Your data and your senders' trust are our top priority. Here's how we protect them.
Every layer of the platform is built with security first.
TLS 1.2+ in transit and AES-256 at rest. DKIM signing keys and secrets are encrypted and never exposed.
API keys are scoped to specific permissions, hashed at rest, instantly revocable, and rate-limited per key. MFA (TOTP) protects accounts.
Monitored infrastructure with automated backups and isolated, per-tenant data separation.
GDPR, CCPA, and CAN-SPAM ready, with a Data Processing Addendum (DPA), suppression handling, and one-click unsubscribe built in.
Outbound events are HMAC-SHA256 signed and timestamped so you can verify authenticity and prevent replay.
Found a vulnerability? Email security@relayly.io. We investigate promptly and credit responsible researchers.
We act as a processor for the email you send. You can access, export, or delete your data at any time, and request a DPA. We never sell personal data and share it only with vetted subprocessors under contract.
Security questions or reports go to security@relayly.io. For privacy requests, contact privacy@relayly.io.