Security
Security
Identity, access control, and network security across Relay.
Relay's security surface spans identity, authorization, and the network.
- Roles & permissions (RBAC) — system and custom roles, bindings, teams, and the workspace gate.
- Members & invitations — who belongs to the organization.
- SSO (OIDC) — enterprise single sign-on.
- Sessions & session policy — the session model and revocation.
- API keys — programmatic access.
- Audit & activity logs — the control-plane trail.
- IP allowlist — restrict access by source IP.
- Private networking — PrivateLink endpoints.
Access control is consistent across everything — the same roles, teams, and audit apply whether a database is Relay-managed or one of your own governed through a connection.
Query audit
The data-plane audit trail of the SQL queries proxied through Relay on connections with audit enabled.
Roles & permissions (RBAC)
Relay's authorization model — permissions, system and custom roles, bindings, teams, the permission matrix, and how access is resolved across organizations and workspaces.