Security at RelayCore

Application and tenant isolation

Each connected application has its own identifiers, API keys, webhook destination, signing secret and assigned WhatsApp numbers. Inbound events are matched to an authorized number before they are forwarded. Outbound requests cannot use a number assigned to another application.

Credential protection

• Meta access tokens are encrypted with authenticated AES-256-GCM encryption.
• Application API keys are stored as keyed hashes rather than recoverable plaintext.
• Webhook signing secrets and application keys can be independently rotated.
• Secrets are revealed only at creation or rotation when operationally necessary.

Webhook and API security

• Meta webhook bodies require a valid HMAC signature before processing.
• Forwarded tenant payloads are re-signed so destination apps can verify RelayCore.
• Destination URLs must use HTTPS and are checked against private-network targets.
• Outbound message requests require an active API key and idempotency key.
• Retries use durable delivery state, bounded attempts and short-lived locks.

Administrative access

The control plane uses Google authentication and a server-side email allowlist. Other Google accounts are rejected. Administrative changes are recorded in an audit trail, including credential rotation and application configuration events.

Responsible disclosure

If you believe you found a vulnerability, email support@relaycore.tech with a clear description, affected URL and safe reproduction steps. Do not access customer data, disrupt service or publicly disclose the issue before it is resolved. We will acknowledge good-faith reports and coordinate remediation.