security

Architecture

security/architecture/page.mdx — The honest “how your email actually flows” trust page. This is the most important page for convincing someone Relais is safe. Content would cover:

• Email content is never stored — Stalwart fires a webhook, Relais passes the raw message to Gmail API, Stalwart responds with “discard”. The email exists in memory for milliseconds during the webhook-to-Gmail handoff. No disk, no database, no S3 bucket.
• The Gmail scope is gmail.insert only — Relais literally cannot read, search, or delete your existing email. You can verify this in your Google account permissions at any time.
• Webhook security uses a shared secret with timing-safe comparison to prevent brute-force attacks.
• Inbound payloads are size-limited (25MB) to prevent abuse.
• If the webhook endpoint is down, Stalwart responds with a temporary failure. The sender’s mail server queues and retries for up to 5 days. Nothing is lost. Tone: matter-of-fact, “here’s exactly what happens, verify it yourself in the source code.”