Reads bookmarks, computes health checks, detects URL copies, organizes loose bookmarks, derives the encryption key, encrypts the vault, decrypts restores, validates payloads, and applies profile changes locally.
Trust Center
Trust claims with receipts.
Relay keeps bookmark sync useful without turning your bookmark library into readable cloud data. This page explains the product boundary, permissions, review status, and what evidence we maintain before making trust claims.
Security architecture
Readable bookmarks stay in the browser.
Relay syncs encrypted vault data. The browser reads bookmarks, keeps one readable local Undo point before protected changes, checks library health, derives the encryption key from the recovery key, validates restore payloads, and applies Tidy or profile changes locally.
Stores encrypted vault blobs, applies rate limits, checks ownership proofs, handles plan state, and never receives a readable bookmark library.
Trust signals
The claims are intentionally narrow.
Relay avoids broad certification language until evidence exists. These are the concrete boundaries the product currently maintains.
Bookmark titles, URLs, folders, profiles, and restore snapshots are encrypted before upload.
Relay can move encrypted data and enforce ownership, but it does not receive the recovery key or passkey PRF output needed to read the vault.
Relay stores the chosen username, Support ID, coarse account activity, and sharing relationships, but does not require a legal name or email.
The public site and extension avoid analytics SDKs, ads, tracking pixels, and content scripts.
Relay asks for bookmarks, storage, and a background alarm for core sync. Passkeys use narrowly scoped Relay-domain host access directly inside the popup.
Independent review summaries will be published only after completion, not promised as current certification.
Permission model
Only the permissions the product needs.
The extension permission surface is deliberately narrow and reviewed in CI.
- bookmarks: read, create, move, and replace bookmark trees during sync/profile switching.
- storage: keep local browser identity, session state, plan cache, and sync metadata.
- alarms: resume a queued Pro sync after Chromium suspends the background worker.
- relayextension.com host access: allow inline WebAuthn to use Relay's passkey domain without opening a website tab; no content scripts are injected.
- No browsing-history permission.
- No all-sites host permission; host access is limited to Relay's own apex and www origins.
- No content scripts.
- No remote script execution.
Review status
Trust is evidence, not decoration.
Relay is preparing for independent browser-extension security review. Until that review is complete, the site will say review planned, not certified.
Current status: Chrome Web Store distribution is the normal install path. Independent audit summaries will be published after completion. Relay does not currently claim SOC 2, ISO, or third-party certification.