Security

Last updated 4 November 2026

Relay holds a boutique's orders, stock, sales and customer list. This is how we look after them, including what we do not do yet.

Connections are encrypted

Every page and the iPhone app reach Relay over HTTPS. Relay talks to your POS, your mailbox, your accounting system and its own service providers over HTTPS too.

Stored data

• Your store's records live in a database and file store run by Supabase in Ireland, and the application runs on Railway in the Netherlands. Supabase encrypts the data it stores.
• The keys Relay holds for your connected systems (your POS, mailbox or accounting sign-in) are encrypted again by Relay, each with its own key, under a master key kept outside the database.
• Your password goes straight to our sign-in provider, which keeps only a scrambled (hashed) form. Relay's own servers never receive it.

Each store is kept apart

Every request is checked against the store you are signed in to, and reads and writes only that store's records. The database also has its own row-level rules, so a sign-in for one store cannot reach another store's rows directly. Inside a store, roles decide who sees what: only owners and managers see the customer list.

Relay acts only when you say so

Relay writes to your POS or web store only after someone in your store approves an order, sends a style or switches stock updates on for that connection. It never writes to your accounting system. Disconnecting a system stops Relay using it at once, and when a store closes Relay deletes its keys for every connected system.

Who at Relay can see your data

Only Relay staff with administrator access, and only to support your store or fix a problem. When one of them opens your store in Relay it is read only, and Relay records that they did. AI providers receive only what a task needs, under business terms that do not let them train on it (see the Privacy Policy).

Payments

Stripe takes card payments. Card numbers go to Stripe and never reach Relay.

What we have not done yet

Relay does not hold a security certification such as SOC 2, and has not yet had an outside security test. We will say so here when that changes.

If something goes wrong

If we confirm that someone has got at a store's data, we tell that store's owners without undue delay, and within 72 hours of confirming it, with what we know and what we are doing about it.

Report a problem

If you think you have found a security problem in Relay, write to support@relay.boutique with “Security” in the subject. Please give us a chance to fix it before telling anyone else, and do not look at or change any store's data while you test.