Security at rd Relay

What rd Relay holds

Lab-result documents, stored and served exactly as uploaded (never parsed, never altered), product and barcode records, license and permit records for retailers and distributors, and business account information (organization profiles, contact emails, team memberships). Consumers scan records without an account, so rd Relay holds no consumer accounts. Payments are processed by Stripe; rd Relay stores Stripe reference identifiers only and never card numbers.

Tenant isolation

Every account belongs to exactly one organization, and database access is scoped by Postgres row level security. Policies grant reads on an organization's own rows only; a retailer, brand, or distributor queries the same tables and receives zero rows belonging to any other tenant. Tables with no applicable policy deny all access by default. As defense in depth, anonymous database access to sensitive tables (credentials, invite tokens, contact records) has been explicitly revoked, so a future policy mistake cannot silently expose them. Uploaded lab-result files are stored in a private bucket with object-level policies that scope each file to the uploading account. Writes to sensitive tables run only through server-side code, never directly from the browser.

Business verification

Every brand account starts in a pending verification state and goes through business identity verification. Verification status is checked on every public serve path (scan pages, lookup, PDF, badge, brand pages, and share links) through a single gate in code. An account that fails verification or is suspended stops serving publicly immediately, on every surface. The same gate supports withholding records from public view until verification clears, with the owning account shown a clear pending status. Verification establishes who stands behind a record and gives every published document an accountable owner; it is an identity control, not a laboratory authenticity guarantee, and we say so in our terms.

Audit trail

rd Relay records structured audit events for sensitive actions: lab-result uploads and replacements, recalls initiated, cleared, and served, permit changes, team membership and invite changes, API key creation, revocation, and use, verification decisions, and billing events. Each event captures the actor (user, system, or API key), the organization, the target record, and event-specific detail. Row level security scopes these events so an organization's members can read only their own organization's trail. Public record scans are also logged with timestamp and outcome; IP addresses in scan logs are stored only as one-way hashes, and share-link accesses are logged on every attempt, valid or not.

Encryption and credentials

All traffic is served over HTTPS (TLS). Data lives in Supabase managed Postgres and object storage, which provide encryption at rest per Supabase platform documentation. Authentication is handled by Supabase Auth; rd Relay never stores plaintext passwords. API keys are stored as one-way hashes, with only a short prefix retained for display.

Operational safeguards

Public endpoints are rate limited. An automated check runs daily and verifies the live database's row level security policies and grants against the expected posture, so isolation drift is detected rather than assumed. Every schema change ships as a reviewed migration that is replayed on a fresh environment in testing. Lab document storage is mirrored nightly to a separate private backup bucket; the mirror's runs and source-to-backup parity were verified on July 10, 2026. Platform status is published at rdrelay.com/status. A documented restore drill is an open item on our current hardening checklist; we would rather state that plainly than claim a tested recovery posture we have not yet proven.

rd Relay does not currently hold SOC 2, ISO 27001, or similar certifications, and we do not claim them.

Continuity and wind-down

A permanent record is only as good as the plan for the day its custodian goes away. Two protections cover that, one structural and one contractual.

Structural: nothing of yours is trapped.Your barcode registry, your lab-result PDFs, and your audit log export at any time, while the service is running normally. The link on a retailer's product page lives in the retailer's own store, so it can be repointed in minutes.

Contractual: our wind-down commitment. If rd Relay is ever discontinued, we commit to:

• 90 days written notice before the service shuts down.
• A full export for every account— the barcode registry, every lab-result PDF, and the complete audit log as CSV.
• The resolver stays live through the entire notice period— every permanent link keeps serving while you transition, so a printed QR code or a live product page never goes dark without warning.

Adopted as policy July 11, 2026.

Questions

Write to support@rdrelay.com. We will answer specific security questions directly, including the ones this page does not cover.