps. Questions? Email support@confident-ai.com.