Security, described plainly.
Your clients trust you with passports, payslips and bank statements. This page lists the controls Relayd has today — and says clearly what it doesn't do yet. We don't claim certifications we don't hold.
Storage
- Documents are stored in private object storage in the EU. The bucket has no public access.
- Each file is saved under a random internal key — never the uploaded file name — and only streams to a browser after Relayd checks access.
- Earlier, replaced and rejected versions are kept alongside the current one, so history is never silently lost.
Links
- Drop, Request and Delivery links contain a 256-bit random token, so they can't be guessed or enumerated.
- Relayd stores only a one-way hash of each token for lookups, plus an encrypted copy under a separate key so your team can copy or email the same link again.
- Links can expire automatically and can be closed instantly. Closed and expired links stop working everywhere.
- Pages opened from a link don't leak it to other sites through the browser's referrer, and aren't indexed by search engines.
Delivery controls
- Every Delivery expires, and can be revoked at any moment.
- On Professional and Business plans, a Delivery can limit how many times each file is downloaded — including one-time downloads — enforced on the server so simultaneous clicks can't exceed it.
- A Delivery can also require the recipient to enter a one-time code sent to their email before any file is shown. Codes expire after 10 minutes, allow five attempts and are stored only as hashes.
- Controls set on a Delivery stay in force even if the workspace later changes plan.
Uploads and downloads
- Uploads are checked for size, accepted type, declared format and the file's actual leading bytes before they're kept.
- Only PDFs and common image formats are ever previewed, from Relayd's own domain with a restrictive content policy. Everything else downloads as a file.
- Uploaded files are never executed. Files are not scanned for malware in this version, so treat downloads like any email attachment.
Accounts and access
- Every record belongs to one workspace, and the server checks that on every request — the browser never chooses whose data it sees.
- Passwords are hashed, sessions use secure, HTTP-only cookies, and email addresses are verified with a one-time code.
- Sign-in, verification and password reset are rate limited, and error messages don't reveal whether an account exists.
- Cloudflare Turnstile checks that forms — sign-in, sign-up, contact, public uploads and changes inside the app — come from a person, verified on our server for every protected action.
- Team members have one of two roles. Only owners manage billing and the team, and a workspace always keeps at least one owner. Invitations are single-use, expire after 7 days and only work for the invited email address.
- Optional Google and Apple sign-in use each provider's standard OAuth flow.
Activity history
- Account and workspace creation, team changes, clients, links, emails sent to clients, uploads, reviews, replacement requests, deliveries, opens, downloads and billing changes are recorded.
- Activity entries never contain passwords, link tokens or document contents.
- Delivery opens and downloads are a history of what happened, not legal proof of receipt.
Payments
- Card details are handled entirely by Stripe and never touch Relayd's servers.
- Subscription changes are applied only from signed Stripe events, not from browser redirects.
Reporting a vulnerability
If you think you've found a security problem in Relayd, please tell us through the contact form with the topic “Security or privacy”. Describe what you found and how to reproduce it; please don't include real client documents or other people's data.
Please give us a reasonable chance to fix an issue before sharing it, and don't access data that isn't yours, degrade the service or test against other people's accounts. We don't run a paid bug bounty. Our machine-readable contact details are in security.txt.