Security, explained plainly.

A dedicated identity service provides the primary sign-in and session flow. Browser sessions use protected cookies, and workspace access also requires an active, verified profile linked to the signed-in account.

Authenticated requests resolve a workspace profile before protected data is loaded. Workspace data is isolated by company and permissions are enforced on the server. Administrator access is fixed, while supported manager and employee permissions can be tailored by workspace.

Stored credentials for optional calendar connections are encrypted before storage. This protection applies to the credentials and tokens needed to operate a connection. Calendar data is sent only to the provider a workspace member chooses to connect.

API keys are hashed and webhook signing secrets are encrypted before storage. Secrets are shown once. Keys support scoped access, expiry, rotation, and revocation. Outbound deliveries require secure public destinations, are signed for verification, use bounded retries, and keep sensitive values out of delivery logs.

The application applies restrictive browser policies and validates where browser changes originate. These controls limit unexpected content, framing, cross-origin changes, information leakage, and access to browser capabilities the product does not need.

Sensitive and resource-intensive routes enforce request limits. Limits cover account access, error reporting, and other abuse-sensitive actions. Deployment checks verify that the required protection is available before the service is considered ready.

A billing service provider renders checkout and processes payment details. RelayBoard stores only the account references and subscription state needed to manage access. Card numbers are handled by the billing provider and are not stored by RelayBoard.

A monitoring service receives errors, limited performance traces, and operational logs. Application context is sanitized, direct personal information is excluded by default, and account context is limited to pseudonymous identifiers and role. Session recording is disabled.

Workspace administrators can download a portable snapshot of workspace business data. Every exported collection is limited to the administrator's company. Credentials, session material, access codes, connection tokens, and billing references are excluded. Successful exports create a metadata-only audit event and are delivered as private, non-cacheable responses.

Administrator-requested workspace deletion runs as a retryable cleanup job rather than an immediate browser action. The job first requests billing cancellation and removes linked identities that are not used by another workspace. If cleanup fails, the workspace remains available for a retry. Provider-managed records may follow separate retention obligations.