RAILHUB · FOR ORGANIZATIONS

One place to see — and stop — every agent your company runs.

The protocol keeps every machine accountable to itself — free, forever, unlimited users and machines. RailHub is where the org coordinates: one audit view, one kill switch, one evidence trail across every box you own.

Join early access Talk to us on Discord
Priced per org · unlimited users · never per seat
railhub.ai — org console
Overview
Machines
Receipts
Policies
Evidence

Org overview

acme-robotics · role: org-admin
Machines
24
Receipts today
1,482
Verified
100%
Holds pending
3
MachineOwnerReceiptsPolicyStatus
build-01.localm.ortega412org-default✓ verified
data-pipeline-2j.chen288org-default✓ verified
finance-agentr.osei96strict-finance◌ hold: awaiting approval
ops-runner-ak.novak377org-default✓ verified
release-bots.iyer201release-gate✓ verified
lab-mac-minit.walsh108org-default✓ verified
WHAT RAILHUB ADDS

The protocol governs the machine.
RailHub governs the org.

Every capability below is org-level coordination on top of the free protocol. Nothing here is required to run agents. All of it is required to run a company that runs agents.

Org-wide auditability

Every signed receipt, from every machine, in one queryable view. Filter by user, machine, tool, or time. Answer "what did our agents do last Tuesday" in seconds.

Company kill switch

One button freezes every agent on every machine in the org. Instantly, with a signed record of who pressed it and when. Unfreeze is just as accountable.

Evidence packs

One auditor-ready bundle covering all users and any date range. Signed receipts, approval chains, policy versions — exported, verifiable offline.

Compliance attestation

Who approved what — by role and by period. Attest a quarter with a signed statement backed by the receipt chain, not a spreadsheet someone maintained.

Shared policy & ledger

Write an approval policy once, enforce it on every machine. The shared ledger keeps the org's receipt index consistent — no machine can quietly drift.

Shared runbooks & templates

Publish vetted workflows to the whole org. New machine, new hire, same governed playbook — pulled from your org library, not rebuilt from scratch.

HOW IT SITS ON THE PROTOCOL

RailHub aggregates the proof — never the data.

Every machine runs the protocol free: human-approved airlock, Ed25519-signed receipts, minted and stored locally, verifiable offline. That never changes and never phones home.

RailHub subscribes to signatures and outcomes only. The org sees that an action was approved, by whom, and that its receipt verifies. Payloads never leave the machines they ran on.

✓Receipts stay on the machine that minted them. RailHub holds hashes and signatures.
✓Verification works offline — an auditor never needs RailHub to check a receipt.
✓Pull RailHub out tomorrow: every machine keeps running, fully governed, free.
machine A receipts · local payloads stay here machine B receipts · local payloads stay here machine C receipts · local payloads stay here signatures + outcomes only RailHub org view · kill switch evidence · attestation holds proof, not data
UPGRADED FEATURES · À LA CARTE

Your fleet is mostly idle.
RailHub puts it to work.

Premium upgrades on top of RailHub — added per org, only when you want them. Same protocol, same airlock, same receipts underneath.

Flagship upgrade

Internal compute routing

Your agents need compute. Your org already owns it — sitting idle on desks and in racks. RailHub routes agent workloads to the machines with headroom: the coolest, most idle box gets the job, and the signed receipt follows the work wherever it ran.

✓Idle-aware. A machine takes work only when plugged in, cool, and genuinely free.
✓People first. The owner’s own work always preempts — routed jobs are the lowest-priority tenant.
✓Same governance. Every routed job passes the airlock and mints an Ed25519 receipt, exactly like local work.
live routing · acme-robotics fleet
design-mac.local
92% busy
ops-runner-a
71% busy
build-rig-2
12% · idle
flow: nightly-reconcile → build-rig-2routed · receipt follows the job
Upgrade

Always-on node

A hosted machine that joins your fleet as just another node. Flows keep running when laptops close — same protocol, same airlock, same receipts, still your keys.

Upgrade

Evidence archive

Long-term, org-wide retention of receipts and evidence packs. Immutable, exportable, and verifiable offline years later — your audit trail outlives any laptop.

Plus the coordination pack · multi-user controls
Approvals
Delegated & quorum approvals

An agent proposes; someone else approves. High-blast-radius actions take M-of-N signoff — two humans, one action, all of it receipted.

Approvals
Separation of duties

The person who writes a workflow can’t be the one who approves it. The control auditors ask for by name.

Approvals
Routing & escalation

Approvals route to whoever’s on call and escalate when they go stale. No 2am bottleneck, no orphaned holds.

Registry
Private module registry

Your internal modules and workflows, visible only to your org. Private repos — for agent capability.

Secrets
Scoped credential vault

Teams run with org credentials no member can read. Secrets stay sealed; receipts still prove who used what, when.

Proof
Cross-machine chains

One workflow across five machines is one signed chain — prove the whole path, not five fragments.

Control
Blast-radius budgets & simulation

Cap what a team’s agents can touch or spend — and dry-run the blast radius before anyone approves.

Access
Guest access with expiry

Time-boxed, scoped access for contractors and vendors. It expires on its own; the receipts remain.

Proof
Outside-auditor anchoring

Independent countersignature on the receipts you choose — proof an outsider can trust without trusting you.

Priced per org. Unlimited users.
Never per seat.

Add every developer and every machine in the company — the price doesn't move. The protocol underneath stays $0 forever either way.

Join early access Talk to us on Discord
protocol: $0 forever · railhub: per-org, early access · marketplace: publishers keep 95%