Security

Last updated: October 2026. RelayForge is pre-launch; these are our operating security commitments, not marketing claims.

How we protect the service

• Authentication: API keys are required on all non-public endpoints. Treat your keys like passwords — rotate immediately if exposed.
• Transport: TLS everywhere in production; the API never accepts plaintext credentials.
• Secrets: all configuration via environment variables. Secrets are never hardcoded, never committed to git, never written to logs.
• Logging: structured logs record metadata (timestamps, counts, error codes) — never message bodies, API keys, or credentials.
• Least privilege: production services run as non-root users in minimal containers.

What we ask of you

• Keep API keys server-side; never embed them in client-side code or public repos.
• Use a unique key per environment and rotate on personnel changes.

Reporting vulnerabilities

Email don+relayforge@lifeofmorr.com(placeholder address — being set up) with details. We aim to acknowledge within 48 hours. Please don't publicly disclose before we've had a chance to fix.

What we don't claim

We have not completed a SOC 2 audit or penetration test yet. When we do, the reports and dates will be listed here.