Security

Account isolation

Every row of data carries an account identifier and is protected by database-level row security. One account can never read another account's brands, projects, history or billing.

Key handling

Klaviyo private keys are encrypted with AES-256-GCM before storage, kept in a server-only table that no browser client can read, and are only decrypted inside a server function while a publish is running. Only a short hint is ever displayed. Keys can be rotated at any time.

Access control and auditing

Roles are stored separately from profiles and checked server-side. Platform administrator access is recorded — user, action, decision and timestamp — in an append-only log that only administrators can read.

Abuse protection

Sensitive operations are rate limited per account, uploads are validated by type and size, and webhook payloads are verified with a timing-safe signature check before processing.

Reporting a vulnerability

Email security reports to hello@renderrelay.app from your account address with steps to reproduce. We acknowledge within two business days and will not pursue good-faith researchers.