Access & governance

Relay's governance layer sits between your team and your databases. Instead of distributing raw credentials, members connect through Relay, which brokers every connection through a Relay agent and enforces masking, policy, access grants, and audit.

The building blocks

• Connections — register a database Relay governs access to.
• Connection groups — organize connections.
• Agents — the brokers that carry every connection, and their replicas.
• Tunnels — live, masked sessions (relay connect).
• Credential sources — resolve passwords from your own secret store at connect time instead of storing them in Relay.
• Access grants — scope which members reach which connections.
• Data masking — redact sensitive columns.
• Query policies — a query firewall.
• Query audit — the SQL-level audit trail.

How a connection is served

member ── relay connect ──► agent
                              │  applies masking + policy
                              ▼
                            your database

The agent resolves the database password at connect time from your credential source, applies masking and policy, records the session for audit, and forwards queries to the real database. Relay's control plane never needs direct network access to your databases.