How Relay protects your account

Signing in and authenticating requests

Accounts are managed by Supabase Auth. The API routes behind your account, including your profile, jobs, spaces, and generated documents, require a valid Supabase access token sent in the Authorization header, and requests without one are rejected. The live job progress connection is authenticated the same way: the browser must send your token as the first message after the connection opens, or the server closes it.

A small number of endpoints are public on purpose: basic health and version checks used by our hosting platform, the contact form, and the Stripe billing webhook. The webhook accepts a request only if its Stripe signature verifies.

Keeping each account's data separate

Your profile, jobs, and other records are stored in a Supabase Postgres database with row-level security enabled, so database policies limit each row to the account that owns it. The API also checks that a job, space, or file belongs to you before returning it or streaming its progress.

Where generated files are stored

The resumes and reports Relay generates are stored in a private Supabase Storage bucket, in a folder named after your user ID and the job that produced them. A storage policy restricts each folder to its owner. When you download a file, the API issues a signed link that expires after one hour.

Text sent to AI models

Relay uses AI models from Anthropic and Google to write and review resumes. In the step that writes your resume, your profile and the job description are escaped and wrapped in clearly marked data sections before they are placed into the model prompt, which makes it harder for that text to be read as instructions. The prompt editor's chat assistant also rejects messages that match known prompt-injection patterns. These measures reduce the risk of prompt injection; they cannot rule it out.

What those providers receive, and how long they keep it, is covered in the Privacy Policy.

Input limits and rate limiting

The API enforces size limits on submitted text, such as job descriptions and profile fields, and rate-limits endpoints that are costly or open to abuse, including job submission, billing actions, and the contact form.

Reporting a security issue

If you believe you have found a security vulnerability in Relay, email support@relayresume.com with a description of the issue and the steps to reproduce it. Please do not access, change, or delete other people's data while investigating, and give us a reasonable chance to fix the problem before sharing it publicly.