1. Current controls
2. Identity and sessions
- one-way password hashing using the server platform’s current password-hashing facility;
- random, time-limited session credentials;
- session credentials stored in the mobile operating system’s secure storage;
- server-side authorization on every authenticated account request;
- rate limits for account creation, sign-in and public request forms;
- logout, account-deletion and security revocation controls.
3. Data and infrastructure protection
- HTTPS encryption in transit;
- private configuration and database files outside the public document root;
- prepared database statements and strict input limits;
- account-level isolation for household reads and writes;
- application secrets excluded from client bundles and public source packages;
- in-app deletion of the account and synchronized household data.
The current app does not provide document or voice-file upload. Customers should avoid adding unnecessary sensitive details to responsibility notes.
4. Product-learning safeguards
Optional product learning is off by default. The service accepts only allowlisted, minimized product-use fields keyed to a pseudonymous device value. Responsibility text and other private household content are excluded. A customer can disable learning and erase eligible learning history.
5. Operations and incident response
RELAY uses code checks, dependency review, API smoke tests, restricted administration and production monitoring appropriate to the current service. Security controls and recovery procedures should continue to be reviewed as the service grows.
Suspected incidents are triaged, contained, investigated and documented. Required notifications are handled under applicable law.
6. Reporting a security issue
Use Support, choose “Report a problem” and provide a concise description without credentials, exploit payloads or personal data. Do not test RELAY systems without written authorization.