Verified webhooks
Each domain has its own secret webhook token, plus an optional Svix signature check; the message body is then fetched back from Resend with that domain’s key.
Skip to contentSecurity
Security built into every layer
Email holds your customers’ most sensitive conversations, so RelayRow is secure by default: every inbound webhook is verified, provider keys live in a vault, the database enforces who can see what, and untrusted HTML never runs in your browser.
Updated
How your mail is protected
Keys in a vault
Resend and AI provider keys are stored in Supabase Vault, write-only from the interface, and never sent to the browser.
Row-level security
Every table enforces access in the database itself, so a workspace can only ever read its own domains, mailboxes and mail.
Sandboxed HTML email
HTML messages render in a locked sandbox with scripts disabled and remote images blocked.
Spam and phishing scoring
Every inbound message is scored before anyone opens it, and rules can quarantine it.
Least-privilege roles
Owner, admin, domain admin and operator roles, plus viewer, agent and owner seats per mailbox.
Security at a glance
| Database | PostgreSQL on Supabase with row-level security on every table |
|---|---|
| Secrets | Supabase Vault; only the last characters of a key are ever shown |
| Inbound mail | Per-domain token, optional Svix signature, fetch-back with the domain’s key |
| Webhooks out | HMAC-SHA256 signature header on every automation webhook |
| AI usage | Every call logged with feature, model, mailbox and cost |
| Audit | System logs for inbound mail and automation runs |
Security questions
Who can read our email?
Only people with access to your workspace and, for operators, a seat on the mailbox. The database enforces this with row-level security.
Is email sent to AI providers?
Only for the AI features you switch on, and only to the providers you choose for each feature. Mailboxes can have AI replies set to Off.
How do I report a security issue?
Email hello@relayrow.com with the details. We respond to every report.
🚀 Ready when you are
Run every inbox from one place.
Connect your first domain in minutes — no mail server, no IMAP, no glue code. AI and automations included.