Security built into every email
Your data and your senders’ trust are our top priority. Here’s how we protect them.
Defense in depth
Every layer of the platform is built with security first.
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest. DKIM signing keys and secrets are encrypted and never exposed.
Scoped access & least privilege
API keys are scoped to specific permissions, hashed at rest, instantly revocable, and rate-limited per key. MFA (TOTP) protects accounts.
Resilient infrastructure
Monitored infrastructure with automated backups and isolated, per-tenant data separation.
Compliance & privacy
GDPR, CCPA, and CAN-SPAM ready, with a Data Processing Addendum (DPA), suppression handling, and one-click unsubscribe built in.
Signed webhooks
Outbound events are HMAC-SHA256 signed and timestamped so you can verify authenticity and prevent replay.
Responsible disclosure
Found a vulnerability? Email security@relayly.io. We investigate promptly and credit responsible researchers.
Data handling
We act as a processor for the email you send. You can access, export, or delete your data at any time, and request a DPA. We never sell personal data and share it only with vetted subprocessors under contract.
privacy@relayly.ioReporting a concern
Security questions or vulnerability reports go straight to the team. We investigate promptly, keep you in the loop, and credit responsible researchers.
security@relayly.ioSend with confidence
Security-first infrastructure on every plan — from the free tier up.
No credit card required.