Relay: security, SSO and limits

Where it runs

Relay runs on Google Cloud Run in asia-east1 by default (EU and US regions on request), with Cloud SQL for metadata and Secret Manager for provider keys. Each organisation's data is isolated at the row level; provider keys are stored under a per-organisation secret path and decrypted only inside the request that uses them. Enterprise customers can run Relay inside their own Google Cloud project, in which case no customer data leaves that project.

Keys and secrets

• Provider keys: encrypted at rest in Secret Manager, never logged, never included in traces or exports, redacted in audit diffs.
• Relay keys: stored as salted hashes; the plaintext is shown once at creation. Each key is scoped to one environment and rate-limited.
• Prompt and completion bodies: not stored unless an environment opts in.

SSO

Console sign-in with Google Workspace or Microsoft Entra ID (OIDC) on Business and Enterprise plans; domain-restricted so only your tenant's users can be invited. SCIM provisioning is on the Enterprise roadmap. API access never uses SSO — it uses environment keys.

Fail-open contract

Relay is in your request path, so its availability matters. Three facts:

1. Relay is stateless per request and runs on multiple instances; a single instance failure is invisible to clients.
2. GET /v1/health returns provider channel health and Relay's own status; poll it from your service mesh if you want to route around Relay automatically.
3. Whether your application may bypass Relay and call a provider directly during an outage is an environment policy (fallback_direct: allow | deny). Allowing it trades control for availability; denying it means the application fails closed. Choose per environment, deliberately.

Non-essential work — tracing, evaluation sampling, export — never blocks the response: if it cannot complete, the request still returns and the gap is logged.

Limits (first release)

Limit	Value
Request body	10 MB
Streaming idle timeout	120 s without a provider byte
Total request timeout	600 s
Keys per environment	50
Environments	by plan (1 / 5 / unlimited)
Rate limit per key	configurable, default 600 requests / min
Tags per request	10, 64 chars each

Reporting a vulnerability

[email protected]. We acknowledge within two business days and publish fixes in the changelog. The company-wide security overview, sub-processor list and data processing addendum apply to Relay as to every product.