Encryption
Customer contact details are encrypted at rest with AES-256-GCM, and the encryption key is held outside the database — a database export alone exposes nothing readable. All traffic runs over TLS.
Security
Built to hold less, not just guard more
The strongest protection is data that isn't there. RelayLeads keeps only what a booking needs, encrypts it, deletes it on a timer — and keeps money and card numbers out of its systems entirely.
Retention by default
Customer contact details auto-delete on a retention timer — 30 days by default, adjustable per business, and never past one year. Data that no longer exists can't leak.
Tenant checks on every request
Every business's data is scoped by application-level checks: the tenant is derived only from the authenticated operator's own record — never from a URL or request body — and re-verified on every read and write.
Payments never touch us
Card details are tokenized client-side and go directly to the business's own Stripe or Square account. RelayLeads is never in the funds flow and never stores card numbers.
Logs with nowhere for data to land
Message delivery logs store no phone numbers and no message bodies — by schema, not policy. Push notifications to operators carry no customer data at all, just a secure pointer.
Infrastructure
RelayLeads runs entirely on Cloudflare's global network — Workers, D1, KV, R2, and Queues. Uploaded photos are stripped of location metadata on both the client and the server before storage.
The fine points, plainly
- ✓The operational database holds no customer contact details — only encrypted references.
- ✓Operator sign-in is Google-only — no passwords for us to store or lose.
- ✓Operators see masked customer details in lists; full details render only when they open a specific job.
- ✓Customer information is never sold. What operators export to their own tools is governed by their own practices — see how we handle data.
Found a vulnerability, or have a security question? Email hello@relayleads.io — security reports go to the top of the queue.
Claim your link. We build the rest.
Free, takes about two minutes, no credit card. Your page, booking flow, and dashboard — generated the moment you claim.