Frequently asked questions
Everything about self-hosting, security and daily use. Can’t find your answer? Send us a message.
Hosting & data
Where does my data live?
On the server you deploy to. Relayload is a single Docker Compose stack — PostgreSQL, RabbitMQ, the API and a worker — with no external calls home. EU residency is your deployment boundary.
Do production payloads get stored?
No. The schema makes payload persistence structurally impossible. Only metadata (status, duration, sanitized error codes) is kept, plus opt-in 24-hour test captures.
How do backups work?
A bundled script dumps PostgreSQL and archives TLS certificates; the runbook documents tested restore rehearsals.
Security
How are downstream credentials protected?
AES-256-GCM encryption at rest with a vault master key, per-credential resolution, rotation support, and redaction from every log and error path.
Can the platform be tricked into calling internal addresses?
Every outbound call passes a connection-time SSRF guard: loopback, private, link-local and cloud-metadata ranges are blocked, DNS is pinned, redirects revalidated. Exceptions are explicit and audited.
Which authentication modes can my endpoints use?
Rotated bearer keys, API keys (header or query), HTTP Basic, custom header secrets or anonymous — per integration, or inherited from an organization-wide policy.
Product
Is there a visual editor?
Yes: a graph canvas for workflows and a dual-mode mapping editor (guided form + visual mapper with live connections) whose preview runs the exact production engine.
What formats are supported?
JSON and XML request/response bodies, multipart form data and URL-encoded forms. XML attributes become @keys and repeated elements become arrays.
Can I roll back a bad release?
Publishing creates immutable versions; rollback switches the pointer atomically and in-flight executions keep their pinned version.