Security

Last updated: May 25, 2026

This page describes how RelayGuard protects customer data and operates the hosted platform. For product-level RPC integrity features, see Security Mode.

Overview

RelayGuard is a bring-your-own-RPC gateway. You supply provider endpoints and keys; we store the configuration required to route traffic and never sell your data. Our goal is to minimize what we hold, encrypt what we must store, and fail closed on integrity-critical reads when Security Mode is enabled.

Encryption

• In transit — TLS 1.2+ on all public endpoints (dashboard, API, gateway)
• Provider URLs at rest — encrypted with AES-256-GCM using a platform encryption key stored separately from the database
• Passwords — bcrypt hashes only; we never store plaintext passwords
• Gateway API keys — bcrypt hashes and display prefixes; plaintext shown once at creation

API key and secret handling

• Provider URLs and API keys are decrypted in memory only when needed to forward a request
• Secrets are not written to application logs
• Suspicious patterns in provider URL fields can trigger internal review alerts
• Rotate gateway API keys from the dashboard if you suspect compromise

You are responsible for ensuring your RPC provider keys are used in compliance with your provider's terms of service.

Authentication and access control

• Dashboard sessions use HttpOnly, Secure cookies in production
• Workspace data is isolated by tenant; cross-workspace access is denied at the API layer
• Gateway requests require a valid workspace API key
• Internal admin endpoints require separate authentication
• Email verification is required before sensitive dashboard operations

Logging and monitoring

We log operational metadata to run and secure the service:

• Request metadata (chain, method, request ID, status class)
• Provider health transitions, failovers, and Security Mode quorum outcomes
• Rate-limit and authentication failure events

We do not persist full JSON-RPC payloads in logs or the database. See Data boundary for detail.

Infrastructure

• Compute: Fly.io (multi-machine HA for API and gateway in production)
• Database: Fly Managed Postgres with automated backups
• Primary region: US East (iad)
• Metrics and logs: Grafana Cloud (operational telemetry for the founding team)

Subprocessors

We use the following subprocessors to deliver the hosted service:

Your RPC providers (Alchemy, Infura, QuickNode, etc.) are your vendors — not RelayGuard subprocessors — because you bring your own endpoints and keys.

Enterprise customers requiring a DPA or updated subprocessor notice should contact [email protected].

Availability and backups

• Production API and gateway run with multiple machines for high availability
• Database backups: hourly incremental and daily full snapshots
• Status page: gateway.0xrelayguard.com/status

Report a vulnerability

See our Responsible disclosure policy for how to report security issues. Email [email protected] with details.

Related documents

• Privacy Policy
• Data boundary
• Responsible disclosure
• Terms of Service