Security Architecture & Trust
Relay is architected from the ground up for teams with strict compliance, intellectual property, and data isolation requirements. Here is how your audio, prompts, and credentials are protected at every phase.
Cryptographic Encryption (AES-256 GCM & TLS 1.3)
In-transit and at-rest standards
All audio streams and API requests transmit exclusively over TLS 1.3 with strict HSTS. Persisted metadata, DAG entity tables, and user sessions are encrypted at rest using authenticated AES-256-GCM with customer-isolated cryptographic key rotation.
FIDO2 WebAuthn & Hardware Security Enclaves
Eliminating passwords and credential theft
Relay utilizes WebAuthn/FIDO2 passkeys stored in the Apple Secure Enclave (iOS/macOS), Android StrongBox, and hardware security keys. Private keys never leave user devices; authentication challenges are verified via cryptographic public key assertions (COSE_Key) on the Ktor server backend.
Ephemeral Audio Processing
Zero long-term audio storage
Spoken audio stems are maintained in temporary volatile memory buffers strictly for the duration of transcription and action item extraction. Once the structured DAG is generated and synchronized, transient raw audio stems are automatically purged from runtime buffers.
Prompt Ingestion & Tool Optimization
Transparent LLM process engineering
Relay ingests user prompt texts and extracted task intents to evaluate, refine, and optimize internal LLM tools and heuristic pipelines. This enables our models to recognize common engineering patterns, improving execution accuracy, latency, and cost-efficiency without sharing or licensing user IP to third-party consumer models or advertising aggregators.
Vulnerability Disclosure Program
Collaborative security research
We value constructive security research. If you discover a potential vulnerability in Relay, please report it securely to security@relay-voice.com. We commit to acknowledging receipt within 24 hours and keeping researchers updated through resolution.