Procurement pack
A one-page answer to "where does our PII live?" Hand this to your DPO, or save it as a PDF for a security questionnaire attachment.
Architectural summary
Blindrelay is a transactional email relay that does not store message content, except while a deferred delivery waits to retry (up to 24h). Turn retries off and it never touches disk. The customer sends email via POST /v1/send ; Blindrelay DKIM-signs and relays it from the customer's own verified sending domain, then discards the content as soon as delivery is attempted.
- Email body, subject, and headers exist in process RAM only until the MIME message is built for SMTP. A message the recipient's server defers waits on disk with its recipient address for up to 24 hours, unless the workspace turns retries off.
- The recipient address is replaced with a bcrypt hash (cost 12) before any persistent write; a keyed HMAC lookup hash may be stored beside it for the send-time suppression check, and its key is never stored in the database. The plaintext recipient address never appears in logs, errors, or audit rows.
- In-flight coordination rows (id, from, recipient hash, domain, status) are deleted on terminal delivery. Only integer counters and a minimal hashed bounce-correlation mapping (for up to 72 hours) remain.
- Delivery events are exported to the customer's OTLP collector or webhooks; Blindrelay keeps only aggregate integer counters, never per-message events.
- Production infrastructure runs in the EU by default.
Data retention
| Data | During send | After delivery |
|---|---|---|
Body, subject, HTML | In process RAM | Discarded; on disk only while a deferred delivery waits to retry (up to 24h) |
Recipient address | In process RAM | One-way hashes only — a bcrypt hash and a keyed lookup hash, not recoverable from either |
Delivery status | In-flight coordination row | Deleted; integer counters only |
Suppression list | Checked by hash | Hashes + reason only |
Architecture evidence
The no-content-on-disk property is enforced by an automated integration test that runs on every release and is a release blocker. It asserts that no table in the public schema has columns named body , subject , html , or to_address , and that the recipient hash column contains a valid bcrypt hash.
Under NDA, your security team can receive the latest CI evidence and an architecture walkthrough. We do not provide production database access.
Compliance posture
| Data minimization | No message content stored, except while a deferred delivery waits to retry (up to 24h; off with retries turned off). Recipient addresses otherwise persisted only as one-way hashes. |
| EU deployment | Production runs in the EU by default. |
| Encryption in transit | API connections require TLS 1.2 or higher. |
| Processor terms (DPA) | GDPR Article 28 terms are part of the Terms of Service on every plan. No message content is stored. |
| BAA (HIPAA) | Available on request for paid plans. |
| SOC 2 | Not certified. No evidence pack or Type II claim until an audit completes. |
Contact
General and procurement inquiries: info@blindrelay.app. Security questionnaires under NDA can use the same address; request an NDA in the subject line.
Start free